International Business Machines Corporation

David Paul Moore

Shane Bradley Weeden

Craig A Pearson

John T Robertson

Leo M M Farrell

Jasmine Anne Smith

Zoran Radenkovic

Rune Hartelius Larsen

Benjamin M E Martin

Franz Wolfhagen

Simon Gilbert Canning

Trevor Scott Norvill

Christopher Y Choi

Leo Michael Farrell

Philip A J Nye

Anthony B Ferguson

Scott M Andrews

Stephen Viselli

Philip Alan John Nye

Robert T Trotter

A first authenticator payload is obtained that includes a first authenticator random value. A first authenticator encrypted file is generated with an authenticator public key that is related to a client authenticator application. The first authenticator encrypted file is generated based on a first cryptographic algorithm. The first authenticator encrypted file includes the first authenticator payload. A first target payload is obtained that includes a first target random value. A first target encrypted file is generated with the first authenticator random value. The first target encrypted file is generated based on a second cryptographic algorithm. The first target encrypted file includes the first target payload.

Connection resilient multi-factor authentication

An indication is sent to a host server device. The indication includes a request for a push notification service identification (PNSID). The PNSID is used to establish a secure registration between one or more applications on the computing device of a user and the host server device. The PNSID is received from the host server device. An input is received from the user. The input includes one or more application server devices that may send push notifications to the computing device. A unique key is generated for each application server device. The PNSID and a different unique key are sent to each application server device. Each different unique key is associated with a different application server device. A registration is received from each application server device.

Push notifications from multiple tenant servers

A technique to enforce mobile device security policy is based on a 'risk profile' of the individual device, where the risk profile is fine-grained and based on the types of applications installed on the device, the services they are accessing, and the operation(s) the user granted the device authorization to perform. Thus, the approach takes into account not only the actual applications installed on the device (and those actively in use), but also the services those applications are accessing, and the scope of operations the user has granted the device authorization to perform. By combining this information to create the risk profile, a suitable security policy, including one that does not unnecessarily degrade device usability, may then be applied.

Mobile device security policy based on authorized scopes

A biometric server receives, a transmission of a biometric sample and an encrypted enrollment template of the user from a client device, wherein the encrypted enrollment template comprises an encrypted mathematical representation of historical biometric data of the user, and wherein the biometric sample comprises a current snapshot of the biometric data. The biometric server decrypts the encrypted enrollment template to an enrollment template using an enrollment template key. The biometric server converts the biometric sample to a biometric template. The biometric server, based on determining that the biometric template is similar to the enrollment template associated with the user, sends an access token to the client device.

Distributed storage of authentication data

An indication is received that a user has initiated an access to a website hosted by a service provider. Access to the website requires an authorization of a user identification associated with the user and a password associated with the user. A token is requested. The token provides access to an application programming interface. The token is received. The token is stored by the service provider.

Service provider initiated additional authentication in a federated system

A method sends a request for a delegated authorization grant data set, receives a delegated authorization grant data set that defines the delegated authorization grant scope, with respect to a resource. The delegated authorization grant data set includes a scope variable value having been selected by a delegator entity through a delegation grant scope user interface on the delegator device. The scope controls access to the resource in a manner limited by the scope of the delegated authorization grant defined by the delegated authorization grant data set.

User managed access scope specific obligation policy for authorization

A method and system for integrating restrictions in an identity management system is provided. The method includes generating a role/account attribute table storage from static and dynamic rule defined values. A role request for a first role associated with a user is received and a set of attributes comprising a result of the role request are calculated. The set of attributes are transmitted to a target system for evaluation and a result is received.

Late constraint management

Embodiments of the present invention disclose a method, computer program product, and system for determining role-based access. In one embodiment, the method includes receiving an audit event for a restricted resource and a first user id associated with the audit event. The method further includes determining based at least in part on the audit event, a historical reference, the historical reference including at least one audit event associated with at least one user id. The method further includes determining access activity associated with the first user id. The method further includes determining based at least in part on the historical reference and the access activity, at least one recommended role for the first user id.

Event analytics for determining role-based access

A host organization system for a host organization of a physical site, receives a request, by a visitor with an identifier of a visitor organization for a visitor access medium, for access to the physical site controlled by a physical access control system requiring presentation of the visitor access medium for access to the physical site, wherein there is an electronic trust relationship between the host organization system and a visitor organization system for the visitor organization via a network, wherein the visitor organization system maintains an electronic identity profile for the visitor. Responsive to the host organization system receiving an authenticated identifier for the visitor from the visitor organization system and validating the authenticated identifier from the visitor organization system, issuing a visitor access medium to the visitor for controlling access to the physical site.

Just in time visitor authentication and visitor access media issuance for a physical site

An electronically authenticated internet voice connection can be initiated on an institution's website. Authentication of the customer's identity can be determined based upon already established credentials, such as a username and password. Upon verifying the identity of the customer, the institution's web server can generate and transmit a unique identifier to the customer's browser. The unique identifier can be an encrypted identifier used to authenticate the customer when establishing a subsequent voice connection.

Establishing electronically authenticated internet voice connections

A mechanism for the deployment of asynchronous agentless agent functionality in clustered environments. An agentless agent execution node in an agentless agent execution node cluster receives a context message comprising an asynchronous operation request and an execution context from a messaging service. The agent node determines if an entry for the execution context exists in an execution context state table of the agent node. If no entry exists, the agent node creates an execution context entry in the execution context state table of the agent node. The agent node retrieves an asynchronous code module associated with the asynchronous operation from a central repository. The asynchronous code module is then executed on a managed resource to detect asynchronous code events occurring on the managed resource. When asynchronous code events are detected at the managed resource, the agent node sends a message comprising the asynchronous code events to a management server.

Deployment of asynchronous agentless agent functionality in clustered environments

Embodiments of the present invention provide a method, system and computer program product for de-centralized nodal failover handling in a high availability computing architecture. The system can include multiple different nodes coupled to one another in a cluster over a computer communications network including an initial lead node and remaining auxiliary nodes. The system further can include a messaging service coupled to each of the nodes and nodal failover handling logic coupled to each of the nodes and to the messaging service. The logic can include program code enabled to periodically receive heartbeat messages from the messaging service for the initial lead node and to subsequently detect a lapse in the heartbeat messages, to post within a message to the messaging service a request to become a replacement lead node in response to detecting the lapse in the heartbeat messages, and to periodically post heartbeat messages to the messaging service as the replacement lead node for the initial lead node.

Growing community of inventors

Burleigh Waters, Australia

David Paul Moore