International Business Machines Corporation

Daniel J McGinnes

Martin Andrew Ross

Craig H Stirling

David Granshaw

Richard Graham Schofield

Samuel T Massey

Dominic John Storey

John Hosie

Sam T Massey

William Bittles

Gareth Ian Bottomley

Jonathan P Bond

A method and system for handling sensitive data required by an application in a secure computer system. The secure computer system transforms sensitive data in a request message from a data format required by the application into a data format required by a service in an external computer system. The secure computer system tokenizes the sensitive data by replacing the sensitive data with tokenized data and stores a mapping between the sensitive data and the tokenized data in the secure computer system. The secure computer system sends the request message to an external computer system and receives, from the external computer system, a response message that includes annotations for the tokenized data with transform instructions for transforming the transformed sensitive data from the data format required by the service into the data format required by the application. The secure computer system replaces the tokenized data with the sensitive data.

Handling sensitive data in an application using external processing

A method and system for handling sensitive data required by an application in a secure computer system. An external computer system that is external to the secure computer system receives a transformed request message that includes one or more data aspects having tokenized data that has replaced transformed sensitive data after sensitive data in the one or more aspects had been transformed from a data format required by a service in the external computer system into a data format required by the application. The external computer system generates a response message from the transformed request message by including, in the response message, annotations with transform instructions for transforming the transformed sensitive data, from the data format required by the service into the data format required by the application, after the tokenized data has been replaced by the transformed sensitive data in the one or more data aspects.

A method and system for secure message handling of an application across deployment locations. The application is analyzed to identify processing nodes referencing one or more data aspects having deployment constraints on locations in which aspect data in the one or more data aspects may be deployed. It is ascertained whether the one or more data aspects are accessed by an identified processing node of the application. If so, a restriction is determined for the identified processing node based on deployment constraints included in the accessed one or more data aspects and the identified processing node is deployed according to the determined restriction for the identified processing node. If not, the identified processing node or a preceding processing node is marked to indicate a required tokenization of the one or more data aspects, wherein the tokenization removes the deployment constraints for the identified processing node.

Secure message handling of an application across deployment locations

Cache memory can be organized to include adapted data objects that reflect queries. A data object can be identified in cache memory. This data object can be identified based on its being referenced by a query, and both the data object and the query can have a number of attributes. The data object can be adapted to create a subset data object that contains only a subset of attributes. This subset of attributes can be those referenced by the query.

Application memory organizer

A messaging system comprises a plurality of connected components and including a schema defining fields for messages, at least one field defined as non-essential. A mechanism for operating the messaging system comprises the steps of collecting one or more performance metrics for one or more components of the messaging system, determining that at least one performance metric has crossed a predetermined threshold, informing one or more components of the messaging system that a surge in workload has occurred, and the informed components removing non-essential fields from transmitted messages and/or not processing non-essential fields from received messages.

Workload management

A computer-implemented method of parsing a message comprising a sequence of data fields, the method comprising evaluating program code for processing the parsed message to identify a first set of data fields of the message that are referenced in said program code; identifying the boundaries of the data fields in a schema defining the format of said message; identifying a second set of data fields in said schema related to the first set of data fields by reference, said second set further including the first set; and sequentially parsing the message using the identified data field boundaries, wherein said parsing step comprises skipping data fields in said sequence that precede the first data field belonging to the second set. A computer program product comprising program code for implementing this method and a data processing system adapted to implement this method are also disclosed.

Opaque message parsing

A method and system are provided for providing event-processing rules in an event-processing environment. The method includes providing at least one generalised event-processing rule to a customer, receiving customer input of rule customization to produce a customized rule, and storing the customized rule in Polish notation for processing using stack-based processing. The method also includes receiving notification of an event for a customer, retrieving a customized rule relating to the customer, and processing the customized rule using stack-based processing.

Providing event-processing rules

Methods and associated data processing system for handling sensitive data required by an application in a secure computer system. The secure computer identifies sensitive data in one or more data aspects of a request message. The secure computer system tokenizes the sensitive data in the one or more data aspects by replacing the sensitive data with tokenized data and stores a mapping between the sensitive data and the tokenized data in the secure computer system. The secure computer system sends the request message to an external computer system. After the request message is sent to the external computer system, the secure computer system receives a response message from the external computer system. The response message includes annotations for the tokenized data with transform instructions for the tokenized data. The secure computer system replaces the tokenized data with the sensitive data and performs the transform instructions on the sensitive data.

Embodiments of the present invention provide a method, system and computer program product for dynamic, granular messaging persistence in a messaging system. In an embodiment of the invention, a method for dynamic, granular messaging persistence in a messaging system is provided. The method includes monitoring operational performance of a message broker and receiving a message for queuing in a message queue of the message broker. The method also includes parsing the message to extract different fields and corresponding priorities and selectively storing in fixed storage, data for corresponding ones of the different fields based upon consideration of corresponding ones of the priorities and the monitored operational performance. Finally, the method includes queuing the message in the message queue.

Dynamic granular messaging persistence

A method and system for secure message handling of an application across deployment locations. The application is divided into multiple processing nodes which process messages and can be deployed in multiple different locations. The application is analyzed to identify processing nodes referencing given data aspects having deployment constraints. It is ascertained whether one or more data aspects of the given data aspects are accessed by an identified processing node. If so, a restriction is determined for the identified processing node based on the deployment constraints of the accessed one or more data aspects and the identified processing node of the application is deployed according to the determined restriction for the identified processing node. If not, the identified processing node or a preceding processing node is marked to indicate a required tokenization of the one or more data aspects, wherein the tokenization removes the deployment constraints for the identified processing node.

Managing a system comprising a pool of servers including a number of active servers. Utilization of the system capacity is monitored, in which the utilization results from a workload of the number of active servers. Upon detecting a critical utilization of the system capacity during the monitoring of the utilization of the system capacity, a duration of the detected critical utilization of the system capacity is predicted from a monitoring history of the utilization of the system capacity. Further, the number of active servers is increased, if the predicted duration exceeds a defined threshold. Tuning measures may also be deployed to handle surges in capacity utilization.

Server pool management

Allocating threads to processors based, at least in part, on identifiers for thread sets and applications. A thread is paired with an application and, using the identifier for the application, an ID pairing is allocated to a processor.

Growing community of inventors

Southampton, United Kingdom

Daniel J McGinnes