International Business Machines Corporation

Christopher V Derobertis

Tara Lynn Astigarraga

Louie Arthur Dickens

Daniel James Winarski

Jose Roberto Mosqueda Mejia

Andrew C M Hicks

Ryan Thomas Rawlins

Khaalid Persaud Juggan McMillan

Donald G Grice

Michael E Starling

Michael E Browne

Serban C Maerean

Robert R Gensler, Jr

Itzhack Goldberg

Anthony Thomas Sofia

Michael J Jordan

Felipe Knop

Myung Mun Bae

Orna Raz

Jessica P Doherty

James Richard Coon

Garry Joseph Sullivan

John Robert Hare

Robert K Gardner

Jason G Katonica

Nancy J Finn

Ashwin Venkatraman

Hemant R Suri

Yantian Tom Lu

Evren O Baran

Michael J Young

Johannes Sayre

Aharon Brodie

George G Behrend

Jessica Doherty

Michael Joseph Jordan

Michael Young

John Hare

Robert Gensler

Hemant Suri

A computer-implemented method for remote management of hardware security modules (HSMs) includes receiving a command request from a mobile device. The command request includes an encrypted key part and an encrypted signing key. The HSM decrypts the command request using a key associated with a security zone of the mobile device. The HSM decrypts the encrypted key part and the encrypted signing key. Decrypting the encrypted key part and the encrypted signing key includes using the key associated with the security zone of the mobile device and a key associated with a remote administrator associated with the mobile device. A command is generated for a domain with a target HSM. The command is generated using the decrypted key part and the decrypted signing key. The command is transmitted to the domain for execution by the target HSM. Various other methods, systems, and computer-readable media are also disclosed.

Remote management of hardware security modules

A system is provided and includes a securable resource, a locking element configured to assume a locked condition in which the securable resource is locked and an unlocked condition in which the securable resource is unlocked and a controller. The controller is receptive of an instruction to authorize users to unlock the securable resource and is configured to perform operating system (OS) level authentication of the users and OS level control of the locking element in accordance with the instruction to authorize users and the OS level authentication.

Management of securable computing resources

A system is provided. The system includes a computing resource, a cable insertable into the computing resource, a locking element and a controller. The locking element is configured to assume a locked condition in which the cable is locked to the computing resource or prevented from insertion into the computing resource and an unlocked condition in which the cable is removable from the computing resource and permitted to be inserted into the computing resource. The controller is configured to define rules for users. The rules are associated with respective identifiers (IDs) of each of the users and establish criteria associated with each user for causing the locking element to assume one of the locked and unlocked conditions.

Embodiments include encrypting an object such that the creator of the encrypted object can be identified. Aspects include receiving, by a processor, an unencrypted object that includes plaintext and metadata that describes the plaintext and obtaining, by the processor in response to a request from a user, a data encryption key (DEK) and a nonce key for the unencrypted object, the nonce key being unique to the user. Aspects also include encrypting, by the processor, the unencrypted object. The encrypting includes generating a nonce based at least in part of the plaintext and the nonce key and generating ciphertext and a metadata authentication tag comprising a signature of the metadata, the generating based at least in part on the plaintext, the metadata, the DEK, and the nonce. Aspects further include creating an encrypted object that includes the ciphertext, the metadata, and the metadata authentication tag.

Identification of a creator of an encrypted object

A system is provided and includes a securable resource, a locking element configured to assume a locked condition in which the securable resource is locked and an unlocked condition in which the securable resource is unlocked, a controller and a physical authentication interface. The controller is receptive of an instruction to authorize users to unlock the securable resource and configured to perform operating system (OS) level authentication of the users and OS level control of the locking element in accordance with the instruction to authorize users and the OS level authentication. The physical authentication interface is configured to enable or disable a capability of the controller to perform the OS level authentication.

A system is provided and includes a securable resource, a locking element configured to assume a locked condition in which the securable resource is locked and an unlocked condition in which the securable resource is unlocked, a first controller, which is receptive of an instruction to authorize users to unlock the securable resource, and a common interface to which the first controller and additional controllers, which are independent from the first controller and one another, are tied. The first controller is configured to authenticate the users and to perform operating system (OS) level control of the locking element in accordance with the instruction to authorize users and an authentication of the users by the common interface.

A cable assembly is provided. The cable assembly includes a cable element, a plug element to which a terminal end of the cable element is connected and which is configured to be plugged into a plug receptor, a sensor and an analysis engine. The sensor is disposed along the cable element or in the plug element and is configured to sense a manipulation of at least one of the cable element and the plug element relative to the plug receptor and to issue signals indicative of sensing results. The analysis engine is receptive of the signals and is configured to analyze the signals to determine a type of the manipulation and to determine whether to take an action responsive to the manipulation.

Detecting cable movement in physical ports

A system is provided and includes a resource, locking elements and a controller. The resource includes multiple independently securable resources. The locking elements are respectively configured to assume a locked condition in which corresponding ones of the multiple independently securable resources are locked and an unlocked condition in which the corresponding ones of the multiple securable resources are unlocked. The controller is receptive of an instruction to authorize users to unlock the one or more of the multiple independently securable resources and is configured to perform operating system (OS) level authentication of the users and OS level control of the locking elements in accordance with the instruction to authorize users and the OS level authentication.

Methods, systems and computer program products for detecting contagious diseases in a wildlife population using a drone are provided. Aspects include monitoring, by a drone, a geographic area and capture images of the geographic area and analyzing the captured images to identify a deceased wildlife in a region of the geographic area. Aspects also include performing increased monitoring of the region and capture supplemental images of the region using the drone and analyzing the supplemental images to identify a number of deceased wildlife in the region. Based on a determination that number of deceased wildlife in the region, greater than a threshold number, a corrective action is taken.

Detection of contagious diseases using unmanned aerial vehicle

Methods, systems, and computer program products for data entry device security are provided. Aspects include receiving an indication of a user presence at a data entry device, wherein the data entry device includes a surface with apertures, and wherein the apertures include a material with a reflection coefficient. A presence of a fraud device is determined by emitting, from beneath the surface, security light from a set of one or more emitters, wherein the security light has a security light luminous power. A reflection of the security light off the material is collected by a first set of one or more sensors, wherein the reflection has a reflection luminous power. A luminous power range is determined based on the security light luminous power and the reflection coefficient and based on the reflection luminous power being outside the luminous power range, security measures are engaged at the data entry device.

End user protection against ATM keypad overlay

A computer-implemented method according to one embodiment includes identifying a storage environment, establishing a baseline associated with input and output requests within the storage environment, monitoring activity associated with the storage environment, comparing the activity to the baseline, and performing one or more actions, based on the comparing.

Storage environment activity monitoring

A locking element for use with a cable having a plug insertable into a plug receiver of a housing is provided. The locking element includes a connector body connected to the plug and including a receiving feature insertable through an aperture of the housing. The locking element further includes a locking feature configured to assume one of a locked condition in which the locking feature locks onto the receiving feature or prevents insertion of the receiving feature through the aperture and an unlocked condition in which the locking feature unlocks the receiving feature or permits insertion of the receiving feature through the aperture and an actuator coupled to the locking feature and configured to control the locking feature to assume the one of the locked and unlocked conditions.

An apparatus for managing network security includes an inventory module, a survey module, an observation module, and a security module. The inventory module identifies each node of a network. The survey module gathers information for each node of the network. The security module generates notifications to one or more users in response to the observation module detecting one or more irregularities.

LAN/SAN network security management

An example system includes a processor to receive a source code and history information, wherein the history information includes a version control history or a defect history, or a combination of the version control history and the defect history. The processor is to also divide the source code into security-related components and security-non-related components. The processor is to further calculate security metrics for each of the security-related components and each of the security-non-related components based on the history information. The processor is also to compare the security metrics of the security-related components with the security metrics of the security-non-related components. The processor is to further generate a visual representation comprising a highlighted area of concern based on the comparison.

Growing community of inventors

Hopewell Junction, NY, United States of America

Christopher V Derobertis