Rick C Lowe

US Patent:

7434058, Oct 7, 2008

Filed:

Jun 7, 2004

Appl. No.:

10/863311

Inventors:

Ratinder Paul Singh Ahuja - Saratoga CA, US
Erik de la Iglesia - Mountain View CA, US
Rick Lowe - Atherton CA, US
Matthew Howard - Saratoga CA, US
William Deninger - Mountain View CA, US

Assignee:

Reconnex Corporation - Mountain View CA

International Classification:

G06F 11/30
H04L 9/00

US Classification:

713177, 713187, 726 32

Abstract:

A document accessible over a network can be registered. A registered document, and the content contained therein, cannot be transmitted undetected over and off of the network. In one embodiment, the invention includes maintaining a plurality of stored signatures over a registered document. In one embodiment, the plurality of stored signatures are generated by extracting content from the document, normalizing the extracted content, and generating the plurality of signatures using the normalized content.

US Patent:

7483916, Jan 27, 2009

Filed:

Jan 6, 2005

Appl. No.:

11/031582

Inventors:

Rick Lowe - Atherton CA, US
Stephen Broeker - Mountain View CA, US

Assignee:

McAfee, Inc. - Santa Clara CA

International Classification:

G06F 17/30

US Classification:

707103Z, 707101

Abstract:

A tag database storing tags indexing captured object can be searched efficiently. In one embodiment, such a search begins by receiving a query for one or more objects captured by a capture system, and determining whether a query time range exceeds a time range of a set of fast tables. In one embodiment, the invention further includes searching the set of fast tables if the query time range does not exceed the time range of the fast tables, the set of fast tables containing tags having meta-data related to captured objects. In one embodiment, the invention further includes searching a set of hourly tables if the query time range does exceed the time range of the fast tables. In one embodiment, the present invention further includes searching a set of daily tables if the query time range also exceeds the time range of the hourly tables.

US Patent:

7774604, Aug 10, 2010

Filed:

Nov 22, 2004

Appl. No.:

10/995454

Inventors:

Rick Lowe - Atherton CA, US
Shaun Coleman - Saratoga CA, US
Erik de la Iglesia - Mountain View CA, US
Samuel King - Los Gatos CA, US
Ashish Khasgiwala - Cupertino CA, US

Assignee:

McAfee, Inc. - Santa Clara CA

International Classification:

H04L 9/32
G06F 12/14
G08B 23/00

US Classification:

713176, 726 23

Abstract:

Objects can be extracted from data flows captured by a capture device. Each captured object can then be classified according to content. Meta-data about captured objects can be stored in a tag. In one embodiment, the present invention includes receiving a request to present a previously captured object to a user, accessing a tag associated with the requested object, the tag containing metadata related to the object, the metadata including an object signature, and verifying that the object has not been altered since capture using the object signature before presenting the object to the user.

US Patent:

7814327, Oct 12, 2010

Filed:

Mar 30, 2004

Appl. No.:

10/815239

Inventors:

Ratinder Paul Singh Ahuja - Saratoga CA, US
Matthew Howard - Saratoga CA, US
Rick Lowe - Menlo Park CA, US
Erik de la Iglesia - Mountain View CA, US
William Deninger - Mountain View CA, US

Assignee:

McAfee, Inc. - Santa Clara CA

International Classification:

H04L 29/06
H04L 9/32
G06F 21/00
G06F 15/173
G06F 15/16

US Classification:

713177, 713162, 713179, 713182, 713168, 709224, 709249

Abstract:

A document accessible over a network can be registered. A registered document, and the content contained therein, cannot be transmitted undetected over and off of the network. In one embodiment, the invention includes maintaining a plurality of stored signatures, each signature being associated with one of a plurality of registered documents, intercepting an object being transmitted over a network, calculating a set of signatures associated with the intercepted object, and comparing the set of signatures with the plurality of stored signatures. In one embodiment, the invention can further include detecting registered content from the registered document being contained in the intercepted object, if the comparison results in a match of at least one of the signatures in the set of signatures with one or more of the plurality of stored signatures.

US Patent:

7899828, Mar 1, 2011

Filed:

Mar 30, 2004

Appl. No.:

10/814093

Inventors:

Erik de la Iglesia - Mountain View CA, US
Rick Lowe - Atherton CA, US
Ratinder Paul Singh Ahuja - Saratoga CA, US
Shaun Coleman - Saratoga CA, US
Samuel King - Los Gatos CA, US
Ashish Khasgiwala - Cupertino CA, US

Assignee:

McAfee, Inc. - Santa Clara CA

International Classification:

G06F 17/30

US Classification:

707741, 707747

Abstract:

Objects captured over a network by a capture system can be indexed to provide enhanced search and content analysis capabilities. In one embodiment the objects can be indexed using a data structure having a source address field to indicate an origination address of the object, a destination address field to indicate a destination address of the object, a source port field to indicate an origination port of the object, a destination port field to indicate a destination port of the object, a content field to indicate a content type from a plurality of content types identifying a type of content contained in the object, and a time field to indicate when the object was captured. The data structure may also store a cryptographic signature of the object to ensure the object is not altered after capture.

US Patent:

7907608, Mar 15, 2011

Filed:

Aug 12, 2005

Appl. No.:

11/202438

Inventors:

Weimin Liu - Sunnyvale CA, US
Erik de la Iglesia - Mountain View CA, US
William Deninger - San Jose CA, US
Rick Lowe - Menlo Park CA, US
Stephen Broeker - Mountain View CA, US

Assignee:

McAfee, Inc. - Santa Clara CA

International Classification:

H04L 12/28
H04L 12/56

US Classification:

370389, 379242, 710316

Abstract:

Packets can be read from a network interface into an application using a single kernel copy. In one embodiment, the invention includes a receiver packet memory to store captured packets, and a network interface driver operating in a kernel of a device to read packets captured by network interface hardware into the kernel by storing captured packets in the receiver packet memory. Then, an application interface can expose the receiver packet memory to an application executing on the device by representing the receiver packet memory as a virtual file.

US Patent:

7949849, May 24, 2011

Filed:

Jun 27, 2005

Appl. No.:

11/168104

Inventors:

Rick Lowe - Atherton CA, US
Stephen Broeker - Sunnyvale CA, US
Weimin Liu - Sunnyvale CA, US

Assignee:

McAfee, Inc. - Santa Clara CA

International Classification:

G06F 12/00
G06F 17/00

US Classification:

711173, 707799, 707823, 709224

Abstract:

A file system can be provided in a capture system to efficiently read and write captured objects. In one embodiment, such a file system includes a plurality of queues to queue captured objects to be written to a disk, each queue being associated with one of a plurality of object types, and each queue containing captured objects of the type associated with each queue. A scheduler can be provided to select one of the plurality of queues, and a block manager to select a partition of a disk, the partition being associated with the object type of the captured objects in the selected queue. A disk controller configured to write contiguous blocks of data from the selected queue to the selected partition is connected to the block manager to enable writing to a disk.

US Patent:

7958227, Jun 7, 2011

Filed:

May 22, 2006

Appl. No.:

11/439112

Inventors:

Ratinder Paul Singh Ahuja - Saratoga CA, US
William Deninger - Mountain View CA, US
Erik de la Iglesia - Mountain View CA, US
Rick Lowe - Menlo Park CA, US

Assignee:

McAfee, Inc. - Santa Clara CA

International Classification:

G06F 15/173

US Classification:

709224

Abstract:

A system and method for capturing objects and balancing systems resources in a capture system are described. An object is captured, metadata associated with the objected generated, and the object and metadata stored.