International Business Machines Corporation

Chee Meng Low

Vivek Shankar

Edwin Boaz Soenaryo

Nandagopal Seshagiri

Kelvin K V Chin

Weng Sing Tang

Tien Hiong Lee

Konstantin Levinski

Larisa Shwartz

Yaoping Ruan

Milton H Hernandez

Peng Tsin Ong

Paul Driscoll

Paul Jennings

Christopher John Hockings

Matthew Paul Ouellette

Eng-Kiat Koh

Suhas Venkatesh Kashyap

Advait Deepak Karande

Chiang Kai Er

Sharad Ganesh

Mok Ku

Sriram Saroop

A method, system and a computer program product are provided for updating mobile device applications at a central cloud server by establishing an application virtual machine representation of a first mobile device application installed on a mobile device; updating the application virtual machine representation at the central cloud server to perform software configuration, installation, upgrade, optimization, testing, or maintenance tasks on the application virtual machine representation without using computational resources at the mobile device; and sending the mobile device one or more modules that were changed when updating the application virtual machine representation for integration into the first mobile device application installed on the mobile device.

Method and system for mobile applications update in the cloud

Embodiments can provide a method for accessing an endpoint, including: receiving, from a privileged user, a request for accessing the endpoint; providing, by a user behavior analytics device, a risk score with respect to the privileged user, wherein the risk score is calculated based on at least one action performed by the privileged user. If the risk score is lower than a first predefined value, providing access to the endpoint for the privileged user. If the risk score is higher than a second predefined value, denying the request for accessing the endpoint. If the risk score is between the first predefined value and the second predefined value, performing at least one of: providing, by a privileged identity management server, a multi-factor authentication against the privileged user; and rerouting the request for accessing the endpoint for approval.

Privileged identity authentication based on user behaviors

A computer-implemented method, a computer program product, and a computer system for handling email flows arising from transactions initiated with a shared privileged identity at a service provider. A privileged identity management (PIM) system reads an email sent from a service provider to a single shared PIM email address, wherein the single shared PIM email address is associated with a shared ID and wherein the email is related to a transaction initiated with the shared ID at the service provider. The PIM system analyzes the email by extracting an ID of the transaction and keywords in the email. The PIM system identifies one or more PIM users relevant to the transaction, based on analysis of the email. The PIM system sends a notification of the email to the one or more PIM users relevant to the transaction.

Handling email flows arising from transactions initiated with a shared privileged identity at a service provider

A method and technique for OCR-based single sign-on in a computing environment includes launching a login interface to log a user into an application. The login interface includes one or more input fields configured to receive credentials to be authenticated. An agent executing on a computer device sends a keystroke to input data into at least one of the input fields. A screenshot of the login interface is captured, and then the agent attempts to determine a state of a login operation on the login interface based on the captured screenshot. Responsive to being unable to determine the state of the login operation on the login interface, the agent sends at least one keystroke to return the login operation to a known state.

OCR-based single sign-on

A generic approach to extending the authentication and authorization capabilities of a client-server application (e.g., a VPN) without any code changes. To this end, the application is augmented with an authentication mechanism comprising a pair of cooperating components: an authentication agent that is associated with (and hooks into) the client-side of the application, and an authentication server that is associated with the server-side. In operation, the authentication server issues commands to the authentication agent to acquire all required data from the user, device or host environment, and the authentication agent (hooked into the VPN client) scrapes requests originating from the authentication server and injects (e.g., by auto-fill) the appropriate responses into the VPN client UI for transmission back through the VPN server and to the authentication server. The commands and responses are communicated using a challenge-response protocol (e.g., RADIUS) implemented by the VPN client-server.

Extending authentication and authorization capabilities of an application without code changes

A method and technique for OCR-based single sign-on in a computing environment includes automatically causing a display of a dialog screen of an application in response to launching a login interface of the application. An image of the dialog screen is automatically captured, and version information about the application is derived from the image of the dialog screen. An image of the login interface is automatically captured, and the launched login interface is automatically verified as corresponding to a version of the application based on the version information derived from the image of the dialog screen.

In an approach for providing auditable retrieval of privileged credentials in a privilege identity management (PIM) system, a processor invokes a checkout of a PIM credential, based on, at least, a determination that a PIM server cannot be accessed. A processor receives a request to access the PIM credential by a user. A processor receives validation of the request to access the PIM credential and an identity of the user. A processor retrieves the PIM credential from a database, wherein the database stores a plurality of PIM credentials owned by a system owner.

Auditable retrieval of privileged credentials

According to one aspect of the present disclosure, a method and technique for OCR-based single sign-on in a computing environment is disclosed. The method includes: responsive to launching of an application login interface, capturing an image of the login interface; determining a location of a cursor on the login interface from the image; determining whether the location of the cursor corresponds to a credential input field of the login interface; and responsive to determining that the location of the cursor corresponds to the credential input field of the login interface, automatically sending a keystroke to the login interface to insert at least one character to the login interface.

In an environment wherein a front end system receives a service request, and a back end system responds to the request, a user of a target endpoint must be authenticated. A ticket ID is assigned to the service request, and responsive to an initiating action of the user, a virtual token is generated that has a specified relationship with the ticket ID. The virtual token is delivered to the user, and the user is prompted to present the token to a validating component associated with one of the front end or back end systems, wherein the validating component is configured to verify the token validity. If the token is found to be valid, the user is authenticated to access the specified target endpoint.

Growing community of inventors

Singapore, Singapore

Chee Meng Low