International Business Machines Corporation

Axel Tanner

Bo Yang

Michael Elton Nidd

Suzanne K McIntosh

Metin Feridun

Bernhard Jansen

Matthias Schunter

Marion Lee Blount

Iqbal I Mohomed

Jonathan Lenchner

Canturk Isci

Rajarshi Das

Diego M Zamboni

Harigovind Ramasamy

Martim Carbone

Mechanisms are provided for virtualizing physical sensors and providing sensor data to a requestor using the virtualized physical sensors. The mechanisms obtain sensor data from a plurality of physical sensors and storing the sensor data in a virtual sensor storage system of the data processing system in at least one standardized format. A request from a requestor for a first type of sensor data is received which does not specify a particular physical sensor. A portion of the sensor data stored in the virtual sensor storage system is retrieved in response to receiving the request, the portion of sensor data corresponding to the type of sensor data requested in the request from the requestor. The retrieved portion of the sensor data is returned to the requestor in a format corresponding to a physical sensor configured to provide the requested type of sensor data.

Sensor virtualization through cloud storage and retrieval mechanisms

At least one anomaly associated with at least one actual hardware element in a computer system having a plurality of hardware elements is addressed. The anomaly is detected, and, responsive to the detection, a virtualization layer is inserted between (i) an operating system of the computer system, and (ii) the plurality of hardware elements. Hardware emulation and/or selective hardware activation/deactivation are performed on the at least one actual hardware element by the virtualization layer. The insertion of the virtualization layer is accomplished in an on-the-fly manner.

Hardware emulation using on-the-fly virtualization

Mechanisms are provided for determining the location of computing assets within an organization. These mechanisms determine first location information identifying a location of at least one first physical asset housing in a predetermined physical area of the organization relative to a predetermined coordinate system, and second location information identifying a location of at least one second physical asset housing within the at least one first asset housing. The mechanisms automatically determine third location information identifying a location of at least one computing asset within the at least one second physical asset housing. In addition, the mechanisms generate an asset location map data structure for the organization based on the first, second and third location information. The mechanisms also perform at least one management operation for managing resources of the organization, based on the asset location map data structure for the organization.

Location of computing assets within an organization

A firewall system adapted for location outside the client machine, preferably in the same data processing device as the client machine but outside a virtual machine containing the client machine. Control logic of the firewall system receives incoming and outgoing connections from the network and client machine respectively. In response to a connection request initiating a connection between respective endpoints in the network and client machine, the control logic performs a security assessment comprising obtaining from at least one of the network and client machine information indicative of the security state of the endpoint therein, and allows or inhibits the connection in dependence on the result of the security assessment. The security assessment may be performed in accordance with a security policy of the system, and different security assessments may be performed for different connection requests in accordance with the security policy.

Firewall for controlling connections between a client machine and a network

A method for protecting the integrity of a set of memory pages to be accessed by an operating system of a data processing system, includes running the operating system in a virtual machine (VM) of the data processing system; verifying the integrity of the set of memory pages on loading of pages in the set to a memory of the data processing system for access by the operating system; in response to verification of the integrity, designating the set of memory pages as trusted pages and, in a page table to be used by the operating system during the access, marking non-trusted pages as paged; and in response to a subsequent page fault interrupt for a non-trusted page, remapping the set of pages to a region of the data processing system memory which is inaccessible to the virtual machine.

Integrity protection in data processing systems

A first virtualization layer is inserted between (i) an operating system of a computer system, and (ii) at least first and second hardware devices of the computer system. Data is communicated between the first hardware device and the second hardware device, via the first virtualization layer, without exposing the data to the operating system.

Growing community of inventors

Kilchberg, Switzerland

Axel Tanner