International Business Machines Corporation

Christopher Meyer

Linwood H Overby, Jr

Curtis Matthew Gearhart

David John Wierbowski

Constantinos Kassimis

John Anthony Feller

William Lucy

Hank Ibell

Al Chakra

Linwood Hugh Overby, Jr

Scott Christopher Moonen

Joyce Anne Porter

Ahilan Rajadeva

Charles Cruse, Jr

Donald W Schmidt

Marc M Eshel

David Anthony Herr

Carl Edward Clark

David B Emmes

Jeffrey David Aman

Benjamin Thomas Rau

Donald N Jones

Wuchieh James Jong

Richard Roberts

Frederick A Schwartz

Frank P Baldiga

Steven Edward Rosengren

Frank S Samuel, Jr

Guerney Douglass Hunt

Henry L Cantrell, Jr

Thomas J Szczgielski

Satwinder S Kahlon

Kerry R Harpe

Kaleb Joshua Holley

Clifford P Wall

John R Moore

Techniques for integrated authentication for a container-based environment are described herein. An aspect includes accessing, by an application that is running in a container in a container environment that is hosted by a hypervisor on a host system, an authentication module that is located in the container environment. Another aspect includes invoking an authentication handler in the container environment based on the accessing of the authentication module. Another aspect includes passing control to the hypervisor from the authentication handler. Another aspect includes retrieving a security artifact from a security database of the host system by the hypervisor. Another aspect includes providing the retrieved security artifact to the application via the authentication handler. Another aspect includes performing an authentication operation by the application using the security artifact.

Integrated authentication for container-based environment

A method, system, and computer program product are provided for virtualizing specific values in a guest configuration based on the underlying host symbol substitution values. A symbolic link located in a traditional file system in a virtual guest is opened. Each symbol is extracted from a symbol-based file located in a symbol-based file system. The symbol-based file is accessed through a symbolic link from the traditional file system. The virtual guest issues a privileged instruction to a hypervisor for each symbol in the symbol-based file to retrieve a substitution value from a symbol table that is stored in hypervisor storage. The substitution value for each symbol is returned to the virtual guest, and it replaces the symbol in the symbol-based file. In response to a file read request for the traditional file, the substitution value is retrieved from the symbol-based file using the symbolic link from the traditional file.

Virtualizing specific values in a guest configuration based on the underlying host symbol repository

A method, system, and program product are provided. A plurality of recovery groups is defined on each transmission control protocol/internet protocol (TCP/IP) stack in a cluster of servers. The recovery group includes a service, one or more IP addresses associated with the service, a trigger condition, and a recovery action. Each of the recovery groups is monitored for an occurrence of the trigger condition associated with the service. In response to detecting the trigger condition, a backup TCP/IP stack is notified to automatically perform the recovery action defined for a failing recovery group on an owning TCP/IP stack. Only the failing recovery group is recovered and the remaining recovery groups execute uninterrupted.

Selective TCP/IP stack reconfiguration

An example operation may include one or more of receiving a data packet from a network controller, where the data packet is marked as valid based on a checksum calculated by the network controller, determining that the checksum generated by the network controller is in error based on a recalculation of the checksum of the data packet via a network layer, and transmitting the data packet from the network layer to the network controller with a notification that the checksum is in error.

Packet replay in response to checksum error

A method for monitoring a physical area for unauthorized access by a user of a wireless device, includes scanning for signals from a wireless device, detecting a wireless signal from a wireless device, determining a wireless device ID associated with the wireless signal, determining whether the wireless device ID matches a wireless ID in an authorized or unauthorized ID list and in response to determining that the wireless device ID matches a wireless ID in the unauthorized wireless ID list, activate a security alert. The method may further include in response to determining, that the wireless device ID does not match a wireless ID in the authorized wireless ID list nor the unauthorized wireless ID list, receiving, signal strength information associated with the detected wireless signal for a predetermined time interval and determining a pattern as a function of time of the received signal strength.

Detecting unauthorized physical access via wireless electronic device identifiers

A computer-implemented method includes identifying a data transmission session associated with a display-oriented data transmission scheme; identifying an outbound data stream associated with the data transmission session; and determining one or more protected fields associated with the outbound data stream. The computer-implemented method further includes determining a client attempt to write to at least one of the one or more protected fields; and in response to determining said client attempt, determining an intrusion detection report. A corresponding computer program product and computer system are also disclosed.

Detecting intrusion attempts in data transmission sessions

Aspects of the present invention disclose a method, computer program product, and system for determining a number of allowed lists and initiating a change in a number of lists. The method includes receiving a defined list count of a plurality of lists of a coupling facility structure, monitoring list usage by the coupling facility structure, determining that additional lists are required by the coupling facility structure above the defined list count, based on the monitored list usage. The method includes, in response to determining that additional lists are required by the coupling facility structure, determining a new number of lists, where the new number of lists are based on an availability of space for the new number of lists on the coupling facility structure and the new number of lists exceeds the defined list count. The method includes rebuilding coupling facility structure based upon the determined new number of lists.

Dynamically enlarging coupling facility lists

Monitoring a physical area for detection of a wireless device includes scanning for signals from a wireless device within a scanning range defining the physical area, detecting a wireless signal from a wireless device within the scanning range, determining a wireless device ID associated with the wireless device detected within the scanning range and determining whether the wireless device ID is unknown. In response to determining that the wireless device ID is unknown, analyzing the wireless signal to determine scan data representative of the wireless signal, monitoring the scan data over time, determining a scan data pattern as a function of time based on the monitored scan data, comparing the scan data pattern to scan data patterns stored in a database and in response to determining that the scan data pattern based on the monitored scan data matches a scan data pattern in the database, activate a first alert.

Monitoring a physical area for unauthorized access by a user of a wireless device includes setting a wireless signal scanning range using at least one wireless scanning device, detecting a wireless signal within the scanning range, determining a status of the wireless device of authorized, unauthorized or unknown, monitoring scan data obtained from the scanning device during the time the wireless signal remains within the scanning range. A scan data pattern based on the monitored scan data is determined and compared to a scan data pattern database containing scan data patterns indicative of suspicious behavior and determining whether the monitored scan data pattern matches a suspicious scan data pattern based on the comparison. The system identifies the wireless device as unauthorized in response to a match with a suspicious scan data pattern and activates a security alert.

A computer-implemented method includes monitoring a plurality of connections of a plurality of host applications at a host, where each connection of the plurality of connections carries network traffic associated with a respective host application of the plurality of host applications. A plurality of sets of security attributes are detected, and include a respective set of security attributes for each connection of the plurality of connections. The plurality of sets of security attributes are stored in a security database. From the security database, the respective set of security attributes of a first connection are compared to a centralized security policy. It is determined that the respective set of security attributes of the first connection do not meet the centralized security policy. A remedial action is performed on the first connection, responsive to the respective set of security attributes of the first connection not meeting the centralized security policy.

Enforcing a centralized, cryptographic network policy for various traffic at a host

Embodiments of the present invention provide methods, systems and computer program products for the centralized, secure offloading of security services for distributed security enforcement points. In an embodiment, a network data processing system can be configured for centralized secure offload of security services for distributed security enforcement points and can include a set of security enforcement points controlling communication flows between devices in different less trusted zones of protection. The system also can include a security server communicatively coupled to the security enforcement points and hosting security services logic disposed in a more trusted zone of protection. Each of the security enforcement points can include an interface to the security services logic and program code enabled to offload security related services processing through the interface to the security services logic disposed in the more trusted zone of protection.

Centralized secure offload of security services for distributed security enforcement points

Embodiments of the present invention address deficiencies of the art in respect to network security and provide a method, system and computer program product for centralized secure offload of key exchange services for distributed security enforcement points. In one embodiment, a data processing system for centralized secure offload of key exchange services for distributed security enforcement points can be provided. The system can include a security enforcement point controlling communication flows between devices in different less trusted zones of protection, and a security server communicatively coupled to the security enforcement point and hosting key exchange services disposed in a more trusted zone of protection. The security enforcement point can include an interface to the key exchange services and program code enabled to offload at least one portion of a key exchange through the interface to the key exchange services disposed in the more trusted zone of protection.

Centralized secure offload of cryptographic security services for distributed security enforcement points

A network node for communicating data packets secured with a security protocol over a communications network includes a host information handling system (IHS) and one or more external security offload devices coupled by a secure data link. The host IHS communicates state information about data packets, and the external offload security device provides stateless secure data encapsulation and decapsulation of packets using a security protocol. An external network interface controller or internal network interface controller communicates encapsulated data packets over the communications network to a final destination. Encapsulation and decapsulation of packets by the external security offload device reduces network latency and reduces the computational load on the processor in the host IHS. Maintaining state information in the host IHS allows hot-swapping of external security offload devices without information loss. The external security offload device may be included in a firewall, or intrusion detection device, and may implement IPsec protocol.

Network node with network-attached stateless security offload device employing out-of-band processing

A method, network element, and computer storage program product, are provided for selectively loading a communication network security enforcement point ('SEP') with security association ('SA') information for inspection of encrypted data in a secure, end-to-end communications path. At least one encrypted data packet is received. It is determined that SA information for decrypting the at least one encrypted data packet fails to exist locally at the SEP. A request is sent to a communication network key server for SA information associated with the at least one encrypted data packet. The SA information associated with the at least one encrypted data packet is received from the communication network key server.

Growing community of inventors

Cary, NC, United States of America

Christopher Meyer