International Business Machines Corporation

David Yu Chang

Vishwanath Venkataramappa

Ching-Yun Chao

John Yow-Chun Chang

Messaoud Benantar

Robert Howard High, Jr

Shih-Gong Li

Yi-hsiu Wei

Leigh Allen Williamson

John Shih-Yuan Wang

Russell Ley Newcombe

Derek Wan Hok Ho

Liam S Harpur

Paul William Bennett

John Y Chang

William Mitchell Edwards

Marc Gregory Smith

John Alexander Buslawski

Adam Yoho

Wilalberto Rodriguez

Nataraj Nagaratnam

George Prentice Copeland

Ajay Arvind Apte

Hyen Vui Chung

Virgil Anthony Albaugh

Ambuj Goyal

Carlton Keith Mason

Ajay Reddy Karkala

Timothy R Malkemus

Ajay Kumar Reddy Karkala

Zechariah Hein

Edwin M Philpot, Jr

Scott Robert Hinkelman

Hui-Ming Lin

John Yow-Chung Chang

Russell Lev Newcombe

Ashvin Radiya

Lori Jane Milhans VanGulick

Michael David Schiller

An example operation may include one or more of connecting, by a recipient node, to a source node via a blockchain network, receiving, by the recipient node, a data block, a digest of the data block encrypted by a private key of the source node, a public key paired to the private key and an IP address of the source node, calculating, by the recipient node, a digest of the data block, decrypting, by the recipient node, the digest of the data block by the public key, comparing, by the recipient node, the decrypted digest against the digest, and in response to a match, storing the encrypted digest, the public key and the IP address of the source node onto a ledger of the recipient node.

Management of a size of a ledger

Described are techniques for an access management protocol including a method comprising associating a granted permission set and a constrained permission set to a user profile in an access management system. Respective granted permissions in the granted permission set authorize the user profile to perform the respective granted permissions, and respective constrained permissions in the constrained permission set preclude the user profile from performing the respective constrained permissions. The method further comprises receiving a permission-based request at the access management system and from the user profile and determining that the permission-based request is associated with a permission that is included in both the granted permission set and the constrained permission set. The method further comprises rejecting the permission-based request.

Constrained roles for access management

A method, system, and computer program product for detecting a network application security question is provided. The method includes receiving permission to access social media sources of a user. The social media sources and Internet based sources of the user are monitored in response to receiving the permission and associated data is generated and stored. A request for access to a secure account of the user is received and a list of security questions is presented to the user. The list of security questions is analyzed with respect to the data and each security question is ranked. An answer to a question of the list is received and analyzed and security attributes of the answer with respect to a potential malicious attempt to provide a predicted answer to for access to secure account are determined. A resulting security process with respect to enabling access to the secure account is executed.

Network application security question detection and modification

A method, computer system, and computer program product for protecting user data while performing third-party account registration. The method may include receiving, from a third party, a request for personal data of a user. The method may request the user to authenticate the request for personal data. In response to receiving from the user the authentication, the method may include providing the third party the personal data of the user. A portion of the personal data of the user that is provided to the third party may be altered and may be mapped to the user. The method may store identifying information about the third party. The method may also include receiving, from the user, a parameter respecting use of the portion of the personal data that is altered. The parameter may limit the third party from obtaining information from the portion of the personal data that is altered.

Protecting user data

An example operation may include one or more of connecting, by a feedback controller node, to a blockchain network configured to process transaction proposals through a plurality of endorser nodes connected to an orderer node, receiving, by the feedback controller node, reports from the orderer node that reflect performance of the plurality of the endorser nodes, assigning, by the feedback controller node, rankings to the plurality of the endorser nodes based on the reports, and ordering the transaction proposals to be executed by the plurality of the endorser nodes based on the assigned rankings.

Performance optimization

An example operation may include one or more of connecting, by a committer node, to a main blockchain comprised of a plurality of initiator nodes, receiving, by the committer node, a transaction from an initiator node of the plurality of the initiator nodes and placing blocks of the transaction on the main blockchain, executing, by the committer node, a request from the initiator node of the plurality of the initiator nodes to branch off a sub-blockchain from the main blockchain, processing, by the committer node, the transaction in the sub-blockchain, detecting, by the committer node, a completion or an ending of the transaction in the sub-blockchain, in response to the detection of the completion of the transaction, committing the transaction to the main blockchain, in response to the detection of the ending of the transaction, terminating the transaction in the sub-blockchain, and discarding, by the committer node, the sub-blockchain.

Atomic transactional processing

A topic based conversation retrieval system and method may include receiving a first conversation between a first plurality of users a second conversation between the first plurality of users or a second plurality of users, the second conversation being conducted on a second communication mode different than the first communication mode, analyzing the first conversation and the second conversation, determining one or more topics of discussion in the first conversation and the second conversation, and retrieving a portion of each of the first conversation and the second conversation, where the portion is related to a topic chosen to be retrieved.

Topic based conversation retrieval

Access is controlled to managed resources in a stateless web server architecture including a stateless web server computing platform; a resource locator map portion of the stateless web server computing platform providing a unique resource locator code representing each managed resource in a stateless web server architecture, wherein the managed resource is assigned to a plurality of application program components; a set of servlet filters disposed in a portion of the stateless web server computing platform, each servlet filter associated with one of the application program components; a resource locator matcher portion of the stateless web server computing platform, responsive to a user request to a unique resource locator, matching a pattern in the user request to one or more of the application program components using a corresponding servlet filter; and a request dispatcher portion of the stateless web server computing platform sending the user request to the matched application program component, wherein the application program component receives and processes the user request.

Managing and securing manageable resources in stateless web server architecture using servlet filters

An example operation may include one or more of connecting, by a participating blockchain (BC) node, to a blockchain network configured to store a plurality of packages, selecting and downloading, by the participating BC node, a package containing a random code variant identified by a unique identifier (ID), executing, by the participating BC node, the package to calculate an outcome associated with the variant ID, receiving, by the participating BC node, votes on outcomes associated with the variant ID and votes on outcomes associated with different variant IDs from other nodes of the blockchain network, and analyzing, by the participating BC node, the votes to determine if the votes on the outcomes associated with the variant ID are different from the votes on the outcomes associated with the different variant IDs.

Prevention of majority attacks

Computer implemented methods are presented. The methods include, for instance: obtaining a user credential for login to a mobile device from a user. By use of a multi-layered authentication, based on the user credential, and a discreet user identity verification, the user determined to be unauthorized would operate the mobile device in a precaution mode, which discreetly creates secure records of activities of the user.

Discreet user identification and multiple device modes of operations

A method, computer program product, and a device for establishing a direct communications connection between gateways of two computing systems includes a processor(s) of a first system receiving configuration instructions in a generic format and translating the configuration instructions into a first set of gateway configuration commands that are in a format compatible with a first gateway of the first system. The processor(s) executes the first set to configure the first gateway. The processor(s) transmits, via a communication protocol, the configuration instructions, to a program(s) of a second computing systems, the program(s) translates the configuration instructions into a second set of gateway configuration commands, in a format compatible with the second gateway, and executes the second set to configure the second gateway. The processor(s) establishes a direct communications connection between the first gateway and the second gateway, based on the configurations matching.

Establishing cross-vendor secure connectivity in a shared computing environment

An authentication and authorization plug-in model for a cloud computing environment enables cloud customers to retain control over their enterprise information when their applications are deployed in the cloud. The cloud service provider provides a pluggable interface for customer security modules. When a customer deploys an application, the cloud environment administrator allocates a resource group for the customer's application and data. The customer registers its own authentication and authorization security module with the cloud security service, and that security module is then used to control what persons or entities can access information associated with the deployed application. To further balance the rights of the various parties, a third party notary service protects the privacy and the access right of the customer when its application and information are deployed in the cloud.

Authentication and authorization methods for cloud computing platform security

Growing community of inventors

Austin, TX, United States of America

David Yu Chang