International Business Machines Corporation

Christine Axnix

Angel Nunez Mencias

Jakob Christopher Lang

Ute Gaertner

Juergen Probst

Albert Schirmer

Stefan Usenbinz

Friedemann Baitinger

Christoph Raisch

Jerry Wayne Stevens

Marco Kraemer

Hartmut Penner

Thomas Schlipf

Stefan Amann

Rolf Fritz

Joseph M Gdaniec

Ingo Adlung

Viktor Mihajlovski

Christopher S Smith

Carl Mayer

Friedrich Michael Welter

Michael J Mueller

Franz Hardt

Jeffrey Paul Kubala

Jeffrey Alan Frey

Marc Henri Coq

Gerd Breiter

Martin Eckert

Samuel R Connor

Gerhard Banzhaf

Michael Man Behrendt

Hubert Harrer

Andreas Bieswanger

Helmut H Weber

Andrea Schmidt

Martin Rehm

Stefan Wirag

Klaus-Jurgen Kuebl

Andreas Muehlbach

Carl J Hollenback

Katharina Scharff

Jeff A Frey

John R Birtles

A method for detecting information breach in a computer system. The method comprises: detecting a radio frequency signal in an area of the computer system. A set of samples of the radio frequency signal may be input to a machine learning model. An output of the machine learning model may be received. The output indicates whether the detected radio frequency signal is anomalous. An alarm signal may be generated in case the detected radio frequency signal is predicted as an anomalous signal.

Detecting information breach in a computer system

Deploying a software service. A defined software service offering is selected from a plurality of defined software service offerings. An instantiation order for deploying the selected defined software service offering on a corresponding computer system is generated. Each defined software service offering comprises a software service definition and at least one defined software policy. One selected from the group consisting of the software service definition, the software policy, and a combination thereof, provides a hardware configuration for the software service, a software configuration for the software service, and a managing policy for the software service. The instantiation order of the software service for execution on the computer system is created based on the hardware configuration, the software configuration and the managing policy.

Method, arrangement, computer program product and data processing program for deploying a software service

Data collection is facilitated by a multi-threaded processor. One thread of the processor obtains data placed in a buffer by another thread of the processor. The thread placing the data in the buffer is an execution thread executing a customer application and the one thread obtaining the data from the buffer is an assist thread. The assist thread stores the data obtained from the buffer in a selected location, such as a cache, main memory, a measurement control block, a persistent storage device or a network.

Data collection in a multi-threaded processor

An entitlement system includes at least two computing devices and a management controller which all include a trusted platform module. Each of the trusted platform modules include a non-volatile storage for storing entitlement records. A management unit of each computing device includes configuration means to enable and disable computing resources of the respective computing device based on entitlement records. The management controller receives ensemble entitlement records in encrypted form and distributes sub-entitlement records in a second encrypted form to the management units of the computing devices.

Resource entitlement in a multi-computer system controlled by a single instance

Provided is a method for configuring the functional capabilities of a computer system. The computer system may include a persistent memory and a replaceable functional unit. The method may include transferring, in response to a repair action for the functional unit, enablement data that is stored on the functional unit to the persistent memory. The enablement data may specify one or more functional capabilities of the functional unit that are enabled. The method may further include erasing the enablement data from the functional unit after it has been transferred to the persistent storage. The method may further include obtaining a second unique identification item from a replacement unit. The method may further include obtaining new enablement data. The new enablement data may be transferred to the replacement unit.

Configuring functional capabilities of a computer system

Techniques are disclosed for concurrently loading a plurality of new modules while code of a plurality of modules of an original computer program is loaded and executed on a computer system. An associated method may include allocating a module thread local storage (TLS) block for each thread within an initial computer program, wherein the allocated module TLS blocks are large enough to hold all module thread variables that are loaded or to be loaded. The method further may include reserving spare areas between the module TLS blocks for adding new module thread variables and arranging at an end of the module TLS blocks a thread data template section for resetting threads or creating new threads. The method may result in addition of modules to the original computer program and/or application of a concurrent patch through replacement of one or more of the plurality of original computer program modules.

Generating and applying patches to computer program code concurrently with its execution

A method includes generating a set of virtual-machine-specific (VMS) encryption keys for a dedicated virtual machine, storing the set of VMS encryption keys in a protected memory, storing a first look-up table in the protected memory, and replacing an encryption key stored in a crypto unit with at least one VMS encryption key of the set of VMS encryption keys in an operation mode where the dedicated virtual machine is executed by a processor. The protected memory is selectively excluded from access by operating systems executable on a computer system. The look-up table being accessible only by firmware of the computer system.

Protecting a memory from unauthorized access

A method, a computer program product, and a computer system for processing interrupt requests in a computer system. The computer system disables, for a processor, an interrupt request for threads other than an interrupt request handling thread. The computer system configures the processor to route the interrupt request to the interrupt request handling thread. The computer system determines, by the interrupt request handling thread, whether one of the threads needs to process the interrupt request. The computer presents, by the interrupt request handling thread, the interrupt request to the one of the threads, in response to determining that the one of the threads needs to process the interrupt request.

Processing interrupt requests

A method and data processing system are disclosed for concurrently loading a plurality of new modules while code of a plurality of modules of an original (i.e., currently running) computer program is loaded and executed on a computer system. The method may include allocating a module thread local storage (TLS) block for each thread within an initial computer program, wherein the allocated module TLS blocks are large enough to hold all module thread variables that are loaded or to be loaded. The method further may include providing constant offsets between module TLS block pointers corresponding to the module TLS blocks and the module thread variables for all of the threads. The disclosed method may be used to add modules to the original computer program and/or to apply a concurrent patch by replacing one or more of the plurality of original computer program modules.

Protecting contents of storage in a computer system from unauthorized access. The computer system includes one or more processing units sharing the storage. Each of the processing units has at least one processor cache. Each processing unit respectively encrypts or decrypts, with a protected section key, data transferred between its processor cache and the storage, when data relates to the protected section used by the hypervisor; and each processing unit respectively encrypts or decrypts, with a virtual machine key, data transferred between its processor cache and the storage, when data relates to storage areas used by a virtual machine.

Protecting storage from unauthorized access

Protecting contents of storage in a computer system from unauthorized access. The computer system comprises one or more processing units sharing the storage, the processing units each having at least one processor cache. Each processing unit respectively encrypts or decrypts, with a protected section key in the chip cache, data transferred between its processor cache and the protected section, and each processing unit respectively encrypts or decrypts, with a segment key, data transferred between the chip cache and the storage, when data relates to a specific segment of the storage.

Protecting contents of storage

Growing community of inventors

Dettenhausen, Germany

Christine Axnix