International Business Machines Corporation

Eduardo Reyes

Tommy Lucas McLane

Vasu Vallabhaneni

Dwip N Banerjee

Patrick Tam Vo

Paul Bernell Finley, Jr

Jason J Jaramillo

Marco Cabrera Escandell

Marco A Cabrera

Lucas McLane

Paul S Bostrom

Michael John Burkhart

Pruthvi Panyam Nataraj

Vi Trieu Tran

Bipin Tomar

Arun Prasath Anbalagan

Vitaly V Marin

A technique that supports improved debugging of kernel loadable modules (KLMs) that involves allocating a first portion of a memory and detecting a first kernel loadable module (KLM) requesting an allocation of at least a portion of the memory. The first KLM is then loaded into the first portion of the memory and a first identifier is associated with the first KLM and the first portion. The access of a second portion of the memory by the first KLM, the second portion being distinct from the first portion is detected and an indication that the first KLM has accessed the second portion is generated.

Memory allocation with identification of requesting loadable kernel module

Provided are techniques for the prevention of certain types of attacks on computing systems. The current disclosure, which describes one particular type of attack, is directed to the detection and prevention of an attack rather than the mechanics of the particular described attack. The claimed subject matter both detects and prevents an attack without exposing a network to denial-of-service (DoS) attacks by being too restrictive.

Detection of rogue client-agnostic nat device tunnels

Detection of rogue client-agnostic NAT device tunnels

A network based installation management system that dynamically manages secure software installation on a client. The server is configured to determine the software required and prepare an appropriated response containing the list of software and an information file containing the respective attributes of the list of software. The server encoded this response and the encoded response is transmitted to the client. The client on receiving the response is configured to authenticate the response and install the encoded response after authentication. Highly accurate and reliable software installation using the network based installation management system may be achieved using a respective hardware element on the client and the server, which is configured to encode and decode a request and/or response suitably thereby providing a high level of security and trust in an un-trusted network environment.

Method and system for software installation

A method includes receiving a request from a network source to create a logical socket on a logical port. The method includes accessing a structure that indicates a plurality of logical socket allocation policies to select a first of the plurality of socket allocation policies that corresponds to the logical port. Each of the plurality of logical socket allocation policies governs logical socket allocation for one or more ports, wherein logical allocation policies govern at least one of 1) the number of logical sockets that are allocated to the one or more logical ports, 2) a maximum number of logical sockets shared between a grouping of two or more logical ports, and 3) a maximum number of logical sockets. The method includes determining if the first logical socket allocation policy allows for allocation of the logical socket for the network source to communicate. The method includes allocating a logical socket.

Managing logical sockets

The drive for multi-tasking and/or availability of numerous applications can interfere with productivity. Constant interruptions from email and real-time online communication can lead to decreased productivity. In addition, attempting to tackle a massive number of different projects with different applications can impede progress on any one of the projects. Functionality can be implemented in a workspace to focus interaction with one or more applications in the workspace. Focused interaction allows a user to limit distractions (e.g., email notifications, instant message notifications, etc) and restrict activities not related to his or her current task.

Electronic device workspace restriction

Network attacks, such as a denial of service (DoS) attack, attempt to exhaust server resources and can cause a network to be unavailable for significant periods of time. Although a firewall can be utilized to defend a system from network attacks, the number of incoming connections created can be controlled to defend the system against network attacks. An operating system creates connections, known as sockets, on one or more logical ports. Incoming connections are connections whose creation requests originate from a source outside the operating system. Functionality to control socket creation can be implemented within the operating system, thus allowing a system to be placed directly on a network without a firewall. Implementing defense against network attacks within an operating system reduces the additional cost of having firewall products, and can lead to more efficient network configurations.

A computer implemented method, apparatus, and computer usable program code for configuring a remote data processing system. A configuration is identified for the remote data processing system to form an identified configuration. The hardware for the remote data processing system is configured. An installation application is sent to the remote data processing system across a communications link after the hardware in the remote data processing system has been configured, wherein the installation application executes on the remote data processing system to configure the remote data processing system. Installation files are sent across the communications link to the installation application executing on the remote data processing system. The installation program uses the installation files to configure install a set of operating systems, install applications, and configure software on the remote data processing system.

Centralization configuration of data processing systems

A system, method and computer program product for providing command-line warnings are disclosed. The method includes receiving a command as input at a command prompt and, in response to determining that said command is not entered in a structurally correct manner, providing to a user an opportunity to correct said command at said command prompt. In response to determining that said command is entered in an erroneous manner, warning and corrected usage data is shown, and in response to determining that said command is not likely to be safe, said command and said warning and corrected usage data are shown in a blinking yellow text. In response to determining that said command is critical, a final warning is displayed by employing a blinking red text and playing a sound.

Command-line warnings

A method and system for preventing address resolution protocol (ARP) cache poisoning in a network system with multiple hosts. Multiple hosts representing and/or located in separate local area networks (LANS) are tapped (via a shared agreement) to utilize a trusted ARP cache for each LAN represented. Whenever a new ARP response is detected in one network, a request for validation is sent to a separate host in a different network. The separate host initiates a verification process for the ARP, which involves checking whether duplication of one of the IP address or MAC address of the ARP response exists within the address pairings in the ARP cache. If the ARP response is not validated, then the trusted ARP cache is not updated and the system administrator is notified of the failed attempt.

Growing community of inventors

Austin, TX, United States of America

Eduardo Reyes