International Business Machines Corporation

Haim Schneider

Asaf Zinger

Ofira Tal-Aviv

Asaf Ben-Ezra

Olga Berezin

Artem Spector

Iddo Levin

Ishai Borovoy

Gal A Shachor

Paul W Haverstock

Avner Shafrir

Avshalom Houri

Jacob Rimer

Michael Anthony Dempsey

Uri Segev

Robert J Sundstrom

Renee Marie Kovales

Gil Perzy

Anthony William Wrobel, Jr

Mary Elizabeth Raven

Mary A Curran

Benson K Chen

Dror Yaffe

Uri Zonens

Andrew N Capella

Tomer Vilensky

A system for eliminating redundant notifications to SIP/SIMPLE subscribers, the system including a notification fingerprinter configured to generate a fingerprint from the contents of a SIP/SIMPLE subscriber notification using a predefined fingerprinting method, a fingerprint comparator configured to compare a fingerprint of a previously-sent notification with a fingerprint of a waiting-to-be-sent notification, and a server configured to send the waiting-to-be-sent notification to the subscriber only if the fingerprints do not match.

Eliminating redundant notifications to SIP/SIMPLE subscribers

Techniques for determining the legitimacy of a problem report are provided. Report data indicating a reported problem is received at a computer processor. Image data associated with the reported problem is identified, and metadata associated with the image data is identified. The legitimacy of the reported problem is determined based on the metadata in view of the report data.

Legitimacy determination of reported problems

Examples of techniques for authenticating mobile applications are described herein. A method includes receiving, via a first server, a key pair and a policy file associated with a mobile service from a second server. Authentication of the mobile application is performed based on the key pair and the policy file. A scope token is generated with an application scope in response to authenticating the mobile application. Authentication of a client device is performed corresponding to the mobile application and a user to generate a doubly-authenticated scope token including a device scope and application authenticity scope. The doubly-authenticated scope token is sent to a security gateway for user authentication. A trebly-authenticated scope token is received with a grant token request and a grant token is sent to the mobile application. The grant token is received from the mobile application. An access token is generated and sent to the mobile application.

Authenticating mobile applications using policy files

Eliminating redundant notifications to SIP/simple subscribers

Examples of techniques for authenticating mobile applications are described herein. A method can include receiving, by a processor, a key pair and a policy file associated with a mobile service. The processor can receive a service request from a mobile application at a security gateway. The processor can detect that the service request includes an invalid or missing access token. The processor can redirect the mobile application to request a grant token from an authorization end point on a server. The processor can receive a grant token request from the mobile application and forward the grant token request to the server based on a policy file, the policy file including a list of: a plurality of security objects to be authenticated, a plurality of computing devices to authenticate the security objects, and an order of authentication.

Examples of techniques for authenticating mobile applications are described herein. A method includes receiving, at a first server, a key pair and a policy file associated with a mobile service on a second server, the policy file includes a plurality of security objects to be authenticated, a plurality of computing devices to authenticate the security objects, and an order of authentication. The method includes distributing the key pair and the policy file to a security device. The method also includes receiving, at the first server, an authentication request from a mobile application. The method further includes creating an authenticity challenge as specified in the policy file and sending the authenticity challenge with a response to the mobile application.

Examples of techniques for validating access tokens are described herein. An example computer-implemented method includes receiving, via a processor, a pushed event at a server. The method includes adding, via the processor, a value of the pushed event to a black list of recently disabled users, devices, applications, or any combination thereof. The method also includes receiving, via the processor, a request to access a resource on the server, the request including an access token. The method further includes comparing, via the processor, a field value of the access token with the black list. The method further includes declining, via the processor, the request based on a match of the field value of the access token with a value of the pushed event in the black list.

Access control using tokens and black lists

A method for evaluating authorization rules, the method including evaluating a plurality of authorization rules in connection with an authorization process for a subject, storing in a computer-readable storage medium and in association with the subject a rule identifier of any of the rules that are applicable to the subject, and performing, in connection with a subsequent authorization process for the subject, a computer-based action indicated by any of the rules identified by any of the stored rule identifiers, where the performing step is performed independent from an evaluation of the applicability of any of the authorization rules in connection with the subsequent authorization process.

Accelerated reevaluation of authorization rules

A first data store is provided for storing individual subscriptions, including match criteria and an action specification. A second data store is also provided for storing group subscriptions, including a use counter and a list of pointers to the individual subscriptions. When a new individual subscription is submitted, it is registered/stored in the individual subscription data store. Upon registration, its criteria are checked against the criteria of existing subscriptions in the group subscription data store. If there is a match, a use counter corresponding to the matching group subscription is incremented, and a pointer is added to a list of pointers to associate the matching group subscription with the individual subscription. If there is not a match, a new group subscription is added to the group subscription data store, and the group subscription is registered with the pub/sub engine. A use counter corresponding to the group subscription is incremented, and a pointer is added to a list of pointers.

Method, system, and program product for providing automatic group subscriptions

A system for processing triggering rules in SIP event notification filters, including an XPath processor configured to collect a set of XPath expressions from at least one trigger of at least one SIP event notification filter of at least one subscribers in a set of subscribers who are subscribed to state information of a resource, and create a merged finite state automaton having a plurality of nodes and transitions that collectively represent the combination of the XPath expressions, and a streaming parser configured to parse previously-published state information of the resource and newly-published state information of the resource, and stream parsing events of the parsed information to the XPath processor, where the XPath processor is configured to employ the automaton to perform a streaming evaluation of the XPath expressions in parallel to determine which nodes of the parsed information satisfies any of the XPath expressions represented by the automaton.

Parallel processing of triggering rules in SIP event notification filters

A method for sharing subscriptions to the content of a resource list includes creating a first subscription to the content of the resource list upon receipt of a first subscription request for the presence state of the list from a first user; receiving a second presence subscription request for the resource list from a second user; sending a one-time request with the identity of the second subscribing user to an XCAP server; receiving an authorization response related to the one-time request; and creating a super user subscription to the content of the resource list, the super user subscription used to provide presence state information about the list members to the first user and the second user.

Growing community of inventors

Ramot Meir, Israel

Haim Schneider