International Business Machines Corporation

Anthony Thomas Sofia

Matthias Klein

Jonathan D Bradbury

Deborah A Furman

Peter Grimm Sutton

Peter Bergersen Yocom

Bruce C Giamei

Joerg-Stephan Vogt

Jason G Katonica

Simon Weishaupt

Brad D Stilwell

Christian Jacobi

Mark S Farrell

Dale Francis Riedy, Jr

Frank Haverkamp

Thomas Fuchs

Nicholas P Sardino

Timothy John Slegel

Louis P Gomes

John C Dayka

Bonnie Michele Ordonez

Brian D Keuling

Scott Ballentine

Colin D Chen

Marco Kraemer

Ashutosh Misra

Michael J Jordan

Timothy J Siegel

James M Caffrey

Robert M Abrams

Marna Walle

Nicholas C Matsakis

Joseph W Gentile

Mahmoud Amin

Reiner Rieke

Michael Terrence Cohoon

Keith Joseph Miller

Ashutosh Mishra

Hartmut Droege

Gunnar Von Boehn

Trent Balta

Robert W St John

Michael G Jutt

Daniel Nieves

Michael Ruettger

Thomas Ginader

Torin Reilly

Donald W Schmidt

Elpida Tzortzatos

Scott Barnett Swaney

Christopher V Derobertis

Girish Gopala Kurup

Benjamin P Segal

Mark A Nelson

Bryan Childs

Steven Bruce Jones

Stefan Usenbinz

Deepankar Bhattacharjee

Robert Peter Catalano

Marcos Barbieri

Michael Kuan

Heather M Bosko

Bradley M Messer

Connor T Hayes

Andrew M Rundall

Elizabeth Santiago

Aspects include receiving a query at a data engine. The data engine includes data in a protected format stored in a secured database and a copy of the data in a clear format stored in a secured database replica. The query is received from a requestor. The query is processed at the secured database replica to generate a query response in the clear format. The query response is converted into the protected format. The converted query response in the protected format is provided to the requestor.

Secure ingress and egress for data engines

Aspects include encrypting data based at least in part on a session key to generate encrypted data. The session key is encrypted based at least in part on a sender key to generate an encrypted session key. A request for an encrypted sender key index is transmitted to the key management system (KMS), the request includes an index of the sender key and an index of each of one or more additional keys. The encrypted sender key index is received from the KMS. An object that includes the encrypted data, the encrypted session key, the index of each of the one or more additional keys, and the encrypted sender key index is generated. Access to the data via the object is controlled based at least in part on whether a receiver has access to the sender key and to the one or more additional keys.

Distributing encrypted data objects with encryption information as metadata

Aspects include receiving a notification that a value of a data element stored in a source storage location in a source format has been changed to an updated value. The change is replicated to a plurality of target storage locations. The replicating includes, for each of the plurality of target storage locations, determining a target format of the data element in the target storage location. The target format is one of a plurality of different formats, including the source format. Each of the different formats provide a different level of data protection for the data element. In response to determining that the target format is not the same as the source format, the updated value of the data element is converted into the target format, and the updated value of the data element is stored in the target format at the target storage location.

Distribution of user specific data elements in a replication environment

Aspects include receiving an outbound payload for output to a requestor as part of a response to a call by the requestor to an application programming interface (API). Clear data in the outbound payload is selected for encryption based on policy information. The clear data is encrypted to generate encrypted data, and the encrypted data is inserted into the outbound payload in place of the clear data to generate an updated outbound payload. The response, including the updated outbound payload, is sent to the requestor.

Secure ingress and egress of data fields through legacy computer systems

A computer-implemented method for replicating data changes through distributed invalidation includes receiving, by a distributed database system, an instruction to change a data element in a table. The distributed database system includes at least a first server and a second server. A first copy of the table is stored on the first server, and a second copy of the table is stored on the second server. The method further includes in response to the instruction, determining that the data element is secured by a replication key that is stored on a shared key management system that is accessible by the first server and by the second server, wherein the replication key is unique to the data element. The method further includes invalidating the replication key and modifying the first copy of the table on the first server according to the instruction that is received.

Replicating data changes through distributed invalidation

Aspects of the invention include protecting data objects in a computing environment based on physical location. Aspects include receiving, by a computing system, a request to access an encrypted data from an authenticated user, wherein the encrypted data includes information about a data encryption key used to encrypt the encrypted data. Aspects also include providing, by the computing system, the encrypted data to the computer system where the user was authenticated, the computer system including a set of decryption keys protected by a master key stored within a hardware security module associated with the location of the hardware security module. Aspects further include decrypting, by the hardware security module, the encrypted data based on a determination that the data encryption key corresponds to one of the set of decryption keys, wherein the set of decryption keys are determined based on the location of the hardware security module.

Multi-phase protection for data-centric objects

A described method includes receiving, by a database system, an instruction to change a first data element in a table in a database, which includes a first copy and a second copy of the table. A first entry is created in a first change-table. The first entry includes an updated value for a first data element. A second entry is created in a second change-table. Creating the second entry includes, changing the updated value into a ciphertext if the first data element is secured, and storing the ciphertext into the second entry. If the first data element is non-secured, the updated value is stored into the second entry as is. The second copy of the table is modified using the second change-table. The second copy of the table is used to respond to subsequent queries.

Secure data replication in distributed data storage environments

Techniques for container-based cryptography hardware security module (HSM) management in a computer system are described herein. An aspect includes providing a cryptography work daemon container in a computer system, wherein the cryptography work daemon container in the computer system has privileged access to a cryptography HSM of the computer system. Another aspect includes receiving, by the cryptography work daemon container, a request for a cryptography function of the cryptography HSM from an application container in the computer system. Another aspect includes causing, by the cryptography work daemon container, the cryptography HSM to perform the cryptography function based on receiving the request.

Container-based cryptography hardware security module management

A method is provided that includes receiving, by a firmware from an originating software, an asynchronous request for an instruction of an algorithm for compression of data. The firmware operates on a first processor and the originating software operates on a second processor. The firmware issues a synchronous request to the first processor to cause the processor to execute the instruction synchronously. It is determined, by the firmware, whether an interrupt is received from the first processor with respect to the first processor executing the instruction. The firmware retries the issuance of the synchronous request each time the interrupt is received until a retry threshold is reached.

Functional completion when retrying a non-interruptible instruction in a bi-modal execution environment

Embodiments include techniques for detection of data offloading through instrumentation analysis, where the techniques include monitoring, via a processor, an execution of a job, and analyzing processes associated with the job to determine a pattern. The techniques also include determining whether the pattern of the job is associated with a pattern for a workload type, and classifying the job based at least in part on the determination.

Detection of data offloading through instrumentation analysis

Embodiments are described for ordering records. Aspects include blocking one or more records and storing the one or more blocked records as a set of records. Aspects also include reserving space for a metadata record for each of the one or more blocked records that meet one or more selection criteria and generating the metadata record for each of the one or more blocked records that meet the one or more selection criteria. Aspects further include adding the metadata records to the set of blocked records and storing the set of records including the metadata records.

Ordering records for timed meta-data generation in a blocked record environment

A select processor obtains a request to perform a requested operation. The request includes encrypted data and a protected key. The protected key is to be used by the select processor on behalf of an entity unauthorized to use the protected key. The encrypted data is decrypted using the protected key to obtain decrypted data. The requested operation is performed on the decrypted data to obtain resulting data. The resulting data is encrypted (e.g., using the protected key) to obtain encrypted resulting data. The encrypted resulting data is provided to a requestor of the request.

Employing a protected key in performing operations

Embodiments include encrypting an object such that the creator of the encrypted object can be identified. Aspects include receiving, by a processor, an unencrypted object that includes plaintext and metadata that describes the plaintext and obtaining, by the processor in response to a request from a user, a data encryption key (DEK) and a nonce key for the unencrypted object, the nonce key being unique to the user. Aspects also include encrypting, by the processor, the unencrypted object. The encrypting includes generating a nonce based at least in part of the plaintext and the nonce key and generating ciphertext and a metadata authentication tag comprising a signature of the metadata, the generating based at least in part on the plaintext, the metadata, the DEK, and the nonce. Aspects further include creating an encrypted object that includes the ciphertext, the metadata, and the metadata authentication tag.

Identification of a creator of an encrypted object

Aspects include receiving a request from a user to access data that was acquired by a third-party from a data owner, the data in an encrypted format unreadable by the user. In response to receiving the request from the user to access the data, a third-party key from the third-party is requested and a data owner key from the data owner is requested. The third-party key and the data owner key are applied to the data in the encrypted format to generate the data in an unencrypted format readable by the user. The user is provided with access to the data in the unencrypted format.

Content control through third-party data aggregation services

A processor requests that a data transformation operation be performed using another processor, in which the data transformation operation is performed asynchronously. A determination is made that the data transformation operation performed using the other processor has completed unsatisfactorily, and based on the unsatisfactory completion, status relating to performance of the data transformation operation is incomplete. The data transformation operation is then re-executed synchronously using the one processor, and the re-executing provides status information unavailable in performing the data transformation operation asynchronously.

Synchronous re-execution of a data transformation operation to obtain further details regarding an exception

Growing community of inventors

Highland, NY, United States of America

Anthony Thomas Sofia