International Business Machines Corporation

Heather Maria Hinton

Ivan Matthew Milman

Patrick Ryan Wardrop

George Robert Blakley, Iii

Anthony Scott Moran

Rick A Hamilton, Ii

Neil Toussaint

Darren J Moore

Neil Ian Readshaw

Anthony Joseph Nadalin

Timothy James Hahn

Birgit Monika Pfitzmann

Kelly Malone

Karthik Sivakumar

Mari F Heiser

Jerome R Bell, Jr

Eric Michael Anderson

Rajesh Radhakrishnan

Dolapo Martin Falola

Alastair John Angwin

Mark Pozefsky

Venkat Raghavan

Greg Clark

Ajamu Akinwunmi Wesley

Charles Daniel Wolfson

Steven A Bade

Sridhar R Muppidi

Richard James McCarty

Matthias Schunter

Michael P Waidner

Donald N Jones

Matthew Paul Duggan

Benjamin Brewer Harmon

Masakazu Miyamoto

Linda L Santos

Clifton Steve Looney

Jeb R Linton

Naohiko Uramoto

Srinivas Babu Tummalapenta

Shane Bradley Weeden

Richard Jay Cohen

Gavin George Bray

Michael James McGuire

Peter P Rodriguez

Ian Glazer

Prabhakar Attaluri

David Werner Bachmann

Mark Vandenwauver

Brian James Turner

Parley Avery Salmon

Shane Weeden

Nicholas George Harlow

Toni U Basoglu

Casey M Plunkett

Katsumi Ohnishi

George R Blakley

Clifton Looney

Richard James Mccarty

A method operative at an identity provider enforces a digital rights management (DRM) scheme associated with a piece of content. The identity provider is an entity that participates in a 'federation' with one or more other entities including, for example, an service provider (e.g., a content provider), a DRM privileges provider, and a DRM policy provider. In one embodiment, the method begins by having the identity provider obtain and evaluate against a DRM policy a set of DRM privileges associated with the end user requesting access to the piece of content. Based on the evaluation, the identity provider generates a single sign on (SSO) message that includes a reference to the set of DRM privileges. The message is then forward to the service provider entity, which provides the end user a response.

Digital rights management (DRM)-enabled policy management for an identity provider in a federated environment

A method and system for improving deployment of a compliance cloud software component is provided. The method includes receiving application compliance requirements associated with operational requirements associated with hardware and software components. Original configuration files associated with a current hardware and software configuration for each hardware and software component are received and modified and configuration files associated with a modified hardware and software configuration for the hardware and software components are generated. A risk assessment with respect to the application compliance requirements is executed and a specified cloud infrastructure stack is enabled. A software application comprising the specified cloud infrastructure stack is generated, deployed, and executed resulting in operation of the hardware and software components.

Compliant software component infrastructure deployment

In a method for estimating a severity of a current security incident reported by a customer for the customer's computer system, a processor receives from one or more administrators for a plurality of prior security incidents reported by the customer, identifications of a respective plurality of actual severities for the plurality of prior security incidents. The processor estimates, based in part on the plurality of identified actual severities of the prior security incidents, a severity of the current security incident. The processor reports the estimated severity for the current security incident.

Automated security incident handling in a dynamic environment

A method and system for improving usage of a security compliance framework is provided. The method includes authenticating a user for: access to the security compliance frame work, access to an authoritative source component of the compliance framework, and access to a data store component of the compliance framework. A functionality status of the security compliance framework and a request associated with contents of the data store are presented to a user via a dashboard interface. In response, the request is triggered and associated results are generated.

Security compliance framework usage

An application is instrumented with a document protection service provider interface (SPI). The interface is used to call an external function, e.g., an encryption utility, to facilitate secure document exchange between a sending entity and a receiving entity. When the application invokes the SPI, the user is provided with a display panel. The end user provides a password for encryption key generation, together with an indication of desired encryption strength. The service provider uses the password to generate an encryption key. In one embodiment, the service provider provides the key to the service provider interface, which then uses the key to encrypt the document and to complete the file transfer operation. In the alternative, the service provider itself performs encryption. The SPI generates and sends a message to the receiving entity that includes the key or a link to enable the receiving entity to retrieve the key.

Method and system for secure document exchange

A system and method for using a single-use password to add SSO functionality to a service of a Service Provider belonging to an F-SSO federation that does not support F-SSO functionality for the service. In response to receiving notification from an Identity Provider that a user has requested access to the service, the Service Provider uses information provided by the Identity Provider to identify and authenticate the user, and then uses standard API calls to create and send a temporary password to the user. This password may be created as a function of the user's physical location or IP address and may be communicated out-of-band. Upon determining that the user has correctly returned the temporary password to the Service Provider, the Service Provider generates and sends the user a strong single-use password through a secure in-band communication, through which the user may access the service.

Simulated SSO functionality by means of multiple authentication procedures and out-of-band communications

An approach is provided for controlling a task to perform a change ticket. The task is correlated with user(s) authorized to initiate execution of command(s) to perform the task and with an authorized location. A requestor is determined to be in the authorized location by receiving verification from physical access control system(s). The requestor is determined to be logged into a first computer system at the authorized location and to have utilized the first computer system to request execution of one of the command(s). The requestor is determined to be remotely logged into a second computer system via the first computer system. The requestor is determined to be one of the authorized user(s) correlated with the task. Based in part on determining the requestor is one of the authorized user(s) subsequent to determining the requestor is remotely logged into the second computer system, the requested command is executed.

Correlating a task with a command to perform a change ticket in an it system

A system and method for using a Service-Provider password to simulate F-SSO functionality. A processor receives from an F-SSO Identity Provider authentication data for a user who has requested access to a secured service. The service is managed by an F-SSO Service Provider that does not offer F-SSO functionality for that service. Upon receiving the data, the processor redirects the user to an SU-F-SSO portal of the Service Provider, which uses the received authentication data to authenticate the user. The processor sends the user an on-demand password and, when the user uses that password to sign on, the processor matches the entered password with a stored copy of the password that was sent to the user. If they match, the processor grants the user access to the requested service. In some embodiments, the on-demand password may be a single-use password or may be sent to the user via an out-of-band communication.

Using a service-provider password to simulate F-SSO functionality

A method, system, and computer usable program product for verifying and enforcing certificate use are provided in the illustrative embodiments. A certificate is received from a sender. The certificate is validated before communicating a message associated with the certificate to a receiver. If the certificate is invalid, a policy is selected based on a type of invalidity of the certificate. An action is taken to enforce the policy for using the certificate. The certificate may be received from the sender at a proxy. The validating may further include verifying the validity of the certificate using a certificate from a certificate database accessible to the proxy over a network. the proxy may copy a part of the certificate database to a second certificate database local to the proxy. The validating may further include verifying the validity of the certificate using a certificate revocation list accessible to the proxy over a network.

Verifying and enforcing certificate use

A multi-component auditing environment uses a set of log-enabled components that are capable of being triggered during an information flow in a data processing system. A 'master' compliance component receives data from each log-enabled component in the set of log-enabled components, the data indicating a set of logging properties that are associated with or provided by that log-enabled component. The master compliance component determines, for a given compliance policy, which of a set of one or more events are required from one or more of the individual log-enabled components in the set of log-enabled components. As a result of the determining step, the master compliance component then configures one of more of the individual log-enabled components, e.g. by generating one or more configuration events that are then sent to the one or more individual components. This configuration may take place remotely, i.e., over a network connection. As a result of the information flow, audit or other logs are then collected from the log-enabled components. The master compliance component evaluates the collected logs to determine compliance with the compliance policy. As necessary, the master compliance component re-configures one or more log-enabled components in the set of log-enabled components to address any compliance issues arising from the evaluation. Thus, once a given compliance policy is specified, typically the individual log-enabled components in the multiple-component environment are not responsible for their own configuration, as that task is undertaken by the master compliance component.

Distributed policy distribution for compliance functionality

SSO functionality by means of a temporary password and out-of-band communications

An approach is provided for controlling a task to perform a change ticket. The task is correlated with command(s) to perform the task, and first and second computer system(s). Authorized user(s) utilize the first computer system(s) to remotely log into respective second computer system(s). A requestor utilizes a first computer system to make a request to execute one of the command(s). A second computer system is determined to be remotely logged into by the first computer system to receive the request. It is determined whether (a) the first computer system is one of the first computer system(s) correlated with the task and (b) the second computer system is one of the second computer system(s) correlated with the task. Based in part on (a) and (b) being true, the requested command is executed. If (a) or (b) is false, then execution of the requested command is prevented.

Correlating a task with a command to perform a change ticket in an IT system

Growing community of inventors

Austin, TX, United States of America

Heather Maria Hinton