Abstract: A computer implemented method includes intercepting transfer of an IM attachment, providing a comforting message that the IM attachment is being delayed, and evaluating the IM attachment for malicious code. Upon a determination that the IM attachment is non-malicious, the IM attachment is transferred to the recipient IM user. By explaining the delay in receipt of the IM attachment, the recipient IM user is prevented from becoming disconcerted about the delay.

Abstract: Disclosed are a semiconductor package and a method of making the same. In the semiconductor package, a substrate and a semiconductor die are covered with and encapsulated by vertically pressing thermosetting resin having fluidity in a predetermined temperature range and denaturalizing itself in gel. Thus, it is possible to reduce a thickness of the semiconductor package and prevent wire sweeping.

Abstract: A semiconductor package including a top-surface metal layer for implementing circuit features provides improvements in top-surface interconnect density, more flexible routing and mounting of top surface semiconductor packages, dies and passive components or a conformal shield cap implementation. The metal layer interconnected with an internal substrate of the semiconductor package by blind vias laser-ablated through the encapsulation and filled with metal. The vias extend from the top surface to an internal package substrate or through the encapsulation to form bottom-side terminals. The metal layer may be formed by circuit patterns and/or terminals embedded within the encapsulation conformal to the top surface by laser-ablating channels in the top surface of the encapsulation and filling the channels with metal. A conformal coating may be applied to the top surface of the semiconductor package over the metal layer to prevent solder bridging to circuit patterns of the metal layer.

Abstract: Parameters of DNS transactions associated with DNS MX record queries, which may be performed by mass-mailing worms from a host computer system, are detected at a DNS proxy and collected. An outbound SMTP transaction, such as an e-mail message, received at an SMTP proxy is stalled at the SMTP proxy and a determination is made whether malicious code activity is detected on the host computer system by correlating the parameters associated with the DNS MX record queries and the e-mail message. In one embodiment, above a specified threshold rate of DNS MX record queries to resolve SMTP server IP addresses, followed by the use of a resolved SMTP server IP address to send the e-mail message, an assumption is made that the e-mail message is generated by a worm, such as a mass-mailing worm, and protective action is taken thus preventing propagation of the worm, or other malicious code, via the outbound e-mail message.

Abstract: Architectural techniques and implementations that defer enforcement of certain delayed control transfer instruction (DCTI) sequencing constraints or conventions to later stages of an execution pipeline are described. In this way, complexity of a processor pipeline front-end (including fetch sequencing) can be simplified, at least in-part, by fetching instructions generally without regard to such constraints or conventions. Instead, enforcement of such sequencing constraints and/or conventions may be deferred to one or more pipeline stages associated with commitment or retirement of instructions. Higher fetch bandwidth may be achieved in some realizations when, for example, DCTI couples are encountered in an execution sequence.

Abstract: A copy of the raw data on physical disk of an inaccessible source file is automatically generated in an accessible target file. When accessed, the copy of the raw data of the inaccessible source file in the accessible target file can be read allowing a user or application to evaluate the data of the accessible target file, and thus indirectly the raw data of the inaccessible source file. In some embodiments, the copy of the raw data is evaluated for malicious code, allowing a user or application to take protective actions, such as deleting the inaccessible source file. Where the raw data of the inaccessible source file is encrypted, the copy of the raw data is automatically decrypted by the operating system when read yielding unencrypted data. Where the raw data of the inaccessible source file is compressed, the copy of the raw data is automatically decompressed by the operating system when read yielding uncompressed data.

Abstract: A method of forming a wafer level package includes attaching a laser-activated dielectric material to an integrated circuit substrate to form an assembly, the integrated circuit substrate including a plurality of electronic components having terminals on first surfaces thereof. The laser-activated dielectric material is laser activated and ablated with a laser to form laser-ablated artifacts in the laser-activated dielectric material and simultaneously to form an electrically conductive laser-activated layer lining the laser-ablated artifacts. The laser-ablated artifacts are filled using an electroless plating process in which an electrically conductive filler material is selectively plated on the laser-activated layer to form an embedded circuit pattern within the laser-activated dielectric material.

Abstract: A shielded package includes a shield assembly having a shield fence, a shield lid, and a shield lid adhesive electrically coupling the shield lid to the shield fence. The shield fence includes a porous sidewall through which molding compound passes during molding of the shielded package. Further, the shield fence includes a central aperture through which an electronic component is die attached and wire bonded.

Abstract: A method of forming an optical module includes mounting an image sensor to a base of a substrate and bonding a lens housing to a sidewall of the substrate. A mounting surface of the lens housing includes a locking feature having a horizontal surface and a vertical surface. The sidewall of the substrate includes a joint surface. To bond the lens housing to the sidewall of the substrate, a bond is formed between the horizontal surface of the locking feature of the lens housing and the joint surface of the sidewall. Further, a bond is formed between the vertical surface of the locking feature of the lens housing and an interior surface of the sidewall.

Abstract: A technique maintains return address stack (RAS) content and alignment of a RAS top-of-stack (TOS) pointer upon detection of a tail-call elimination of a return-type instruction. In at least one embodiment of the invention, an apparatus includes a processor pipeline and at least a first return address stack for maintaining a stack of return addresses associated with instruction flow at a first stage of the processor pipeline. The processor pipeline is configured to maintain the first return address stack unchanged in response to detection of a tail-call elimination sequence of one or more instructions associated with a first call-type instruction encountered by the first stage. The processor pipeline is configured to push a return address associated with the first call-type instruction onto the first return address stack otherwise.

Abstract: An in-system memory testing method includes transparently selecting and “stealing” a portion of memory from the memory system for running memory tests, then running one or more of the numerous known memory system tests on the selected portion of memory, and then inserting the selected, and now tested, portion of memory back into the system for normal application use. The disclosed in-system memory testing method is capable of testing system memory in both offline and online environments, without imposing any additional hardware requirements or significantly affecting system performance. The disclosed in-system memory testing method is compatible with any conventional prior art functional test algorithm for in-system memory testing and can be performed under real life system environmental conditions. Therefore, the disclosed in-system memory testing method complements other test techniques like BIST/POST that are conventionally used only at the time of system boot up.

Abstract: A small footprint device can securely run multiple programs from unrelated vendors by the inclusion of a context barrier isolating the execution of the programs. The context barrier performs security checks to see that principal and object are within the same namespace or memory space and to see that a requested action is appropriate for an object to be operated upon. Each program or set of programs runs in a separate context. Access from one program to another program across the context barrier can be achieved under controlled circumstances by using an entry point object. The entry point object can either perform accesses across the context barrier on behalf of a requesting program or can pass the request to the program to be accessed and switch contexts to the program to be accessed.

Abstract: Call to driver load functions, including associated driver objects to be loaded, are stalled and evaluated for indications of a rootkit. When a rootkit is indicated, protective action is taken, and optionally a user or system administrator are notified. Calls not indicative of a rootkit are released and allowed to load. In one embodiment, calls to currently loaded drivers and calls related to installation of new hardware, are excluded from the evaluation for indications of a rootkit. In additional embodiments, sensitive structures and calls to sensitive structures of a computer system are also evaluated for indications of a rootkit.

Abstract: A system and method for configuration management and enforcement of software applications in a computer network. The system comprises of one or more server computers, a configuration rules database and a plurality of client computers. Each client computer has an agent running on it. The agent, after being invoked or on a periodic basis, contacts a server computer to obtain the latest configuration rules from the configuration rules database. The configuration rules are then used by the agent to check the validity of the software applications. The agent also sends log data, back to the server computer, containing details of the status of the computer, any violations, actions taken, time of violations, etc. The present invention also provides a method to check and ensure that the agent is required to be run on all the client computers in order for these computers to communicate with other computers in the network.

Abstract: Systems and methods for protecting a computer during a period of increased vulnerability. In one implementation, a method for protecting a computer is provided. The method includes monitoring a computing device having an first security state for one or more events indicating a time period of increased vulnerability. The method includes adjusting one or more security policies in response to the one or more events to generate a second security state. The method also includes identifying an end of the time of increased vulnerability, and restoring the computing to the first security state. In one implementation, the computer is an embedded device.

Abstract: A method for private personal identification number (PIN) management includes receiving a first PIN, receiving a first key used to scramble a second PIN that has been validated, receiving a first scrambled PIN comprising the second PIN scrambled with the first key, scrambling the first PIN with the first key to create a second scrambled PIN and validating the first PIN based at least in part on whether the first scrambled PIN matches the second scrambled PIN.

Abstract: A machine system includes bubble protection for protecting the information of certain classes of files from unauthorized access by way of unauthorized classes of programs at unauthorized periods of time. The machine system additionally may have On-The-Fly (OTF) mechanisms for automatic decryption of confidential file data on a per-use basis and automatic later elimination of the decrypted data by scorching and/or re-encrypting is disclosed. The system can operate within a multi-threaded environment. The machine system additionally may have a digital signature mechanism for protecting file data from unauthorized tampering. The machine system additionally may have a volume-encryption mechanism for protecting plaintext versions of file data from exposure in events of power outages.

Abstract: Concurrently branch predicting for multiple branch-type instructions demands of high performance environments. Concurrently branch predicting for multiple branch-type instructions provides the instruction flow for a high bandwidth pipeline utilized in advanced performance environments. Branch predictions are concurrently generated for multiple branch-type instructions. The concurrently generated branch predictions are then supplied for further processing of the corresponding branch-type instructions.

Abstract: A method includes stalling a cache flush instruction to flush a cache; determining that the cache comprises a file that has been infected with malicious code, and terminating the cache flush instruction to prevent the cache from being flushed to disk. By preventing copying of the infected file from the cache to disk, the malicious code is prevented from being propagated to disk. Accordingly, the malicious code is detected and defeated without having the malicious code be present on disk. Thus, detection of an infected file on disk and the repair of the infected file on disk are unnecessary and obviated.

Abstract: A method and structure for creating embedded metal features includes embedded trace substrates wherein bias and signal traces are embedded in a first surface of the embedded trace substrate and extend into the body of the embedded trace substrate. The bias trace and signal trace trenches are formed into the substrate body using LASER ablation, or other ablation, techniques. Using ablation techniques to form the bias and signal trace trenches allows for extremely accurate control of the depth, width, shape, and horizontal displacement of the bias and signal trace trenches. As a result, the distance between the bias traces and the signal traces eventually formed in the trenches, and therefore the electrical properties, such as impedance and noise shielding, provided by the bias traces, can be very accurately controlled.