Sean Michael Fay

US Patent:

7975306, Jul 5, 2011

Filed:

Dec 10, 2004

Appl. No.:

11/009572

Inventors:

Brian Chess - Mountain View CA, US
Arthur Do - Danville CA, US
Sean Fay - San Francisco CA, US
Roger Thornton - San Jose CA, US

Assignee:

Hewlett-Packard Development Company, L.P. - Houston TX

International Classification:

G06F 11/00

US Classification:

726 25, 726 3, 726 22, 713188

Abstract:

A computer readable medium includes executable instructions to analyze program instructions for security vulnerabilities. The executable instructions perform a security audit of program instructions. Based upon the security audit, sensors are inserted into the program instructions. The program instructions are executable and the sensors generate a stream of security events. The stream of security events is monitored and security performance results are reported.

US Patent:

8527975, Sep 3, 2013

Filed:

Nov 2, 2007

Appl. No.:

11/934722

Inventors:

Brian Chess - Mountain View CA, US
Sean Fay - San Francisco CA, US
Ayee Kannan Goundan - Los Angeles CA, US

Assignee:

Hewlett-Packard Development Company, L.P. - Houston TX

International Classification:

G06F 9/45
G06F 11/00

US Classification:

717152, 717141, 714 37, 714 381

Abstract:

A computer readable storage medium includes executable instructions to identify a memory operation in target source code. A set of constraints associated with the memory operation are developed. The constraints are converted into a Boolean expression. The Boolean expression is processed with a Boolean satisfiability engine to determine whether the memory operation is potentially unsafe.

US Patent:

8209646, Jun 26, 2012

Filed:

Nov 2, 2007

Appl. No.:

11/934717

Inventors:

Brian Chess - Mountain View CA, US
Sean Fay - San Francisco CA, US
Ayee Kannan Goundan - Los Angeles CA, US

Assignee:

Hewlett-Packard Development Company, L.P. - Houston TX

International Classification:

G06F 17/50

US Classification:

716106, 716107

Abstract:

A computer readable storage medium includes executable instructions to identify a path in target source code. Constraints associated with the path are extracted. The constraints are converted to a Boolean expression. The Boolean expression is processed with a Boolean satisfiability engine to identify either a feasible path or an infeasible path. A feasible path is statically analyzed, while an infeasible path is not statically analyzed.

US Patent:

20050273854, Dec 8, 2005

Filed:

Dec 10, 2004

Appl. No.:

11/010146

Inventors:

Brian Chess - Mountain View CA, US
Arthur Do - Danville CA, US
Sean Fay - San Francisco CA, US
Roger Thornton - San Jose CA, US

International Classification:

H04L009/00
H04L009/32
G06F011/30
G06F012/14

US Classification:

726022000, 713188000

Abstract:

A computer readable medium includes executable instructions to analyze program instructions for security vulnerabilities. The executable instructions convert diverse program instruction formats to a common format. A system model is derived from the common format. A static analysis is performed on the system model to identify security vulnerabilities. Security vulnerabilities are then reported.

US Patent:

20050273859, Dec 8, 2005

Filed:

Dec 10, 2004

Appl. No.:

11/009474

Inventors:

Brian Chess - Mountain View CA, US
Arthur Do - Danville CA, US
Sean Fay - San Francisco CA, US
Roger Thornton - San Jose CA, US

International Classification:

H04L009/00

US Classification:

726025000

Abstract:

A computer readable medium includes executable instructions to analyze program instructions for security vulnerabilities. Executable instructions identify potential security vulnerabilities within program instructions based upon input from an attack database and information derived during a static analysis of the program instructions. Vulnerability tests are applied to the program instructions in view of the security vulnerabilities. Performance results from the vulnerability tests are analyzed. The performance results are then reported.

US Patent:

20050273860, Dec 8, 2005

Filed:

Dec 10, 2004

Appl. No.:

11/009570

Inventors:

Brian Chess - Mountain View CA, US
Arthur Do - Danville CA, US
Sean Fay - San Francisco CA, US
Roger Thornton - San Jose CA, US

International Classification:

H04L009/00

US Classification:

726025000

Abstract:

A method of analyzing program instructions for security vulnerabilities includes applying a static analysis to program instructions during a development phase of the program instructions to identify security vulnerabilities. The security vulnerabilities are used to apply a security test to the program instructions during a testing phase of the program instructions. The security vulnerabilities are analyzed to develop security monitoring criteria to apply to the program instructions during a deployment phase of the program instructions.

US Patent:

20070240138, Oct 11, 2007

Filed:

Apr 9, 2007

Appl. No.:

11/733169

Inventors:

Brian CHESS - Mountain View CA, US
Arthur DO - Danville CA, US
Sean FAY - San Francisco CA, US
Roger THORNTON - San Jose CA, US

Assignee:

FORTIFY SOFTWARE, INC. - Menlo Park CA

International Classification:

G06F 9/45

US Classification:

717143000

Abstract:

A computer readable medium includes executable instructions to analyze program instructions for security vulnerabilities. The executable instructions convert diverse program instruction formats to a common format. A system model is derived from the common format. A static analysis is performed on the system model to identify security vulnerabilities. Security vulnerabilities are then reported.

US Patent:

20130086676, Apr 4, 2013

Filed:

Sep 29, 2011

Appl. No.:

13/248948

Inventors:

Brian V. Chess - Palo Alto CA, US
Sean Patrick Fay - San Francisco CA, US

International Classification:

G06F 11/00
G06F 21/00

US Classification:

726 22

Abstract:

In one implementation, a taint processing applied to a tainted value of an application is identified and an output context of the application associated with output of the tainted value is determined. A notification is generated if the taint processing is incompatible with the output context.