Abstract: Techniques and systems for computer network security are described. One example system includes a computer security mechanism based on multiple security states that each allow successively increased levels of network access, where transitions between the security states occur in response to specified conditions or events. An example system starts (e.g., boots, initializes, powers up) in a first state in which no network communication is allowed. In response to an event such as a user starting a Web browser or other approved program, the system transitions into a second state, in which only outbound network communication is allowed. Thus, in the second state the Web browser can make an outbound request for information but any inbound connection requests will be rejected. In response to other events, the system transitions to security states that allow successively higher levels of network communication.

Abstract: Computer security techniques are described. One example provides a security module. The security module executes on a computing system and determines whether to allow a user or a program (e.g., native executable, script, etc.) associated with the user to access a resource, such as by reading, writing, or executing a file. An example operation system provides a new system administration mechanism that enforces rights and limitations for specific administrative and application groups that each have their own super user. Such a system may include a safe mode superuser who is required to log in when the system is in maintenance mode (e.g., single user console mode) at which time the safe mode superuser is the only user who is allowed to make programs executable.

Abstract: Computer security techniques are described. One example provides a security module. The security module executes on a computing system and determines whether to allow a user or a program (e.g., native executable, script, etc.) associated with the user to access a resource, such as by reading, writing, or executing a file. An example operation system provides a new system administration mechanism that enforces rights and limitations for specific administrative and application groups that each have their own super user. Such a system may include a safe mode superuser who is required to log in when the system is in maintenance mode (e.g., single user console mode) at which time the safe mode superuser is the only user who is allowed to make programs executable.

Abstract: Computer security techniques are described. One example provides a security module. The security module executes on a computing system and determines whether to allow a user or a program (e.g., native executable, script, etc.) associated with the user to access a resource, such as by reading, writing, or executing a file. This decision is based at least in part on whether an access control list that is associated with the resource specifies that a source (e.g., IP address, hardware address) that is associated with the user is allowed to access the resource. This decision can also or instead be based on whether the computing system is executing in maintenance mode, such as in single-user diagnostic mode.

Abstract: Techniques for computer security, and more specifically timestamp-based key generation techniques, are described. Some implementations provide a table of key generation processes that is shared as a secret between a first computing system and a second computing system, both of which have synchronized clocks. Both computing systems use the same technique for selecting a key generation process from the table, such as based on a random number generator seeded with a timestamp. Since the computing systems have synchronized clocks, they both select and use the same key generation process, thereby generating the same encryption key without the need to communicate the key from one system to another. Furthermore, both computing systems may synchronize their clocks to a private time server that maintains a clock that runs faster or slower than standard time.

Abstract: Techniques for computer security, and more specifically timestamp-based key generation techniques, are described. Some implementations provide a table of key generation processes that is shared as a secret between a first computing system and a second computing system, both of which have two clocks. The first clock is a real-time clock and the second clock is a variable-time clock. The variable time clocks are synchronized and run at the same rate, faster or slower than real time. Both computing systems use the same technique for selecting a key generation process from the table, such as based on a random number generator seeded with a timestamp obtained from their variable time clocks. Since the computing systems have synchronized variable-time clocks, they both select and use the same key generation process, thereby generating the same encryption key without the need to communicate the key from one system to another.

Abstract: Techniques for computer security, and more specifically timestamp-based key generation techniques, are described. Some implementations provide a table of key generation processes that is shared as a secret between a first computing system and a second computing system, both of which have two clocks. The first clock is a real-time clock and the second clock is a variable-time clock. The variable time clocks are synchronized and run at the same rate, faster or slower than real time. Both computing systems use the same technique for selecting a key generation process from the table, such as based on a random number generator seeded with a timestamp obtained from their variable time clocks. Since the computing systems have synchronized variable-time clocks, they both select and use the same key generation process, thereby generating the same encryption key without the need to communicate the key from one system to another.

Abstract: Computer security techniques are described. One example determines whether to allow a program (e.g., native executable, script, etc.) to execute. This decision is based at least in part on the source of the program, such as whether the program is provided by a privileged source. A privileged program source may be any module, mechanism, or process that can provide executable instructions, such as directory or folder (e.g., on a local disk or network-accessible store), a computing device (e.g., server computer), another program (e.g., a Web server), or the like.

Abstract: Computer security techniques are described. One example provides a security module. The security module executes on a computing system and determines whether to allow a user or a program (e.g., native executable, script, etc.) associated with the user to access a resource, such as by reading, writing, or executing a file. This decision is based at least in part on whether an access control list that is associated with the resource specifies that a source (e.g., IP address, hardware address) that is associated with the user is allowed to access the resource. This decision can also or instead be based on whether the computing system is executing in maintenance mode, such as in single-user diagnostic mode.

Abstract: Techniques for computer security, and more specifically timestamp-abased authentication, are described. Some implementations provide an authentication method that utilizes an authentication process that is shared as a secret between a client and an authenticator. The process provides as output a number that is based on a timestamp. To authenticate the client when it attempts to access a target service, both the client and authenticator execute the authentication process using locally generated timestamps. If the outputs of the authentication process match, the client is authenticated. If not, subsequent network communications from the client are either denied or redirected to an alternative computing system that masquerades as the target service.

Abstract: Techniques for computer security, and more specifically timestamp-abased authentication, are described. Some implementations provide an authentication method that utilizes an authentication process that is shared as a secret between a first and second computing system. The process provides as output a number that is based on a timestamp. The first computing system executes the authentication process using a timestamp obtained from its clock. The resulting number is transmitted to the second computing system, possibly along with other authentication data, such as a username and/or password. In response, the second computing system executes the authentication process using a timestamp obtained from its clock. If the numbers generated by the first and second computing systems match, the first computing system is authenticated.

Abstract: Techniques for computer security, and more specifically timestamp-based key generation techniques, are described. Some implementations provide a table of key generation processes that is shared as a secret between a first computing system and a second computing system, both of which have synchronized clocks. Both computing systems use the same technique for selecting a key generation process from the table, such as based on a random number generator seeded with a timestamp. Since the computing systems have synchronized clocks, they both select and use the same key generation process, thereby generating the same encryption key without the need to communicate the key from one system to another. Furthermore, both computing systems may synchronize their clocks to a private time server that maintains a clock that runs faster or slower than standard time.

Abstract: Techniques for computer security, and more specifically timestamp-abased authentication, are described. Some implementations provide an authentication method that utilizes an authentication process that is shared as a secret between a first and second computing system. The process provides as output a number that is based on a timestamp. The first computing system executes the authentication process using a timestamp obtained from its clock. The resulting number is transmitted to the second computing system, possibly along with other authentication data, such as a username and/or password. In response, the second computing system executes the authentication process using a timestamp obtained from its clock. If the numbers generated by the first and second computing systems match, the first computing system is authenticated.

Abstract: Techniques for computer security, and more specifically timestamp-abased authentication, are described. Some implementations provide an authentication method that utilizes an authentication process that is shared as a secret between a client and an authenticator. The process provides as output a number that is based on a timestamp. To authenticate the client when it attempts to access a target service, both the client and authenticator execute the authentication process using locally generated timestamps. If the outputs of the authentication process match, the client is authenticated. If not, subsequent network communications from the client are either denied or redirected to an alternative computing system that masquerades as the target service.

Abstract: Computer security techniques are described. One example determines whether to allow a program (e.g., native executable, script, etc.) to execute. This decision is based at least in part on the source of the program, such as whether the program is provided by a privileged source. A privileged program source may be any module, mechanism, or process that can provide executable instructions, such as directory or folder (e.g., on a local disk or network-accessible store), a computing device (e.g., server computer), another program (e.g., a Web server), or the like.

Abstract: Techniques for network security are disclosed. In some implementations, an evaluation module determines whether a network communication from a source computing system to a destination computing system is allowable. The allowability of the communication is determined based properties of the network communication, such as a source or destination address, a port number, a time of day, a geographic location, and the like. If the communication is disallowed, the evaluation module or a related component redirects the communication to an alternative computing system that masquerades as the destination communication system.

Abstract: Techniques for network security are disclosed. In some implementations, an evaluation module determines whether a network communication from a computing device is allowable. The allowability of the communication is determined based on (1) whether the computing device is using an authorized source network address, and (2) whether a non-modifiable identifier of the computing device is authorized. The non-modifiable identifier is a fixed hardware identifier of the computing device, such as an identifier of a CPU, network interface card, storage device, or the like.

Abstract: Techniques for network traffic filtering and flow control are disclosed. Some implementations provide a network communication evaluation module (“NCEM”) that executes on a networking device, such as a gateway or router, and performs network traffic control, such as suppressing denial of service attacks or otherwise limiting packet flow. The NCEM performs packet filtering in order to identify and drop packets that are being (or are likely to be) transmitted as part of a denial of service attack. The NCEM conditionally drops packets that meet specified conditions or rules. For example, the NCEM may drop all packets that are using a nonauthentic source address. As another example, the NCEM may limit the volume of packets of a particular type, such as by limiting the number of DNS requests that are made during a specified time interval.

Abstract: Techniques for evaluating a questionable network communication are disclosed. In some implementations, a network of computing systems or devices is provided. Each system includes an evaluation module that determines whether an outbound or inbound network communication is allowable based on one or more factors or properties of the communication, including one or more of an IP address, a listening port, a geographic location, time of day, or the like. The systems in the network may be configured to only communicate with other devices that are identified in a white list of trusted computing systems.

Abstract: Techniques for evaluating a questionable network communication are disclosed. In some implementations, a network of computing systems or devices is provided. Each system includes an evaluation module that determines whether an outbound or inbound network communication is allowable based on one or more factors or properties of the communication, including one or more of an IP address, a listening port, a geographic location, time of day, or the like. The systems in the network may be configured to only communicate with other devices that are identified in a white list of trusted computing systems.