Patent Grant
8667121
The present invention relates to computer networks and, more particularly, to a system and a method for managing data and policies.
Computer networks have become indispensable tools for modern business. Enterprises can use networks for communications and, further, can store data in various forms and at various locations. Critical information frequently propagates over a network of a business enterprise. Modern enterprises employ numerous tools to control the dissemination of such information and many of these tools attempt to keep outsiders, intruders, and unauthorized personnel from accessing valuable or sensitive information. Commonly, these tools can include firewalls, intrusion detection systems, and packet sniffer devices.
The ability to offer a system or a protocol that offers an effective data management system, capable of securing and controlling the movement of important information, provides a significant challenge to security professionals, component manufacturers, service providers, and system administrators alike.
The present invention is illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings in which like reference numerals refer to similar elements and in which:
Although the present system will be discussed with reference to various illustrated examples, these examples should not be read to limit the broader spirit and scope of the present invention. Some portions of the detailed description that follows are presented in terms of algorithms and symbolic representations of operations on data within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the computer science arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared and otherwise manipulated.
It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise, it will be appreciated that throughout the description of the present invention, use of terms such as “processing”, “computing”, “calculating”, “determining”, “displaying” or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.
As indicated above, one embodiment of the present invention is instantiated in computer software, that is, computer readable instructions, which, when executed by one or more computer processors/systems, instruct the processors/systems to perform the designated actions. Such computer software may be resident in one or more computer readable media, such as hard drives, CD-ROMs, DVD-ROMs, read-only memory, read-write memory and so on. Such software may be distributed on one or more of these media, or may be made available for download across one or more computer networks (e.g., the Internet). Regardless of the format, the computer programming, rendering and processing techniques discussed herein are simply examples of the types of programming, rendering and processing techniques that may be used to implement aspects of the present invention. These examples should in no way limit the present invention, which is best understood with reference to the claims that follow this description.
One embodiment of the present invention is now illustrated with reference to
There are various other possible configurations. For example, router 20 can also forward a copy of all incoming data to capture system 22 as well. Furthermore, capture system 22 can be configured sequentially in front of, or behind router 20, however this makes capture system 22 a critical component in connecting to Internet 12. In systems where router 20 is not used, the capture system can be interposed directly between LAN 10 and Internet 12. In one embodiment, capture system 22 has a user interface accessible from a LAN-attached device, such as one of clients 16.
In one embodiment, capture system 22 intercepts all data leaving the network. In other embodiments, the capture system can also intercept all data being communicated inside the network. In one embodiment, capture system 22 reconstructs the documents leaving the network and stores them in a searchable fashion. Capture system 22 can then be used to search and sort through all documents that have left the network. There are many reasons such documents may be of interest, including network security reasons, intellectual property concerns, corporate governance regulations, and other corporate policy concerns.
One embodiment of the present invention is now described with reference to
One embodiment of object assembly module 28 is now described in more detail with reference to
In one embodiment, reassembler 36 begins a new flow upon the observation of a starting packet defined by the data transfer protocol. For a TCP/IP embodiment, the starting packet is generally referred to as the “SYN” packet. The flow can terminate upon observation of a finishing packet, e.g., a “Reset” or “FIN” packet in TCP/IP. If it is observed that reassembler 36 is finishing within some time constraint, it can terminate the flow via a timeout mechanism. In an embodiment using the TPC protocol, a TCP flow contains an ordered sequence of packets that can be assembled into a contiguous data stream by reassembler 36. Thus, in one embodiment, a flow is an ordered data stream of a single communication between a source and a destination.
The flow assembled by reassembler 36 can then be provided to a protocol demultiplexer (demux) 38. In one embodiment, protocol demux 38 sorts assembled flows using the TCP Ports. This can include performing a speculative classification of the flow contents based on the association of well-known port numbers with specified protocols. For example, Web Hyper Text Transfer Protocol (HTTP) packets—i.e., Web traffic—are typically associated with port 80, File Transfer Protocol (FTP) packets with port 20, Kerberos authentication packets with port 88, and so on. Thus, in one embodiment, protocol demux 38 separates all the different protocols in one flow.
In one embodiment, a protocol classifier 40 also sorts the flows in addition to protocol demux 38. In one embodiment, protocol classifier 40 (operating in either parallel or in sequence with protocol demux 38) can apply signature filters to the flows to attempt to identify the protocol based solely on the transported data. Furthermore, protocol demux 38 can make a classification decision based on port number, which is subsequently overridden by protocol classifier 40. For example, if an individual or program attempted to masquerade an illicit communication (such as file sharing) using an apparently benign port such as port 80 (commonly used for HTTP Web browsing), protocol classifier 40 would use protocol signatures, e.g., the characteristic data sequences of defined protocols, to verify the speculative classification performed by protocol demux 38.
In one embodiment, object assembly module 28 outputs each flow organized by protocol, which represent the underlying objects. Referring again to
Object classification module 30 uses the inherent properties and signatures of various documents to determine the content type of each object. For example, a Word document has a signature that is distinct from a PowerPoint document, or an Email document. Object classification module 30 can extract out each individual object and sort them out by such content types. Such classification renders the present invention immune from cases where a malicious user has altered a file extension or other property in an attempt to avoid detection of illicit activity.
In one embodiment, object classification module 30 determines whether each object should be stored or discarded. In one embodiment, this determination is based on a various capture rules. For example, a capture rule can indicate that Web Traffic should be discarded. Another capture rule can indicate that all PowerPoint documents should be stored, except for ones originating from the CEO's IP address. Such capture rules can be implemented as regular expressions, or by other similar means.
In one embodiment, the capture rules are authored by users of capture system 22. Capture system 22 is made accessible to any network-connected machine through network interface module 24 and user interface 34. In one embodiment, user interface 34 is a graphical user interface providing the user with friendly access to the various features of capture system 22. For example, user interface 34 can provide a capture rule authoring tool that allows users to write and implement any capture rule desired, which are then applied by object classification module 30 when determining whether each object should be stored. User interface 34 can also provide pre-configured capture rules that the user can select from along with an explanation of the operation of such standard included capture rules. In one embodiment, the default capture rule implemented by object classification module 30 captures all objects leaving the network 10. If the capture of an object is mandated by the capture rules, object classification module 30 can also determine where in object store module 32 the captured object should be stored.
In alternative embodiments, instead of being implemented in conjunction with (or included within) a router, capture system 22 may be included as part of other network appliances such as switches, gateways, bridges, loadbalancers, servers, or any other suitable device, component, element, or object operable to exchange information in a network environment. Moreover, these network appliances and/or capture systems may include any suitable hardware, software, components, modules, interfaces, or objects that facilitate the operations thereof. This may be inclusive of appropriate algorithms and communication protocols that facilitate the data mining and policy management operations detailed herein.
One or more tables may be included in these network appliances (or within capture system 22). In other embodiments, these tables may be provided externally to these elements, or consolidated in any suitable fashion. The tables are memory elements for storing information to be referenced by their corresponding network appliances. As used herein in this document, the term ‘table’ is inclusive of any suitable database or storage medium (provided in any appropriate format) that is capable of maintaining information pertinent to the operations detailed herein in this Specification. For example, the tables may store information in an electronic register, diagram, record, index, list, or queue. Alternatively, the tables may keep such information in any suitable random access memory (RAM), read only memory (ROM), erasable programmable ROM (EPROM), electronically erasable PROM (EEPROM), application specific integrated circuit (ASIC), software, hardware, or in any other suitable component, device, element, or object where appropriate and based on particular needs.
With reference to
In one embodiment, the content store is a canonical storage location, simply a place to deposit the captured objects. The indexing of the objects stored in content store 44 is accomplished using a tag database 42. In one embodiment, tag database 42 is a database data structure in which each record is a “tag” that indexes an object in content store 44 and contains relevant information about the stored object. An example of a tag record in tag database 42 that indexes an object stored in content store 44 is set forth in Table 1:
There are various other possible tag fields, and some embodiments can omit numerous tag fields listed in Table 1. In other embodiments, the tag database 42 need not be implemented as a database, and a tag need not be a record. Any data structure capable of indexing an object by storing relational data over the object can be used as a tag data structure. Furthermore, the word “tag” is merely descriptive, other names such as “index” or “relational data store,” would be equally descriptive, as would any other designation performing similar functionality.
The mapping of tags to objects can, in one embodiment, be obtained by using unique combinations of tag fields to construct an object's name. For example, one such possible combination is an ordered list of the Source IP, Destination IP, Source Port, Destination Port, Instance, and Timestamp. Many other such combinations including both shorter and longer names are possible. In another embodiment, the tag can contain a pointer to the storage location where the indexed object is stored.
The tag fields shown in Table 1 can be expressed more generally, to emphasize the underlying information indicated by the tag fields in various embodiments. Some of these possible generic tag fields are set forth in Table 2:
For many of the above tag fields in Tables 1 and 2, the definition adequately describes the relational data contained by each field. For the content field, the types of content that the object can be labeled as are numerous. Some example choices for content types (as determined, in one embodiment, by the object classification module 30) are JPEG, GIF, BMP, TIFF, PNG (for objects containing images in these various formats); Skintone (for objects containing images exposing human skin); PDF, MSWord, Excel, PowerPoint, MSOffice (for objects in these popular application formats); HTML, WebMail, SMTP, FTP (for objects captured in these transmission formats); Telnet, Rlogin, Chat (for communication conducted using these methods); GZIP, ZIP, TAR (for archives or collections of other objects); C++ Source, C Source, FORTRAN Source, Verilog Source (for source or design code authored in these high-level programming languages); C Shell, K Shell, Bash Shell (for shell program scripts); Plaintext (for otherwise unclassified textual objects); Crypto (for objects that have been encrypted or that contain cryptographic elements); Binary Unknown, ASCII Unknown, and Unknown (as catchall categories).
The signature contained in the Signature and Tag Signature fields can be any digest or hash over the object, or some portion thereof. In one embodiment, a well-known hash, such as MD5 or SHA1 can be used. In one embodiment, the signature is a digital cryptographic signature. In one embodiment, a digital cryptographic signature is a hash signature that is signed with the private key of capture system 22. Capture system 22 knows its own private key, thus, the integrity of the stored object can be verified by comparing a hash of the stored object to the signature decrypted with the public key of capture system 22, the private and public keys being a public key cryptosystem key pair. Thus, if a stored object is modified from when it was originally captured, the modification will cause the comparison to fail.
Similarly, the signature over the tag stored in the Tag Signature field can also be a digital cryptographic signature. In such an embodiment, the integrity of the tag can also be verified. In one embodiment, verification of the object using the signature, and the tag using the tag signature is performed whenever an object is presented, e.g., displayed to a user. In one embodiment, if the object or the tag is found to have been compromised, an alarm is generated to alert the user that the object displayed may not be identical to the object originally captured.
In one embodiment, the attributes are completely user-configurable. A user interface provides an attribute editor that allows a user to define attributes by creating an attribute and associating a group of one or more regular expressions with the created attribute. The capture device may come preconfigured with a list of common or popular attributes that may be tailored specifically to the industry into which the capture device is sold.
In one embodiment, a capture device may create new attributes automatically. For example, a capture device may observe that a certain regular expression is being searched with some threshold frequency (generally set to be above normal). The capture device creates an attribute to be associated with this regular expression and begins tagging the newly defined attribute when capturing new objects. In another embodiment, a capture device may suggest that a new attribute be created when a regular expression is searched frequently. In yet another embodiment, a capture device may suggest that an attribute be deleted if infrequently used to make room for another more useful attribute. In terms of the query generation, example embodiments of the present invention allow objects and/or their associated metadata to be searchable upon request. For example, emails, documents, images, etc. may be processed by a capture system and searched.
In several embodiments, capture system 22 has been described above as a stand-alone device. However, the capture system of the present invention can be implemented on any appliance capable of capturing and analyzing data from a network. For example, capture system 22 described above could be implemented on one or more of servers 14 or clients 16 shown in
In one embodiment, illustrated by
In example embodiments, the GUI presented provides for management capabilities for the following features: monitor (providing real-time scanning and analysis of all network traffic, regardless of content type, protocol or port), capture (storing events related to critical content in an indexed, searchable database, enabling after the fact investigation and improved security), control (defining policies that filter network data, assigning roles to organization stakeholders, providing case management and unified reporting tools to establish workflow processes for remediation of security violations), discover (scanning data repositories to identify and fingerprint sensitive information to ensure protection of data at rest), and prevent (alerting, as well as blocking and filtering techniques in coordination with rules and policies to control information that is traversing or begin stored on the network).
In one embodiment, the host takes over tasks like customizing policies and assigning privileges to users while the client devices focus on core tasks, such as capturing and analyzing network data. It also expands the client devices' reporting capabilities to create an enterprise-wide case management structure. Management may include, for example, finding incidents and violations, investigating anomalies, preparing reports, building cases, and setting up mechanisms to help protect business operations.
The GUI discussed hereinafter presents the necessary interfaces/views to accomplish the functions described above. (Views and interfaces are used interchangeably to describe a graphical interface that is presented and displayed to the user). In the embodiments shown in multiple FIGURES hereinafter, a tabbed section is illustrated to break up these functionalities into different views, and discussed accordingly in their descriptions. It should be noted that one tab may be associated with multiple views, which are presented initially, “popped-up,” linked to, etc. These views may be combined and/or further separated while achieving the same purpose and functionality, and thus not compromising the underlying principles of the invention. It should also be noted that the tabs themselves may be combined and/or separated while still achieving the same purpose and functionality. Moreover, the functionality of the tabs may be implemented in other ways such as by links, buttons, menu options, scrolling pages, etc. It should be appreciated that while these aspects are illustrated a specific way for example purposes in the figures, deviations from these do not compromise the underlying principles of the invention.
For example, the user may wish to filter incidents to a specified group or time, and then only those resulting incidents can be displayed in the viewing section. Various attributes 706 are illustrated in columns for each incident in the viewing section. Attributes 706 may include, for example, any of the tags associated with the captured object (e.g., content, source, destination, protocol, timestamp, etc.), a status of an incident, a priority of an incident, or any other identifying information associated with the incident. The user may customize which attributes he wishes to display. This customization is applicable to attributes displayed in other views discussed hereinafter.
In this non-limiting example of
The embodiment shown in
Additional triggers not shown in
In the example embodiment shown in
In the embodiment shown in
When a specific grouping is selected, the incidents are presented according to that specific grouping. For example, as illustrated in
Filtering section 703 displayed in
Time periods may include, but are not limited to: anytime, previous 24 hours, previous 30 minutes, this week, previous week, this month, previous month, whole year, and custom dates. Upon filtering, the resulting incidents will be displayed in viewing section 701. Multiple filters may be performed simultaneous or sequentially, with the subsequent filter being performed on the resulting incidents from a previous filtering. Furthermore, filtering by group or time may occur alone or in conjunction with groupings in grouping section 704. In one embodiment, viewing section 701 displays highlights that provide a snapshot of the actual violation that was flagged for the incident. For example, a highlight may indicate that a social security number was the reason for the violation or flagging.
Trigger 714 triggers the display of additional filtering entry fields to further filter the resulting incidents by group or time.
Returning to viewing section 701, information relating to the incidents may be displayed in different views. The incident information may be presented in a view that displays the incidents and their attributes (as shown in viewing section 701 in
Trigger 718 presents different types of views. Examples default views may include, for example, incident-view, policy-sender, rule-sender, policy-rule, image-rule, etc. In addition, custom views may be created and saved as reports. These custom reports may be saved and used to regularly monitor events that a user considers significant. Another trigger (not shown) may be displayed to schedule or send selected reports to other users. Trigger 719 shown in
Basic search view 813 includes entry fields 802 to enter parameters of a search. In the example embodiment shown in
In the example embodiment shown in
Rules specify data to be found on the network. They scan network data (including indexed database, content store, and/or transmitting data) that matches the conditions defined in that rule. There are also rules, referred hereinafter as action rules, which define some action that will be take if a rule produces a “hit.” Action rules can be applied to different rules, and examples include, but are not limited to, sending email notifications using dynamic variables to multiple recipients, creating log entries in a syslog server, delegating responsibility for the result to a reviewer, assigning a status to the incident, preventing data loss. Concepts are pattern-matching tools that use text patterns or regular expressions to identify collection of related objects. For example, credit cards use a wide range of different numbering patterns, which may be collected into a single concept and applied against captured data. Templates are used, for example, to save keystrokes when searching or creating rules or capture filters. They contain a collection of elements that would otherwise have to be typed in repetitively. Standard, pre-created templates may exist and new templates may be created by users. Policies are sets of rules that search the data stream for specific incidents and/or violations. Default policies may exist and new policies may be created by users. Using rules and policies, a user can, for example, tune the system to perform certain actions when an incident is found, find specific concepts that have been programmed, or create and use templates to expedite search processes.
Count, percentage match, number of lines from beginning, and number of bytes from beginning may include, but are not limited to, entry fields for a condition (e.g., equal to, less than, greater than), a value, and an expression. Proximity may include, but is not limited to, entry fields for a concept, a condition (e.g., equal to, less than, greater than), a byte, and an expression. Advanced may include, but is not limited to, entry fields for distinguishing between content type concepts and network type concepts.
In one embodiment, system monitor view 1101 permits the user to view further details about devices. Example details include, but are not limited to: general information such as last connection date, hostname, IP address, process info (e.g., status of slaves, crawler, indexer, profiler, search driver, search results, tcp flow, signature, etc.), uptime, and any patch history information (e.g., build number, release number, etc.); system information such as SYSTEM memory allotment, operating system uptime, operating system version, system CPU and memory usage, and system drives; and network information such as bandwidth speed, average object size, and total objects. In the embodiment shown in
System monitor view 1101 also presents an interface, which allows a user to view the existing alerts within a system. Alerts are regularly reported to a database and polled periodically.
System monitor view 1101 also presents an interface that allows a user to setup and modify alerts. An alert may be setup by entering recipients, their contact information (e.g., email address), and alert types. Many types of alerts may exist and define, for example, when an alert is sent, how often, a priority level, etc. In the embodiment shown in
Capture filters are generally used to define significant portions of network traffic that do not need to be analyzed by the capture engine. Eliminating processing of this extraneous traffic improves system performance. While capture filters screen out classes of information, they can also be used to scan for and store critical data. Content capture filters act on flow of information that is transmitted through the Application layer. These filters can instruct the capture engine to ignore large stores of content, which may not produce any meaningful results. Network capture filters act on Layer-3 transport data that uses up resources but may not need to be recognized by the capture engine. Because this flow carries distinct protocol information, the order in which packets are eliminated may be significant.
Referring back to
In the example embodiment shown in
The discover view 1201 presents an interface comprising a viewing section 1202 for viewing information associated with incidents. The information presented in viewing section 1202 may be presented in different views, selectable by the user. For instance, a pull down menu 1205 is illustrated in the embodiment shown in
The preceding operational flows have been offered for purposes of example and discussion. Substantial flexibility is provided by the discussed system in that any suitable arrangements, chronologies, configurations, and timing mechanisms may be provided without departing from the teachings of the present invention. Some of these outlined steps may be deleted or removed where appropriate, or these steps may be modified or changed considerably without departing from the scope of the present invention. In addition, a number of these operations have been described as being executed concurrently with, or in parallel to, one or more additional operations. However, the timing of these operations may be altered considerably.
In one non-limiting example implementation of one embodiment of the present invention, an article of manufacture may be used to store program code. An article of manufacture that stores program code may be embodied as, but is not limited to, one or more memories (e.g., one or more flash memories, random access memories (static, dynamic or other)), optical disks, CD-ROMs, DVD ROMs, EPROMs, EEPROMs, magnetic or optical cards or other type of machine-readable medium suitable for storing electronic instructions. In one embodiment, a capture system is an appliance constructed using commonly available computing equipment and storage systems capable of supporting the software requirements.
An article of manufacture (such as a machine-readable medium) may be used to store program code. An article of manufacture that stores program code may be embodied as, but is not limited to, a machine-readable storage medium such as one or more memories (e.g., one or more flash memories, random access memories (static, dynamic or other)), optical disks, CD-ROMs, DVD ROMs, EPROMs, EEPROMs, magnetic or optical cards or other type of machine-readable media suitable for storing electronic instructions. Program code may also be downloaded from a remote computer (e.g., a server) to a requesting computer (e.g., a client) by way of data signals embodied in a propagation medium (e.g., via a communication link (e.g., a network connection)). In one embodiment, a capture system is an appliance constructed using commonly available computing equipment and storage systems capable of supporting the software requirements.
One or more processors 1301 execute instructions in order to perform whatever software routines the computing system implements. The instructions frequently involve some sort of operation performed upon data. Both data and instructions are stored in system memory 1303 and cache 1304. Cache 1304 is typically designed to have shorter latency times than system memory 1303. For example, cache 1304 might be integrated onto the same silicon chip(s) as the processor(s) and/or constructed with faster SRAM cells, while system memory 1303 might be constructed with slower DRAM cells. By tending to store more frequently used instructions and data in the cache 1304 as opposed to system memory 1303, the overall performance efficiency of the computing system improves.
System memory 1303 is made available to other components within the computing system. For example, the data received from various interfaces to the computing system (e.g., keyboard and mouse, printer port, LAN port, modem port, etc.) or retrieved from an internal storage element of the computing system (e.g., hard disk drive) are often temporarily queued into system memory 1303 prior to their being operated upon by one or more processor(s) 1301 in the implementation of a software program. Similarly, data that a software program determines should be sent from the computing system to an outside entity through one of the computing system interfaces, or stored into an internal storage element, is often temporarily queued in system memory 1303 prior to its being transmitted or stored.
ICH 1305 is responsible for ensuring that such data is properly passed between system memory 1303 and its appropriate corresponding computing system interface (and internal storage device if the computing system is so designed). MCH 1302 is responsible for managing the various contending requests for system memory 1303 access amongst processor(s) 1301, interfaces, and internal storage elements that may proximately arise in time with respect to one another.
One or more I/O devices 1308 are also implemented in a typical computing system. I/O devices generally are responsible for transferring data to and/or from the computing system (e.g., a networking adapter), or for large-scale non-volatile storage within the computing system (e.g., hard disk drive). ICH 1305 has bidirectional point-to-point links between itself and observed I/O devices 1308. A capture program, classification program, a database, a filestore, an analysis engine, and/or a graphical user interface may be stored in a storage device or devices 1308 or in memory 1303.
In the foregoing specification, the invention has been described with reference to specific example embodiments thereof. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention as set forth in the appended Claims. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.
Thus, a capture system and a document/content registration system have been described. In the forgoing description, various specific values were given names, such as “objects” and “documents,” and various specific modules, such as the “registration module” and “signature database” have been described. However, these names are merely to describe and illustrate various aspects of the present invention, and in no way limit the scope of the present invention. Furthermore, various modules may be implemented as software or hardware modules, combined, or without dividing their functionalities into modules at all. The present invention is not limited to any modular architecture either in software or in hardware, whether described above or not.
| Number | Name | Date | Kind |
|---|---|---|---|
| 4286255 | Siy | Aug 1981 | A |
| 4710957 | Bocci et al. | Dec 1987 | A |
| 5249289 | Thamm et al. | Sep 1993 | A |
| 5465299 | Matsumoto et al. | Nov 1995 | A |
| 5479654 | Squibb | Dec 1995 | A |
| 5497489 | Menne | Mar 1996 | A |
| 5542090 | Henderson et al. | Jul 1996 | A |
| 5557747 | Rogers et al. | Sep 1996 | A |
| 5623652 | Vora et al. | Apr 1997 | A |
| 5768578 | Kirk | Jun 1998 | A |
| 5781629 | Haber et al. | Jul 1998 | A |
| 5787232 | Greiner et al. | Jul 1998 | A |
| 5794052 | Harding | Aug 1998 | A |
| 5813009 | Johnson et al. | Sep 1998 | A |
| 5873081 | Harel | Feb 1999 | A |
| 5937422 | Nelson et al. | Aug 1999 | A |
| 5943670 | Prager | Aug 1999 | A |
| 5987610 | Franczek et al. | Nov 1999 | A |
| 5995111 | Morioka et al. | Nov 1999 | A |
| 6026411 | Delp | Feb 2000 | A |
| 6073142 | Geiger et al. | Jun 2000 | A |
| 6078953 | Vaid et al. | Jun 2000 | A |
| 6094531 | Allison et al. | Jul 2000 | A |
| 6108697 | Raymond et al. | Aug 2000 | A |
| 6122379 | Barbir | Sep 2000 | A |
| 6161102 | Yanagihara et al. | Dec 2000 | A |
| 6175867 | Taghadoss | Jan 2001 | B1 |
| 6192472 | Garay et al. | Feb 2001 | B1 |
| 6243091 | Berstis | Jun 2001 | B1 |
| 6243720 | Munter et al. | Jun 2001 | B1 |
| 6278992 | Curtis et al. | Aug 2001 | B1 |
| 6292810 | Richards | Sep 2001 | B1 |
| 6336186 | Dyksterhouse et al. | Jan 2002 | B1 |
| 6343376 | Saxe et al. | Jan 2002 | B1 |
| 6356885 | Ross et al. | Mar 2002 | B2 |
| 6363488 | Ginter et al. | Mar 2002 | B1 |
| 6389405 | Oatman et al. | May 2002 | B1 |
| 6389419 | Wong et al. | May 2002 | B1 |
| 6408294 | Getchius et al. | Jun 2002 | B1 |
| 6408301 | Patton et al. | Jun 2002 | B1 |
| 6411952 | Bharat et al. | Jun 2002 | B1 |
| 6457017 | Watkins et al. | Sep 2002 | B2 |
| 6460050 | Pace et al. | Oct 2002 | B1 |
| 6493761 | Baker et al. | Dec 2002 | B1 |
| 6499105 | Yoshiura et al. | Dec 2002 | B1 |
| 6502091 | Chundi et al. | Dec 2002 | B1 |
| 6515681 | Knight | Feb 2003 | B1 |
| 6516320 | Odom et al. | Feb 2003 | B1 |
| 6523026 | Gillis | Feb 2003 | B1 |
| 6539024 | Janoska et al. | Mar 2003 | B1 |
| 6556964 | Haug et al. | Apr 2003 | B2 |
| 6556983 | Altschuler et al. | Apr 2003 | B1 |
| 6571275 | Dong et al. | May 2003 | B1 |
| 6584458 | Millett et al. | Jun 2003 | B1 |
| 6598033 | Ross et al. | Jul 2003 | B2 |
| 6629097 | Keith | Sep 2003 | B1 |
| 6662176 | Brunet et al. | Dec 2003 | B2 |
| 6665662 | Kirkwood et al. | Dec 2003 | B1 |
| 6675159 | Lin et al. | Jan 2004 | B1 |
| 6691209 | O'Connell | Feb 2004 | B1 |
| 6754647 | Tackett et al. | Jun 2004 | B1 |
| 6757646 | Marchisio | Jun 2004 | B2 |
| 6771595 | Gilbert et al. | Aug 2004 | B1 |
| 6772214 | McClain et al. | Aug 2004 | B1 |
| 6785815 | Serret-Avila et al. | Aug 2004 | B1 |
| 6804627 | Marokhovsky et al. | Oct 2004 | B1 |
| 6820082 | Cook et al. | Nov 2004 | B1 |
| 6857011 | Reinke | Feb 2005 | B2 |
| 6937257 | Dunlavey | Aug 2005 | B1 |
| 6950864 | Tsuchiya | Sep 2005 | B1 |
| 6976053 | Tripp et al. | Dec 2005 | B1 |
| 6978297 | Piersol | Dec 2005 | B1 |
| 6978367 | Hind et al. | Dec 2005 | B1 |
| 7007020 | Chen et al. | Feb 2006 | B1 |
| 7020654 | Najmi | Mar 2006 | B1 |
| 7020661 | Cruanes et al. | Mar 2006 | B1 |
| 7062572 | Hampton | Jun 2006 | B1 |
| 7072967 | Saulpaugh et al. | Jul 2006 | B1 |
| 7082443 | Ashby | Jul 2006 | B1 |
| 7093288 | Hydrie et al. | Aug 2006 | B1 |
| 7130587 | Hikokubo et al. | Oct 2006 | B2 |
| 7158983 | Willse et al. | Jan 2007 | B2 |
| 7181769 | Keanini et al. | Feb 2007 | B1 |
| 7185073 | Gai et al. | Feb 2007 | B1 |
| 7185192 | Kahn | Feb 2007 | B1 |
| 7194483 | Mohan et al. | Mar 2007 | B1 |
| 7219131 | Banister | May 2007 | B2 |
| 7219134 | Takeshima et al. | May 2007 | B2 |
| 7243120 | Massey | Jul 2007 | B2 |
| 7246236 | Stirbu | Jul 2007 | B2 |
| 7254562 | Hsu et al. | Aug 2007 | B2 |
| 7254632 | Zeira et al. | Aug 2007 | B2 |
| 7266845 | Hypponen | Sep 2007 | B2 |
| 7272724 | Tarbotton et al. | Sep 2007 | B2 |
| 7277957 | Rowley et al. | Oct 2007 | B2 |
| 7290048 | Barnett et al. | Oct 2007 | B1 |
| 7293067 | Maki et al. | Nov 2007 | B1 |
| 7293238 | Brook et al. | Nov 2007 | B1 |
| 7296011 | Chaudhuri et al. | Nov 2007 | B2 |
| 7296070 | Sweeney et al. | Nov 2007 | B2 |
| 7296088 | Padmanabhan et al. | Nov 2007 | B1 |
| 7296232 | Burdick et al. | Nov 2007 | B1 |
| 7299277 | Moran et al. | Nov 2007 | B1 |
| 7299489 | Branigan et al. | Nov 2007 | B1 |
| 7373500 | Ramelson et al. | May 2008 | B2 |
| 7424744 | Wu et al. | Sep 2008 | B1 |
| 7426181 | Feroz et al. | Sep 2008 | B1 |
| 7434058 | Ahuja et al. | Oct 2008 | B2 |
| 7467202 | Savchuk | Dec 2008 | B2 |
| 7477780 | Boncyk et al. | Jan 2009 | B2 |
| 7483916 | Lowe et al. | Jan 2009 | B2 |
| 7493659 | Wu et al. | Feb 2009 | B1 |
| 7505463 | Schuba et al. | Mar 2009 | B2 |
| 7506055 | McClain et al. | Mar 2009 | B2 |
| 7506155 | Stewart et al. | Mar 2009 | B1 |
| 7509677 | Saurabh et al. | Mar 2009 | B2 |
| 7516492 | Nisbet et al. | Apr 2009 | B1 |
| 7539683 | Satoh et al. | May 2009 | B1 |
| 7551629 | Chen et al. | Jun 2009 | B2 |
| 7577154 | Yung et al. | Aug 2009 | B1 |
| 7581059 | Gupta et al. | Aug 2009 | B2 |
| 7596571 | Sifry | Sep 2009 | B2 |
| 7599844 | King et al. | Oct 2009 | B2 |
| 7664083 | Cermak et al. | Feb 2010 | B1 |
| 7685254 | Pandya | Mar 2010 | B2 |
| 7730011 | Deninger et al. | Jun 2010 | B1 |
| 7739080 | Beck et al. | Jun 2010 | B1 |
| 7760730 | Goldschmidt et al. | Jul 2010 | B2 |
| 7760769 | Lovett et al. | Jul 2010 | B1 |
| 7774604 | Lowe et al. | Aug 2010 | B2 |
| 7814327 | Ahuja et al. | Oct 2010 | B2 |
| 7818326 | Deninger et al. | Oct 2010 | B2 |
| 7844582 | Arbilla et al. | Nov 2010 | B1 |
| 7849065 | Kamani et al. | Dec 2010 | B2 |
| 7899828 | de la Iglesia et al. | Mar 2011 | B2 |
| 7907608 | Liu et al. | Mar 2011 | B2 |
| 7921072 | Bohannon et al. | Apr 2011 | B2 |
| 7926099 | Chakravarty et al. | Apr 2011 | B1 |
| 7930540 | Ahuja et al. | Apr 2011 | B2 |
| 7949849 | Lowe et al. | May 2011 | B2 |
| 7958227 | Ahuja et al. | Jun 2011 | B2 |
| 7962591 | Deninger et al. | Jun 2011 | B2 |
| 7979524 | Dieberger et al. | Jul 2011 | B2 |
| 7984175 | de la Iglesia et al. | Jul 2011 | B2 |
| 7996373 | Zoppas et al. | Aug 2011 | B1 |
| 8005863 | de la Iglesia et al. | Aug 2011 | B2 |
| 8010689 | Deninger et al. | Aug 2011 | B2 |
| 8055601 | Pandya | Nov 2011 | B2 |
| 8056130 | Njemanze et al. | Nov 2011 | B1 |
| 8166307 | Ahuja et al. | Apr 2012 | B2 |
| 8176049 | Deninger et al. | May 2012 | B2 |
| 8200026 | Deninger et al. | Jun 2012 | B2 |
| 8205242 | Liu et al. | Jun 2012 | B2 |
| 8205244 | Nightingale et al. | Jun 2012 | B2 |
| 8261347 | Hrabik et al. | Sep 2012 | B2 |
| 8271794 | Lowe et al. | Sep 2012 | B2 |
| 8301635 | de la Iglesia et al. | Oct 2012 | B2 |
| 8307007 | de la Iglesia et al. | Nov 2012 | B2 |
| 8307206 | Ahuja et al. | Nov 2012 | B2 |
| 8463800 | Deninger et al. | Jun 2013 | B2 |
| 8473442 | Deninger et al. | Jun 2013 | B1 |
| 20010013024 | Takahashi et al. | Aug 2001 | A1 |
| 20010032310 | Corella | Oct 2001 | A1 |
| 20010037324 | Agrawal et al. | Nov 2001 | A1 |
| 20010046230 | Rojas | Nov 2001 | A1 |
| 20020032677 | Morgenthaler et al. | Mar 2002 | A1 |
| 20020032772 | Olstad et al. | Mar 2002 | A1 |
| 20020052896 | Streit et al. | May 2002 | A1 |
| 20020065956 | Yagawa et al. | May 2002 | A1 |
| 20020078355 | Samar | Jun 2002 | A1 |
| 20020091579 | Yehia et al. | Jul 2002 | A1 |
| 20020103876 | Chatani et al. | Aug 2002 | A1 |
| 20020107843 | Biebesheimer et al. | Aug 2002 | A1 |
| 20020116124 | Garin et al. | Aug 2002 | A1 |
| 20020126673 | Dagli et al. | Sep 2002 | A1 |
| 20020128903 | Kernahan | Sep 2002 | A1 |
| 20020129140 | Peled et al. | Sep 2002 | A1 |
| 20020159447 | Carey et al. | Oct 2002 | A1 |
| 20030009718 | Wolfgang et al. | Jan 2003 | A1 |
| 20030028493 | Tajima | Feb 2003 | A1 |
| 20030028774 | Meka | Feb 2003 | A1 |
| 20030046369 | Sim et al. | Mar 2003 | A1 |
| 20030053420 | Duckett et al. | Mar 2003 | A1 |
| 20030055962 | Freund et al. | Mar 2003 | A1 |
| 20030065571 | Dutta | Apr 2003 | A1 |
| 20030084300 | Koike | May 2003 | A1 |
| 20030084318 | Schertz | May 2003 | A1 |
| 20030084326 | Tarquini | May 2003 | A1 |
| 20030093678 | Bowe et al. | May 2003 | A1 |
| 20030099243 | Oh et al. | May 2003 | A1 |
| 20030105739 | Essafi et al. | Jun 2003 | A1 |
| 20030105854 | Thorsteinsson et al. | Jun 2003 | A1 |
| 20030131116 | Jain et al. | Jul 2003 | A1 |
| 20030135612 | Huntington | Jul 2003 | A1 |
| 20030167392 | Fransdonk | Sep 2003 | A1 |
| 20030185220 | Valenci | Oct 2003 | A1 |
| 20030196081 | Savarda et al. | Oct 2003 | A1 |
| 20030204741 | Schoen et al. | Oct 2003 | A1 |
| 20030221101 | Micali | Nov 2003 | A1 |
| 20030225796 | Matsubara | Dec 2003 | A1 |
| 20030225841 | Song et al. | Dec 2003 | A1 |
| 20030231632 | Haeberlen | Dec 2003 | A1 |
| 20030233411 | Parry et al. | Dec 2003 | A1 |
| 20040001498 | Chen et al. | Jan 2004 | A1 |
| 20040010484 | Foulger et al. | Jan 2004 | A1 |
| 20040015579 | Cooper et al. | Jan 2004 | A1 |
| 20040036716 | Jordahl | Feb 2004 | A1 |
| 20040054779 | Takeshima et al. | Mar 2004 | A1 |
| 20040059736 | Willse et al. | Mar 2004 | A1 |
| 20040059920 | Godwin | Mar 2004 | A1 |
| 20040071164 | Baum | Apr 2004 | A1 |
| 20040111406 | Udeshi et al. | Jun 2004 | A1 |
| 20040111678 | Hara et al. | Jun 2004 | A1 |
| 20040114518 | McFaden et al. | Jun 2004 | A1 |
| 20040117414 | Braun et al. | Jun 2004 | A1 |
| 20040120325 | Ayres | Jun 2004 | A1 |
| 20040122863 | Sidman | Jun 2004 | A1 |
| 20040122936 | Mizelle et al. | Jun 2004 | A1 |
| 20040139120 | Clark et al. | Jul 2004 | A1 |
| 20040181513 | Henderson et al. | Sep 2004 | A1 |
| 20040181690 | Rothermel et al. | Sep 2004 | A1 |
| 20040193594 | Moore et al. | Sep 2004 | A1 |
| 20040194141 | Sanders | Sep 2004 | A1 |
| 20040196970 | Cole | Oct 2004 | A1 |
| 20040205457 | Bent et al. | Oct 2004 | A1 |
| 20040215612 | Brody | Oct 2004 | A1 |
| 20040220944 | Behrens et al. | Nov 2004 | A1 |
| 20040230572 | Omoigui | Nov 2004 | A1 |
| 20040249781 | Anderson | Dec 2004 | A1 |
| 20040267753 | Hoche | Dec 2004 | A1 |
| 20050004911 | Goldberg et al. | Jan 2005 | A1 |
| 20050021715 | Dugatkin et al. | Jan 2005 | A1 |
| 20050021743 | Fleig et al. | Jan 2005 | A1 |
| 20050022114 | Shanahan et al. | Jan 2005 | A1 |
| 20050027881 | Figueira et al. | Feb 2005 | A1 |
| 20050033726 | Wu et al. | Feb 2005 | A1 |
| 20050033747 | Wittkotter | Feb 2005 | A1 |
| 20050033803 | Vleet et al. | Feb 2005 | A1 |
| 20050038788 | Dettinger et al. | Feb 2005 | A1 |
| 20050038809 | Abajian et al. | Feb 2005 | A1 |
| 20050044289 | Hendel et al. | Feb 2005 | A1 |
| 20050050205 | Gordy et al. | Mar 2005 | A1 |
| 20050055327 | Agrawal et al. | Mar 2005 | A1 |
| 20050055399 | Savchuk | Mar 2005 | A1 |
| 20050075103 | Hikokubo et al. | Apr 2005 | A1 |
| 20050086252 | Jones et al. | Apr 2005 | A1 |
| 20050091443 | Hershkovich et al. | Apr 2005 | A1 |
| 20050091532 | Moghe | Apr 2005 | A1 |
| 20050097441 | Herbach et al. | May 2005 | A1 |
| 20050108244 | Riise et al. | May 2005 | A1 |
| 20050114452 | Prakash | May 2005 | A1 |
| 20050120006 | Nye | Jun 2005 | A1 |
| 20050127171 | Ahuja et al. | Jun 2005 | A1 |
| 20050128242 | Suzuki | Jun 2005 | A1 |
| 20050131876 | Ahuja et al. | Jun 2005 | A1 |
| 20050132034 | de la Iglesia et al. | Jun 2005 | A1 |
| 20050132046 | de la Iglesia et al. | Jun 2005 | A1 |
| 20050132079 | de la Iglesia et al. | Jun 2005 | A1 |
| 20050132197 | Medlar | Jun 2005 | A1 |
| 20050132198 | Ahuja et al. | Jun 2005 | A1 |
| 20050132297 | Milic-Frayling et al. | Jun 2005 | A1 |
| 20050138110 | Redlich et al. | Jun 2005 | A1 |
| 20050138242 | Pope et al. | Jun 2005 | A1 |
| 20050138279 | Somasundaram | Jun 2005 | A1 |
| 20050149494 | Lindh et al. | Jul 2005 | A1 |
| 20050149504 | Ratnaparkhi | Jul 2005 | A1 |
| 20050166066 | Ahuja et al. | Jul 2005 | A1 |
| 20050177725 | Lowe et al. | Aug 2005 | A1 |
| 20050180341 | Nelson et al. | Aug 2005 | A1 |
| 20050182765 | Liddy | Aug 2005 | A1 |
| 20050188218 | Walmsley et al. | Aug 2005 | A1 |
| 20050203940 | Farrar et al. | Sep 2005 | A1 |
| 20050204129 | Sudia et al. | Sep 2005 | A1 |
| 20050228864 | Robertson | Oct 2005 | A1 |
| 20050235153 | Ikeda | Oct 2005 | A1 |
| 20050273614 | Ahuja et al. | Dec 2005 | A1 |
| 20050289181 | Deninger et al. | Dec 2005 | A1 |
| 20060005247 | Zhang et al. | Jan 2006 | A1 |
| 20060021045 | Cook | Jan 2006 | A1 |
| 20060021050 | Cook et al. | Jan 2006 | A1 |
| 20060037072 | Rao et al. | Feb 2006 | A1 |
| 20060041560 | Forman et al. | Feb 2006 | A1 |
| 20060041570 | Lowe et al. | Feb 2006 | A1 |
| 20060041760 | Huang | Feb 2006 | A1 |
| 20060047675 | Lowe et al. | Mar 2006 | A1 |
| 20060075228 | Black et al. | Apr 2006 | A1 |
| 20060080130 | Choksi | Apr 2006 | A1 |
| 20060083180 | Baba et al. | Apr 2006 | A1 |
| 20060106793 | Liang | May 2006 | A1 |
| 20060106866 | Green et al. | May 2006 | A1 |
| 20060150249 | Gassen et al. | Jul 2006 | A1 |
| 20060167896 | Kapur et al. | Jul 2006 | A1 |
| 20060184532 | Hamada et al. | Aug 2006 | A1 |
| 20060235811 | Fairweather | Oct 2006 | A1 |
| 20060242126 | Fitzhugh | Oct 2006 | A1 |
| 20060242313 | Le et al. | Oct 2006 | A1 |
| 20060251109 | Muller et al. | Nov 2006 | A1 |
| 20060253445 | Huang et al. | Nov 2006 | A1 |
| 20060271506 | Bohannon et al. | Nov 2006 | A1 |
| 20060272024 | Huang et al. | Nov 2006 | A1 |
| 20060288216 | Buhler et al. | Dec 2006 | A1 |
| 20070006293 | Balakrishnan et al. | Jan 2007 | A1 |
| 20070011309 | Brady et al. | Jan 2007 | A1 |
| 20070028039 | Gupta et al. | Feb 2007 | A1 |
| 20070036156 | Liu et al. | Feb 2007 | A1 |
| 20070050334 | Deninger et al. | Mar 2007 | A1 |
| 20070050381 | Hu et al. | Mar 2007 | A1 |
| 20070050467 | Borrett et al. | Mar 2007 | A1 |
| 20070081471 | Talley et al. | Apr 2007 | A1 |
| 20070094394 | Singh et al. | Apr 2007 | A1 |
| 20070106660 | Stern et al. | May 2007 | A1 |
| 20070106685 | Houh et al. | May 2007 | A1 |
| 20070106693 | Houh et al. | May 2007 | A1 |
| 20070110089 | Essafi et al. | May 2007 | A1 |
| 20070112837 | Houh et al. | May 2007 | A1 |
| 20070112838 | Bjarnestam et al. | May 2007 | A1 |
| 20070116366 | Deninger et al. | May 2007 | A1 |
| 20070124384 | Howell et al. | May 2007 | A1 |
| 20070136599 | Suga | Jun 2007 | A1 |
| 20070140128 | Klinker et al. | Jun 2007 | A1 |
| 20070143559 | Yagawa | Jun 2007 | A1 |
| 20070162609 | Pope et al. | Jul 2007 | A1 |
| 20070220607 | Sprosts et al. | Sep 2007 | A1 |
| 20070226504 | de la Iglesia et al. | Sep 2007 | A1 |
| 20070226510 | de la Iglesia et al. | Sep 2007 | A1 |
| 20070248029 | Merkey et al. | Oct 2007 | A1 |
| 20070271254 | de la Iglesia et al. | Nov 2007 | A1 |
| 20070271371 | Ahuja et al. | Nov 2007 | A1 |
| 20070271372 | Deninger et al. | Nov 2007 | A1 |
| 20070280123 | Atkins et al. | Dec 2007 | A1 |
| 20080027971 | Statchuk | Jan 2008 | A1 |
| 20080028467 | Kommareddy et al. | Jan 2008 | A1 |
| 20080030383 | Cameron | Feb 2008 | A1 |
| 20080082497 | Leblang et al. | Apr 2008 | A1 |
| 20080091408 | Roulland et al. | Apr 2008 | A1 |
| 20080112411 | Stafford et al. | May 2008 | A1 |
| 20080115125 | Stafford et al. | May 2008 | A1 |
| 20080140657 | Azvine et al. | Jun 2008 | A1 |
| 20080141117 | King et al. | Jun 2008 | A1 |
| 20080159627 | Sengamedu | Jul 2008 | A1 |
| 20080235163 | Balasubramanian et al. | Sep 2008 | A1 |
| 20080263019 | Harrison et al. | Oct 2008 | A1 |
| 20080270462 | Thomsen | Oct 2008 | A1 |
| 20080276295 | Nair | Nov 2008 | A1 |
| 20090070327 | Loeser et al. | Mar 2009 | A1 |
| 20090070328 | Loeser et al. | Mar 2009 | A1 |
| 20090070459 | Cho et al. | Mar 2009 | A1 |
| 20090100055 | Wang | Apr 2009 | A1 |
| 20090157659 | Satoh et al. | Jun 2009 | A1 |
| 20090178110 | Higuchi | Jul 2009 | A1 |
| 20090187568 | Morin | Jul 2009 | A1 |
| 20090216752 | Terui et al. | Aug 2009 | A1 |
| 20090222442 | Houh et al. | Sep 2009 | A1 |
| 20090235150 | Berry | Sep 2009 | A1 |
| 20090254532 | Yang et al. | Oct 2009 | A1 |
| 20090288164 | Adelstein et al. | Nov 2009 | A1 |
| 20090300709 | Chen et al. | Dec 2009 | A1 |
| 20090326925 | Crider et al. | Dec 2009 | A1 |
| 20100011016 | Greene | Jan 2010 | A1 |
| 20100011410 | Liu | Jan 2010 | A1 |
| 20100037324 | Grant et al. | Feb 2010 | A1 |
| 20100088317 | Bone et al. | Apr 2010 | A1 |
| 20100100551 | Knauft et al. | Apr 2010 | A1 |
| 20100121853 | de la Iglesia et al. | May 2010 | A1 |
| 20100174528 | Oya et al. | Jul 2010 | A1 |
| 20100185622 | Deninger et al. | Jul 2010 | A1 |
| 20100191732 | Lowe et al. | Jul 2010 | A1 |
| 20100195909 | Wasson et al. | Aug 2010 | A1 |
| 20100268959 | Lowe et al. | Oct 2010 | A1 |
| 20100332502 | Carmel et al. | Dec 2010 | A1 |
| 20110004599 | Deninger et al. | Jan 2011 | A1 |
| 20110040552 | Van Guilder et al. | Feb 2011 | A1 |
| 20110131199 | Simon et al. | Jun 2011 | A1 |
| 20110149959 | Liu et al. | Jun 2011 | A1 |
| 20110167212 | Lowe et al. | Jul 2011 | A1 |
| 20110167265 | Ahuja et al. | Jul 2011 | A1 |
| 20110196911 | de la Iglesia et al. | Aug 2011 | A1 |
| 20110197284 | Ahuja et al. | Aug 2011 | A1 |
| 20110208861 | Deninger et al. | Aug 2011 | A1 |
| 20110219237 | Ahuja et al. | Sep 2011 | A1 |
| 20110258197 | de la Iglesia et al. | Oct 2011 | A1 |
| 20110276575 | de la Iglesia et al. | Nov 2011 | A1 |
| 20110276709 | Deninger et al. | Nov 2011 | A1 |
| 20120114119 | Ahuja et al. | May 2012 | A1 |
| 20120179687 | Liu | Jul 2012 | A1 |
| 20120180137 | Liu | Jul 2012 | A1 |
| 20120191722 | Deninger et al. | Jul 2012 | A1 |
| Number | Date | Country |
|---|---|---|
| 2499806 | Sep 2012 | EP |
| WO 2004008310 | Jan 2004 | WO |
| WO 2012060892 | May 2012 | WO |
| Entry |
|---|
| U.S. Appl. No. 12/690,153, filed Jan. 20, 2010, entitled “Query Generation for a Capture System,” Inventor(s) Erik de la Iglesia, et al. |
| Preneel, Bart, “Cryptographic Hash Functions”, Proceedings of the 3rd Symposium on State and Progress of Research in Cryptography, 1993, pp. 161-171. |
| Microsoft Outlook, Out look, copyright 1995-2000, 2 pages. |
| U.S. Appl. No. 12/190,536, filed Aug. 12, 2008, entitled “Configuration Management for a Capture/Registration System,” Inventor(s) Jitendra B. Gaitonde et al. |
| U.S. Appl. No. 12/352,720, filed Jan. 13, 2009, entitled “System and Method for Concept Building,” Inventor(s) Ratinder Paul Singh Ahuja et al. |
| U.S. Appl. No. 12/354,688, filed Jan. 15, 2009, entitled “System and Method for Intelligent Term Grouping,” Inventor(s) Ratinder Paul Ahuja et al. |
| U.S. Appl. No. 12/358,399, filed Jan. 23, 2009, entitled “System and Method for Intelligent State Management,” Inventor(s) William Deninger et al. |
| U.S. Appl. No. 12/410,875, filed Mar. 25, 2009, entitled “System and Method for Data Mining and Security Policy Management,” Inventor(s) Ratinder Paul Singh Ahuja et al. |
| U.S. Appl. No. 12/360,537, filed Jan. 27, 2009, entitled “Database for a Capture System,” Inventor(s) Rick Lowe et al. |
| U.S. Appl. No. 11/254,436, filed Oct. 19, 2005, entitled “Attributes of Captured Objects in a Capture System,” Inventor(s) William Deninger et al. |
| U.S. Appl. No. 12/472,150, filed May 26, 2009, entitled “Identifying Image Type in a Capture System,” Inventor(s) William Deninger et al. |
| U.S. Appl. No. 11/900,964, filed Sep. 14, 2007, entitled “System and Method for Indexing a Capture System,” Inventor(s) Ashok Doddapaneni et al. |
| U.S. Appl. No. 12/171,232, filed Jul. 10, 2008, entitled “System and Method for Data Mining and Security Policy Management,” Inventor(s) Weimin Liu et al. |
| Chapter 1. Introduction, “Computer Program product for analyzing network traffic,” Ethereal. Computer program product for analyzing network traffic, pp. 17-26, http://web.archive.org/web/20030315045117/www.ethereal.com/distribution/docs/user-guide, approximated copyright 2004-2005, printed Mar. 12, 2009. |
| U.S. Appl. No. 12/873,061, filed Aug. 31, 2010, entitled “Document Registration,” Inventor(s) Ratinder Paul Singh Ahuja, et al. |
| U.S. Appl. No. 12/939,340, filed Nov. 3, 2010, entitled “System and Method for Protecting Specified Data Combinations,” Inventor(s) Ratinder Paul Singh Ahuja, et al. |
| U.S. Appl. No. 12/967,013, filed Dec. 13, 2010, entitled “Tag Data Structure for Maintaining Relational Data Over Captured Objects,” Inventor(s) Erik de la Iglesia, et al. |
| U.S. Appl. No. 13/047,068, filed Mar. 14, 2011, entitled “Cryptographic Policy Enforcement,” Inventor(s) Ratinder Paul Singh Ahuja, et al. |
| U.S. Appl. No. 13/024,923, filed Feb. 10, 2011, entitled “High Speed Packet Capture,” Inventor(s) Weimin Liu, et al. |
| Han, OLAP Mining: An Integration of OLAP with Data Mining, Oct. 1997, pp. 1-18. |
| International Search Report and Written Opinion and Declaration of Non-Establishment of International Search Report for International Application No. PCT/US2011/024902 mailed Aug. 1, 2011 (8 pages). |
| Niemi, Constructing OLAP Cubes Based on Queries, Nov. 2001, pp. 1-7. |
| Schultz, Data Mining for Detection of New Malicious Executables, May 2001, pp. 1-13. |
| U.S. Appl. No. 13/099,516, filed May 3, 2011, entitled “Object Classification in a Capture System,” Inventor(s) William Deninger, et al. |
| U.S. Appl. No. 13/168,739, filed Jun. 24, 2011, entitled “Method and Apparatus for Data Capture and Analysis System,” Inventor(s) Erik de la Iglesia, et al. |
| U.S. Appl. No. 13/187,421, filed Jul. 20, 2011, entitled “Query Generation for a Capture System,” Inventor(s) Erik de la Iglesia, et al. |
| U.S. Appl. No. 13/188,441, filed Jul. 21, 2011, entitled “Locational Tagging in a Capture System,” Inventor(s) William Deninger et al. |
| U.S. Appl. No. 13/422,791, filed Mar. 16, 2012, entitled “System and Method for Data Mining and Security Policy Management”, Inventor, Weimin Liu. |
| U.S. Appl. No. 13/424,249, filed Mar. 19, 2012, entitled “System and Method for Data Mining and Security Policy Management”, Inventor, Weimin Liu. |
| U.S. Appl. No. 13/431,678, filed Mar. 27, 2012, entitled “Attributes of Captured Objects in a Capture System”, Inventors William Deninger, et al. |
| U.S. Appl. No. 13/436,275, filed Mar. 30, 2012, entitled “System and Method for Intelligent State Management”, Inventors William Deninger, et al. |
| U.S. Appl. No. 13/337,737, filed Dec. 27, 2011, entitled “System and Method for Providing Data Protection Workflows in a Network Environment”, Inventor(s) Ratinder Paul Singh Ahuja, et al. |
| U.S. Appl. No. 13/338,060, filed Dec. 27, 2011, entitled “System and Method for Providing Data Protection Workflows in a Network Environment”, Inventor(s) Ratinder Paul Singh Ahuja, et al. |
| U.S. Appl. No. 13/338,159, filed Dec. 27, 2011, entitled “System and Method for Providing Data Protection Workflows in a Network Environment”, Inventor(s) Ratinder Paul Singh Ahuja, et al. |
| U.S. Appl. No. 13/338,195, filed Dec. 27, 2011, entitled “System and Method for Providing Data Protection Workflows in a Network Environment”, Inventor(s) Ratinder Paul Singh Ahuja, et al. |
| Mao et al. “MOT: Memory Online Tracing of Web Information System,” Proceedings of the Second International Conference on Web Information Systems Engineering (WISE '01); pp. 271-277, (IEEE0-0-7695-1393-X/02) Aug. 7, 2002 (7 pages). |
| Webopedia, definition of “filter”, 2002, p. 1. |
| Werth, T. et al., “Chapter 1—DAG Mining in Procedural Abstraction,” Programming Systems Group; Computer Science Department, University of Erlangen-Nuremberg, Germany. |
| Walter Allasia et al., Indexing and Retrieval of Multimedia Metadata on a Secure DHT, University of Torino, Italy, Department of Computer Science, Aug. 31, 2008, 16 pages. |
| International Preliminary Report on Patentability Written Opinion of the International Searching Authority for International Application No. PCT/US2011/024902 dated May 7, 2013 (5 pages). |
| U.S. Appl. No. 13/896,210, filed May 16, 2013, entitled “System and Method for Data Mining and Security Policy Management” Inventor(s) Ratinder Paul Singh Ahuja et al. |
| Number | Date | Country | |
|---|---|---|---|
| 20130246925 A1 | Sep 2013 | US |
