International Business Machines Corporation

Andrew John Bernoth

Gandhi Sivakumar

Sandeep R Patil

Riyazahamad Moulasab Shiraguppi

Timothy Michael Lynar

Geetha Adinarayan

Daniel Joseph Martin

Adam Eberbach

Piyush Sarwal

Harish Rajagopal

Sateesh S Kannegala

Chandrasekara Aiyer

Medardo Roberto Sandoval

A request to monitor a data packet to be transmitted from a first location to a second location over a first network is received. A projected time for the transmission of the data packet from the first location to the second location is determined. Responsive to determining the projected time, whether the data packet arrived at the second location after the projected time plus a variance is determined.

Offline, realtime, and historic monitoring of data packets

Mitigating network saturation includes detecting reconnection of device to a network after a period of disconnection. A set of applications residing on the device is queried for estimated data associated with the application awaiting transfer. A response is received from a first application of the set of applications including a first estimated data awaiting transfer from the first application. Responsive to determining that a response has not been received from a second application, a second estimated data awaiting transfer from the second application is determined based upon a learned data usage model for the application. A total expected data transfer amount is determined based upon the first estimated data and the second estimated data. Responsive to the determining that the total expected data transfer amount is not less than a threshold value, A priority of the data transfer for the first application and the second application is determined.

Mitigating network saturation following periods of device disconnection and subsequent reconnection

System, method and program product for managing a security policy of a firewall. The firewall receives a message packet addressed to a specified port of a destination IP address and determines that the firewall does not have a message flow rule which permits passing of the message packet to the port. The port is tested to determine if the port is open. If so, an administrator is queried whether the firewall should have a message flow rule which permits passing of the message packet to the port. If not, an administrator is not queried whether the firewall should have a message flow rule which permits passing of the message packet to the port. There may be first and second firewalls located between the source IP address and destination IP address. Before the port is tested, a central database is checked to learn if the central database has a record of whether the first firewall should have a message flow rule which permits passing of the message packet to the port. If not, and the port is found to be open, the central database is updated to indicate that both the first and second firewalls should have a message flow rule which permits passing of the message packet to the port. Also, the security policy of the first firewall is updated with a message flow rule which permits passing of the message packet to the port. The second firewall is not updated until it encounters a message packet addressed to the port.

Identifying additional firewall rules that may be needed

A smart card assembly with at least two chips. In some embodiments, the at least two chips are on the same major surface and define mutually-perpendicular, respective directions of insertion with respect to a standard reciprocating card reader. In some embodiments, the at least two chips are respectively mounted on opposite major surfaces of the smart card body.

Multi chip smart card

A method and associated systems for the environmentally aware load-balancing of components of a multi-component power-consuming system. The environmentally aware load-balancer receives continually updated values from at least two environmental sensors that monitor and report the values of environmental metrics that characterize components of the power-consuming system and the environments within which those components are located. When the load-balancer receives a task request directed to the power-consuming system, the load-balancer selects a balanced workload allocation as a function of the values of the received environmental metrics and communicates that balanced workload allocation to a routing mechanism. The routing mechanism then uses the communicated balanced workload allocation to determine which component or components of the power-consuming system should receive the task request.

Environmentally aware load-balancing

A method and system for providing a standardized set of filters for a router. A set of pre-written filters are provided in a file, and a program is run on a computer to identify one of these pre-written filters as a substitute for a filter that was specifically written for the router. The standardized filter file is then loaded onto the router and the identified substitute filters are used instead of the filter that has been specifically written for the router. Preferably, the computer program is used to identify which one of the pre-written filters of the pre-written filter files most closely matches, according to a predefined test, the filter file written specifically for the router.

Method and system for providing a filter for a router

A method and system for determining whether to alter a firewall configuration. Message flow data associated with a message packet blocked by a firewall is received. The packet was blocked based on the firewall not having a message flow rule that permitted passage of the message packet. Risk values associated with a source network, destination network and destination port are identified by the message flow data. Based on the risk values, an electronic recommendation indicating whether to add to the firewall a message flow rule that permits the message flow to pass is determined and generated.

Method and system for determining whether to alter a firewall configuration

A method for determining if a multiplicity of networks are authorized to communicate with each other and what IP protocol can be used for communication between each combination of two of the networks. For each network, a computer readable data base stores a record of (a) IP protocol(s) permitted to be used with said each network and (b) types of other networks permitted to communicate to said each network. For said each network, a computer readable data base stores a record of IP protocols and destination and source networks permitted by a respective firewall or router for said each network. For said each network, a computer readable data base stores a record of a type of said each network. Multiple combinations of the networks are automatically identified. Each of the combinations comprises a source network and a destination network. For each of the combinations, based on the records, it is automatically determined if each of the networks in the combination is permitted to communicate with the other network in the combination and what IP protocol(s) are common to both of the networks in the combination.

Growing community of inventors

Lara, Australia

Andrew John Bernoth