International Business Machines Corporation

Christopher J Giblin

John G Rooney

Maja Vukovic

Sriram K Rajagopal

Milton H Hernandez

Jan Leonard Camenisch

Paul T Hurley

Daniel Nikolaus Bauer

Thomas R Gross

Guenter Karjoth

Marcel Waldvogel

Florian Hermann Froese

Pascal Vetsch

The present disclosure relates to a method for a cryptographic key rotation in a publish-subscribe system providing a broker service for routing stored encrypted messages to one or more subscribers of the topic to which the routed messages are assigned. The routing comprises decrypting the stored encrypted messages. The cryptographic key rotation comprises a re-encryption of the stored messages using a cryptographic replacement key. The re-encryption is executed by an encryption module of the publish-subscribe system as a background process, while the broker service is continued.

Key rotation on a publish-subscribe system

A targeted, topic-based encryption in a publish-subscribe message queue. Topic-based encryption driven by encryption policies for both storing and receiving messages uses activity tracking and logging to ensure confidentiality of certain topics associated with stored encrypted messages. Authentication of both publisher and consumer ensure encryption and decryption keys are used in confidence.

Policy-based topic-level encryption for message queues

Embodiments are directed to a computer-implemented method for ranking a proximity of data sources with one or more reference entities, which may be authoritative entities. The method comprises identifying several data sources and one or more reference entities. For each of the identified reference entities a vector of terms representative of said each of the reference entities is obtained. For each data source of the identified data sources, terms from said each data source are selected, an array comprising the selected terms can be accordingly populated, and a term frequency of terms of the vector obtained for said each of the reference entities is determined, in said array. The term frequency corresponds to the number of occurrences of said each of the terms in said array. The method ranks a proximity of the identified data sources with each of the one or more reference entities.

Ranking proximity of data sources with authoritative entities in social networks

In one embodiment, a computer-implemented method includes receiving a request for a product. Two or more fingerprints are selected, where each fingerprint includes digital data describing a corresponding virtual customer. By a computer processor, a first fingerprint is loaded to emulate a first virtual customer. A first price query is submitted to a vendor's web service for the product, where the first price query uses the loaded first fingerprint. A second fingerprint is loaded to emulate a second virtual customer. A second price query is submitted to the vendor's web service for the product, where the second price query uses the loaded second fingerprint. Two or more prices are received from the vendor's web service, including a first price received in response to the first price query and a second price received in response to the second price query. A lowest price is selected from among the prices received.

Determining a lowest price for a dynamically priced product

Auditable data distribution from a server to clients is achieved as follows. The server delivers chunks of a data file, and identifiers of the chunks, to the clients. For each chunk of the data file received by the clients, a digest is generated by the client that received the chunk, using at least a part of the chunk and further data of the client that received the chunk. The further data is known to the server. The client that received this chunk sends the digest to the server, which receives the digest. The server determines an identity of the clink that received the chunk in question, by comparing the digest to the chunks that the server has sent and to the further data known to the server. The server stores the identity of the client that received the chunk.

Auditable distribution of a data file

An embodiment of the invention is associated with a system having a role for controlling user access, the role comprising users, permissions, and a set of rules. The embodiment records each of a succession of access events in an access log, each event comprising an instance of the system being accessed by a user. The embodiment further analyzes recorded access events in the access log at selected time intervals, to detect a condition or violation of rules of the set of rules. Responsive to detecting a condition or violation, the embodiment selectively determines whether any change to the users or permissions of a specified role is needed. Each needed change is then implemented.

Automated role adjustment in a computer system

In an embodiment of the invention, wherein users must be able to access a computer system to perform respective functions, initial data is acquired from data sources, some of the initial data pertaining to previously granted system access rights. The initial data is used to create a crowdsourcing task, which is executed to acquire crowdsourced data from SMEs in an SME population, wherein the crowdsourced data comprises additional data pertaining to previously granted system access. The crowdsourced data is used to create a set of role definitions, wherein the role definitions determine which of the users are assigned to be members of a particular role associated with the system, and further determine the access rights that are granted to each member of the particular role.

Using data analytics and crowdsourcing to determine roles for a computer system

A method for identifying a geographic location of a server. A request is delivered to the server to send back a message via a cellular network; the message of the server is received via a cell of the cellular network; cell location information about the geographic location of the cell that received the message is delivered; the cell location information is used as information about the geographic location of the server.

Identifying a location of a server

A system for anonymous separation of duties with credentials includes an identity provider, the identity provider configured to issue anonymous credentials to a user based on one or more attributes of the user; a service provider, the service provider configured to issue a pseudonym to the user based on the user's anonymous credentials, and to associate the user's pseudonym with a step of an instance of a business process hosted on the service provider, the step being completed by the user; and an auditor, the auditor configured to determine if the completion of the step of the instance of the business process by the user is compliant with a separation of duties policy.

Anonymous separation of duties with credentials

The invention provides methods, apparatus and systems for detecting distributed denial of service (DDoS) attacks within the Internet by sampling packets at a point or points in Internet backbone connections to determine a packet metric parameter. The packet metric parameter which might comprise the volume of packets received is analyzed over selected time intervals with respect to specified geographical locations in which the hosts transmitting the packets are located. The expected behavior can be employed to identify traffic distortions revealing a DDoS attack. In a complementary aspect, the invention provides a method of authenticating packets at routers in order to elevate the QoS of authenticated packets. This method can be used to block or filter packets and can be used in conjunction with the DDoS attack detection system to defend against DDoS attacks within the Internet in a distributed manner.

Growing community of inventors

Zurich, Switzerland

Christopher J Giblin