专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US07856653B2 Method and apparatus to protect policy state information during the life-time of virtual machines 有权
标题翻译：在虚拟机的使用寿命期间保护策略状态信息的方法和装置
公开(公告)号：US07856653B2
公开(公告)日：2010-12-21
申请号：US11392349
申请日：2006-03-29
申请人： Stefan Berger , Trent Ray Jaeger , Ronald Perez , Reiner Sailer , Enriquillo Valdez
发明人： Stefan Berger , Trent Ray Jaeger , Ronald Perez , Reiner Sailer , Enriquillo Valdez
IPC分类号： G06F17/00
CPC分类号： H04L63/102 , H04L63/12
摘要： A scheme for protecting policy state information during the lifetime of a virtual machine is presented. In order to protect and preserve the policy state information of the virtual machine, a process creates a source policy, a mapping policy, and a binary policy. These policies are all different representations of a security policy. The different policy representations are chained together via cryptographic hashes.
摘要翻译：提出了一种在虚拟机生命周期内保护策略状态信息的方案。为了保护和保存虚拟机的策略状态信息，进程创建源策略，映射策略和二进制策略。这些策略都是安全策略的不同表示形式。不同的策略表示通过加密散列链接在一起。

2. 发明授权

US08087090B2 Fuzzy multi-level security 有权
标题翻译：模糊多级安全
公开(公告)号：US08087090B2
公开(公告)日：2011-12-27
申请号：US12131206
申请日：2008-06-02
申请人： Pau-Chen Cheng , Shai Halevi , Trent Ray Jaeger , Paul Ashley Karger , Ronald Perez , Pankaj Rohatgi , Angela Marie Schuett , Michael Steiner , Grant M. Wagner
发明人： Pau-Chen Cheng , Shai Halevi , Trent Ray Jaeger , Paul Ashley Karger , Ronald Perez , Pankaj Rohatgi , Angela Marie Schuett , Michael Steiner , Grant M. Wagner
IPC分类号： G06F11/00 , G06F12/14 , G06F12/16 , G06F7/04 , G08B23/00
CPC分类号： G06N7/023 , G06F21/577 , G06F21/604 , G06F21/6218 , H04L63/105
摘要： An access control system and method includes a risk index module which computes a risk index for a dimension contributing to risk. A boundary range defined for a parameter representing each risk index such that the parameter above the range is unacceptable, below the range is acceptable and in the range is acceptable with mitigation measures. A mitigation module determines the mitigation measures which reduce the parameter within the range by mapping the effectiveness of performing the mitigation measures to determine a residual risk after a mitigation measure has been implemented.
摘要翻译：访问控制系统和方法包括风险指数模块，其计算用于风险的维度的风险指数。为表示每个风险指数的参数定义的边界范围，使得高于该范围的参数是不可接受的，低于该范围是可接受的，并且在该范围内可以用缓解措施来接受。缓解模块通过绘制执行缓解措施的有效性来确定缓解措施实施后的剩余风险，确定减少范围内的参数的缓解措施。

3. 发明授权

US07530110B2 System and method for fuzzy multi-level security 失效
标题翻译：模糊多层次安全的系统和方法
公开(公告)号：US07530110B2
公开(公告)日：2009-05-05
申请号：US11123998
申请日：2005-05-06
申请人： Pau-Chen Cheng , Shai Halevi , Trent Ray Jaeger , Paul Ashley Karger , Ronald Perez , Pankaj Rohatgi , Angela Marie Schuett , Michael Steiner , Grant M. Wagner
发明人： Pau-Chen Cheng , Shai Halevi , Trent Ray Jaeger , Paul Ashley Karger , Ronald Perez , Pankaj Rohatgi , Angela Marie Schuett , Michael Steiner , Grant M. Wagner
IPC分类号： H04K1/00 , H04L9/00 , H04L9/32
CPC分类号： G06N7/023 , G06F21/577 , G06F21/604 , G06F21/6218 , H04L63/105
摘要： An access control system and method includes a risk index module which computes a risk index for a dimension contributing to risk. A boundary range defined for a parameter representing each risk index such that the parameter above the range is unacceptable, below the range is acceptable and in the range is acceptable with mitigation measures. A mitigation module determines the mitigation measures which reduce the parameter within the range.
摘要翻译：访问控制系统和方法包括风险指数模块，其计算用于风险的维度的风险指数。为表示每个风险指数的参数定义的边界范围，使得高于该范围的参数是不可接受的，低于该范围是可接受的，并且在该范围内可以用缓解措施来接受。缓解模块确定减少该范围内的参数的缓解措施。

4. 发明申请

US20080263662A1 SYSTEM AND METHOD FOR FUZZY MULTI-LEVEL SECURITY 有权
标题翻译： FUZZY多级安全系统与方法
公开(公告)号：US20080263662A1
公开(公告)日：2008-10-23
申请号：US12131206
申请日：2008-06-02
申请人： Pau-Chen Cheng , Shai Halevi , Trent Ray Jaeger , Paul Ashley Karger , Ronald Perez , Pankaj Rohatgi , Angela Marie Schuett , Michael Steiner , Grant M. Wagner
发明人： Pau-Chen Cheng , Shai Halevi , Trent Ray Jaeger , Paul Ashley Karger , Ronald Perez , Pankaj Rohatgi , Angela Marie Schuett , Michael Steiner , Grant M. Wagner
IPC分类号： G06F21/00
CPC分类号： G06N7/023 , G06F21/577 , G06F21/604 , G06F21/6218 , H04L63/105
摘要： An access control system and method includes a risk index module which computes a risk index for a dimension contributing to risk. A boundary range defined for a parameter representing each risk index such that the parameter above the range is unacceptable, below the range is acceptable and in the range is acceptable with mitigation measures. A mitigation module determines the mitigation measures which reduce the parameter within the range.
摘要翻译：访问控制系统和方法包括风险指数模块，其计算用于风险的维度的风险指数。为表示每个风险指数的参数定义的边界范围，使得高于该范围的参数是不可接受的，低于该范围是可接受的，并且在该范围内可以用缓解措施来接受。缓解模块确定减少该范围内的参数的缓解措施。

5. 发明授权

US06490625B1 Powerful and flexible server architecture 失效
标题翻译：强大灵活的服务器架构
公开(公告)号：US06490625B1
公开(公告)日：2002-12-03
申请号：US08980074
申请日：1997-11-26
申请人： Nayeem Islam , Trent Ray Jaeger , Jochen Liedtke , Vsevolod V. Panteleenko
发明人： Nayeem Islam , Trent Ray Jaeger , Jochen Liedtke , Vsevolod V. Panteleenko
IPC分类号： G06F1516
CPC分类号： H04L67/2842 , H04L67/1002
摘要： A server complex including at least one hit server with item cache, used to process read and write operations relating to cached items from clients, and at least one miss server, serving as a link to other servers (e.g., web servers, file system servers, and databases) for receiving requests relayed from the hit server(s) which relate to non-cached items and for responding to same. The hit server is a general-purpose, generic, component, which is independent of concrete applications and is basically responsible for the performance; while a miss server is a highly-customizable component, which is responsible for flexibility, and is application specific. The inventive architecture provides improved performance whereby a server complex achieves exceptionally high throughput rates for local services (i.e., services using items in the local item cache); flexibility, whereby a server complex can support the enforcement of a variety of application-specific policies for item management, authentication, and item consistency; security, whereby a server complex can enable the verification of the source, integrity, and freshness of communications over untrusted links; and, scalability, whereby a server complex is expandable by adding server components and implementing customized item consistency policies.
摘要翻译：包括至少一个具有项目缓存的命中服务器的服务器复合体，用于处理与来自客户端的缓存项目相关的读取和写入操作，以及至少一个未命中服务器，用作到其他服务器（例如，Web服务器，文件系统服务器和数据库），用于接收从命中服务器转发的与非高速缓存的项目相关的请求并对其进行响应。命中服务器是一个通用的，通用的组件，它独立于具体的应用，基本上是对性能的负责; 而一个小姐服务器是一个高度可定制的组件，它负责灵活性，并且是特定于应用程序的。本发明的架构提供了改进的性能，由此服务器复合体对本地服务（即，使用本地项目高速缓存中的项目的服务）实现极高的吞吐率; 灵活性，从而服务器复合体可以支持对项目管理，认证和项目一致性的各种特定于应用程序的策略的强制执行; 安全性，由此服务器组合可以通过不可信链接来验证通信的来源，完整性和新鲜度; 以及可扩展性，从而通过添加服务器组件和实现自定义项目一致性策略来扩展服务器组合。

6. 发明授权

US06862734B1 Mechanism for synchronous interprocess communication over transparent external monitors 失效
标题翻译：通过透明外部监视器进行同步进程间通信的机制
公开(公告)号：US06862734B1
公开(公告)日：2005-03-01
申请号：US09661341
申请日：2000-09-14
申请人： Trent Ray Jaeger , Jonathon Earnshaw Tidswell
发明人： Trent Ray Jaeger , Jonathon Earnshaw Tidswell
IPC分类号： G06F3/00 , G06F9/44 , G06F9/46 , G06F13/00
CPC分类号： G06F9/54 , G06F2209/542
摘要： A method and system for performing interprocess communications (IPCs). The method comprises the steps of receiving IPC requests, where each of the IPC requests identifies a source and a destination; building IPCs in response to the request: transmitting the IPCs from the sources to the destinations; and intercepting and examining selected ones of the IPCs. The method comprises the further step of controlling the synchrony of the IPCs so that each IPC appears to its source and destination to be implemented according to the same semantics regardless of whether the IPC is intercepted and examined. With the preferred embodiment of this invention, the system monitors are considered as an extension of the system kernel (although they may be linked into the kernel and run in kernel mode as well), so the source and destination are treated as if the kernel is still processing the IPC. Thus, the desired. semantics of communication can be implemented in the monitors.
摘要翻译：一种用于执行进程间通信（IPC）的方法和系统。该方法包括接收IPC请求的步骤，其中每个IPC请求标识源和目的地; 根据请求建立IPC;将IPC从源传输到目的地; 截取和检查选定的IPC。该方法包括进一步控制IPC的同步的步骤，以便每个IPC看起来根据相同的语义来实现其源和目的地，而不管IPC是否被拦截和检查。利用本发明的优选实施例，系统监视器被认为是系统内核的扩展（尽管它们可以链接到内核并且以内核模式运行），因此源和目的地被视为如同内核是仍处理IPC。因此，所需的。通信语义可以在监视器中实现。

7. 发明授权

US06202132B1 Flexible cache-coherency mechanism 失效
标题翻译：灵活的高速缓存一致性机制
公开(公告)号：US06202132B1
公开(公告)日：2001-03-13
申请号：US09473660
申请日：1999-12-29
申请人： Nayeem Islam , Trent Ray Jaeger , Jochen Liedtke , Vsevolod V. Panteleenko
发明人： Nayeem Islam , Trent Ray Jaeger , Jochen Liedtke , Vsevolod V. Panteleenko
IPC分类号： G06F1212
CPC分类号： G06F12/0837 , G06F12/0815 , Y10S707/99952
摘要： A cache system in accordance with the present invention consists of one or more cache components and a set of one or more consistency-replacement functions. A cache component caches one or more items in its one or more cache entries. Items that hit in the cache can result in corresponding cache entries being read or written. Any valid entry in a cache component includes status information reflecting whether the entry has been accessed and whether it has been modified, and is linked to a consistency-action matrix that, in correspondence with the entry's status information and access type (i.e. read or write), determines what consistency action has to be executed in conjunction with the current entry access. Consistency actions and the consistency-action matrix are the inventive mechanisms for implementing cache-coherency and cache-replacement policies. Any valid entry in a cache is linked to a consistency-replacement function that implements one or more consistency and/or replacement policies. Consistency-replacement functions are application-specific and are implemented by means of the consistency-action matrix.
摘要翻译：根据本发明的缓存系统由一个或多个缓存组件和一组一个或多个一致性替换功能组成。缓存组件缓存其一个或多个高速缓存条目中的一个或多个项目。缓存中的项目可能导致相应的缓存条目被读取或写入。高速缓存组件中的任何有效条目包括反映该条目是否被访问以及是否被修改的状态信息，并被链接到一致性动作矩阵，该矩阵对应于该条目的状态信息和访问类型（即读取或写入），确定与当前条目访问一起执行的一致性操作。一致性动作和一致性动作矩阵是用于实现高速缓存一致性和高速缓存替换策略的创新机制。缓存中的任何有效条目都链接到实现一个或多个一致性和/或替换策略的一致性替换功能。一致性替换功能是特定于应用程序的，并且通过一致性操作矩阵来实现。

8. 发明授权

US6032228A Flexible cache-coherency mechanism 失效
标题翻译：灵活的高速缓存一致性机制
公开(公告)号：US6032228A
公开(公告)日：2000-02-29
申请号：US978745
申请日：1997-11-26
申请人： Nayeem Islam , Trent Ray Jaeger , Jochen Liedtke , Vsevolod V. Panteleenko
发明人： Nayeem Islam , Trent Ray Jaeger , Jochen Liedtke , Vsevolod V. Panteleenko
IPC分类号： G06F12/08 , G06F12/12
CPC分类号： G06F12/0837 , G06F12/0815 , Y10S707/99952
摘要： A cache system in accordance with the present invention consists of one or more cache components and a set of one or more consistency-replacement functions. A cache component caches one or more items in its one or more cache entries. Items that hit in the cache can result in corresponding cache entries being read or written. Any valid entry in a cache component includes status information reflecting whether the entry has been accessed and whether it has been modified, and is linked to a consistency-action matrix that, in correspondence with the entry's status information and access type (i.e. read or write), determines what consistency action has to be executed in conjunction with the current entry access. consistency actions and the consistency-action matrix are the inventive mechanisms for implementing cache-coherency and cache-replacement policies. Any valid entry in a cache is linked to a consistency-replacement function that implements one or more consistency and/or replacement policies. Consistency-replacement functions are application-specific and are implemented by means of the consistency-action matrix.
摘要翻译：根据本发明的缓存系统由一个或多个缓存组件和一组一个或多个一致性替换功能组成。缓存组件缓存其一个或多个高速缓存条目中的一个或多个项目。缓存中的项目可能导致相应的缓存条目被读取或写入。高速缓存组件中的任何有效条目包括反映该条目是否被访问以及是否被修改的状态信息，并被链接到一致性动作矩阵，该矩阵对应于该条目的状态信息和访问类型（即读取或写入），确定与当前条目访问一起执行的一致性操作。一致性动作和一致性动作矩阵是用于实现高速缓存一致性和高速缓存替换策略的创新机制。缓存中的任何有效条目都链接到实现一个或多个一致性和/或替换策略的一致性替换功能。一致性替换功能是特定于应用程序的，并且通过一致性操作矩阵来实现。

9. 发明授权

US06748452B1 Flexible interprocess communication via redirection 有权
标题翻译：通过重定向进行灵活的进程间通信
公开(公告)号：US06748452B1
公开(公告)日：2004-06-08
申请号：US09276869
申请日：1999-03-26
申请人： Kevin John Elphinstone , Trent Ray Jaeger
发明人： Kevin John Elphinstone , Trent Ray Jaeger
IPC分类号： G06F15163
CPC分类号： H04L63/102
摘要： A mechanism for inter-process communication (IPC) redirection is defined that enables flexible and dynamic management of IPC paths. In some cases, it is desirable to interpose a process on a communication channel. There are a number of uses of such interposition, ranging from auditing communication to capturing requests for a debugger to authorizing operations expressed in the communication. Prior IPC mechanisms typically do not enable dynamic and flexible interposition. Either interposition is ingrained in the process identity or is done in an ad hoc manner (e.g., by inserting code into the kernel). An IPC mechanism is defined that enables a communication from a source to a destination to be arbitrarily redirected. Services, called redirection controllers, are defined that are able to specify the redirections for IPC paths. Redirections may be set up dynamically because the redirection data is not dependent on permanent information like the process identifier, but rather, they are left to the discretion of the redirection controllers.
摘要翻译：定义了一种进程间通信（IPC）重定向机制，可实现对IPC路径的灵活和动态管理。在某些情况下，最好在一个通信通道上插入一个进程。这种插入有许多用途，从审计通信到捕获调试器的请求到授权在通信中表达的操作。先前的IPC机制通常不能实现动态和灵活的插入。任何插入在进程标识中根深蒂固，或者以ad hoc方式（例如，通过将代码插入到内核中）完成。定义了IPC机制，使得能够任意地重定向从源到目的地的通信。定义了称为重定向控制器的服务，可以指定IPC路径的重定向。可以动态地设置重定向，因为重定向数据不依赖于诸如进程标识符的永久信息，而是由重定向控制器决定。

10. 发明授权

US6044466A Flexible and dynamic derivation of permissions 失效
标题翻译：灵活和动态的权限派生
公开(公告)号：US6044466A
公开(公告)日：2000-03-28
申请号：US979807
申请日：1997-11-25
申请人： Rangachari Anand , Frederique-Anne Giraud , Nayeem Islam , Trent Ray Jaeger , Jochen Liedtke
发明人： Rangachari Anand , Frederique-Anne Giraud , Nayeem Islam , Trent Ray Jaeger , Jochen Liedtke
IPC分类号： G06F1/00 , G06F9/46 , G06F21/00 , G06F12/14
CPC分类号： G06F21/6218 , G06F21/54 , G06F21/604 , G06F9/468 , G06F2221/2105 , G06F2221/2141 , G06F2221/2149
摘要： A dynamic derivation mechanism is defined which enables limited permissions to be dynamically and flexibly derived for executables based upon their authenticated description. The dynamic derivation mechanism uses the authenticated description to determine the maximal permissions that individual principals can delegate to the content. A principal's maximal permissions for content define a superset of the rights that that principal will actually delegate to that content. Although the maximal permissions are derived from predefined specifications, the specifications can be sensitive to runtime state on the downloader's system or previous delegations to enable the dynamic (i.e., runtime) derivation. Multiple principals can delegate a subset of their maximal permissions for the executable content. The mechanism uses policy for combining the delegated permissions into the content's runtime permissions.
摘要翻译：定义了一种动态导出机制，其使得有限权限能够基于其经认证的描述被动态地和灵活地导出为可执行文件。动态导出机制使用经过身份验证的描述来确定各个主体可以委托给内容的最大权限。委托人对内容的最大权限定义了该主体将实际委托给该内容的权限的超集。尽管最大权限是从预定义规范中得出的，但规范可能对下载程序系统上的运行时状态或先前的委派来敏感，以实现动态（即运行时）派生。多个主体可以委托其可执行内容的最大权限的一部分。该机制使用策略将委派的权限组合到内容的运行时权限。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式