International Business Machines Corporation

Holger Karn

Joachim Frank

Michael Reichert

Boas Betzler

Kevin Michael McBride

Bryan Frederick Smith

Peter Wansch

Hans-Juergen Bildhaeuser

Michael Roehle

Ingo Dressler

Vinod S Chavan

Li Long Chen

Namik Hrle

Curt Lee Cotner

Stephen Andrew Brodsky

You-Chin Gene Fuh

Maryela Evelin Weihrauch

Paul Arnold Ostler

Anshul Dawra

Torsten Steinbach

Bilung Lee

Randall William Horman

Matthew Wayne Novak

Andreas Limmer

Norbert Heck

Thorsten Steinbach

Megan Elena Bock

Yongchun Zhu

Sven Miller

James R Porell

Ganesh B Asaithambi

A method and system for performing an operation on protected sensitive data. A processor of a data processing system receives, from a computing system: (i) the protected sensitive data, (ii) an identification of an operation that accesses and utilizes the protected sensitive data during performance of the operation, and (iii) a request to perform the operation, wherein the computing system is external to the data processing system. The processor de-protects the received protected sensitive data, which generates unprotected sensitive data from the protected sensitive data. The processor performs the operation, which includes accessing and utilizing the unprotected sensitive data and generating a result. After the operation is performed, the processor re-protects the unprotected sensitive data, which restores the protected sensitive data. The processor sends the result to the computing system.

In a data processing system environment performing an operation on sensitive data

A method and system for dynamically modifying rules in a firewall infrastructure. A signed passport is encrypted based on a public key certificate registered with a trusted signer. The signed passport includes a hash value that includes a heart-beat time-out interval and a firewall rule. A trigger signal within the heart-beat time-out interval is generated. The signed passport and the trigger signal are transmitted within the heart-beat time-out interval to a border control agent of a firewall in the firewall infrastructure. In response to receiving, from the border control agent, a continuous confirmation of the firewall rule within a time interval shorter than the heart-beat time-out interval, the firewall is modified according to the firewall rule. In response to determining that the trigger signal was not received by the border control agent within the heart-beat time-out interval, the firewall rule is reset.

Passport-controlled firewall

A method and system for dynamically modifying rules in a firewall infrastructure. A signed passport, which includes a heart-beat time-out interval and a firewall rule, is received. A trigger signal is generated within the heart-beat time-out interval. The signed passport and the trigger signal are transmitted within the heart-beat time-out interval to a border control agent of a firewall in the firewall infrastructure. In response to receiving, from the border control agent, a continuous confirmation of the firewall rule within a time interval shorter than the heart-beat time-out interval, the firewall is modified according to the firewall rule. In response to determining that the trigger signal was not received by the border control agent within the heart-beat time-out interval, the firewall rule is reset.

Performing an operation on sensitive data

A method, and associated system and computer program product, for modifying rules in a firewall infrastructure are described. A unit of deployment including application code and a signed passport is received at a requestor module on a server. The passport includes a heart-beat time-out interval, a firewall rule, and a first application hash value. A trigger signal within the heart-beat time-out interval is generated. The application code is hashed, resulting in a second application hash value. In response to authenticating the passport and determining the first and second application hash values as being equal, the signed passport and trigger signal are transmitted to a border control agent of the firewall; the firewall rule is continuously confirmed within a time interval shorter than the heart-beat time-out interval; and the firewall is modified according to the firewall rule.

An apparatus, system, and method are provided for evaluating database accesses. The apparatus may comprise a computer program that causes a computer system to exchange profiling data between a client application module and a database module; execute a database access; determine a database access policy violation at a detection point module; and selectively request context information from a context point module related to the database access.

Apparatus, system, and method for database management extensions

A method and associated computing system. A first computing environment receives data that includes first sensitive data. The first computing environment includes a hypervisor, a virtual machine running on the hypervisor, and a compliance gateway coupled to the virtual machine and the hypervisor. The compliance gateway intercepts the request. The compliance gateway inspects the intercepted request, does not find sensitive data in the request from inspecting the intercepted request, and forwards the request directly to the virtual machine in response to not finding sensitive data in the request. The virtual machine receives the request from the compliance gateway and in response. The virtual machine initiates performance of an operation indicated in the request. The hypervisor determines that the performance of the request requires the first sensitive data that is sensitive, and in response the hypervisor prevents the virtual machine from completing performance of the operation, by intercepting the operation.

Protection of sensitive data from unauthorized access

A method, and associated system and computer program product, for dynamically modifying rules in a firewall infrastructure. A unit of deployment is received at a requestor module at a server. The unit of deployment includes the application code and a signed passport. The passport includes a firewall rule and a first application hash value. The received passport is authenticated, the received application code is hashed resulting in a second application hash value, and it is validated that the received first application hash value and the generated application hash value are equal. In response to the validation, the passport is received by a border control agent of the firewall from the server, a firewall is modified in the firewall infrastructure according to the received firewall rule, and communicating with the application is enabled through the modified firewall.

A method, system and program product for providing virtual configuration management for applications running in a virtual environment. A method is described that includes: receiving a request for application configuration information from a virtual machine for an application; retrieving a versioned configuration image for the application, wherein the versioned configuration image comprises formatted configuration information captured from a previously configured application; creating a configuration runtime instance from the versioned configuration image; and attaching the configuration runtime image to the virtual machine for the application.

Application configuration in a virtual environment

A method and associated computing system. Data received by a computing environment includes a mixture of non-sensitive data and sensitive data along with related metadata indicative of a sensitivity of the sensitive data. The computing system includes the computing environment. An operation is performed on the sensitive data in the computing environment by: (a) determining that the data used for the operation are sensitive data, (b) intercepting the operation on the sensitive data, and (c) registering newly created sensitive data, as a result of the operation, with metadata indicating one or more addresses of the sensitive data. An external access to the sensitive data in the computing environment is intercepted. A compliance firewall rule is applied to the sensitive data intended to leave the computing environment. The compliance firewall rule defines an action to be applied to the sensitive data such that the sensitive data are protected against unauthorized access.

A method and associated systems for a transparent tunneling architecture for a secured database. A tunneling driver captures a user's database-access request before it can be blocked by a security gateway. The driver translates the request into a Web-service request, where the requested Web service is implemented by means of classes or objects that correspond to database operations. The request is formatted into a standard database-independent form that the security gateway allows to pass to the database server intact. A Web-service runtime environment interprets the requested Web service, thereby instructing the server-side database-management application to respond to the user's access request. In a reverse procedure, the database's response is translated into a Web-service response to the requested Web service that may similarly tunnel through the security gateway, and that is then translated back into a form that may be properly interpreted by the requesting user's client application.

Transparent tunneling architecture for a secured database

Provided are techniques for extending functionality of an application. A request to create an application object is received. In response to receiving the request, the application object is created, and an extension proxy object is created. The extension proxy object is wrapped around the application object. An invocation of a function of the extension proxy object is received from the application object.

Integrated extension framework

A method, computer program product, and infrastructure for accessing a remote application running on a system A by a system B, each being connected to an open network and located behind a firewall, are provided. The method, computer program product, and infrastructure provide for system A sending a first HTTP request to system B via the open network, blocking the first HTTP request from system A till an application request is available at system B, system B sending an HTTP response to system A via the open network, the HTTP response comprising the application request, system A processing the application request from system B to generate an application response, system A sending a second HTTP request to system B via the open network, the second HTTP request comprising the application response, and blocking the second HTTP request from system A till another application request is available at system B.

Method and infrastructure for accessing remote applications through a secure firewall

Techniques are provided for tuning work. In response to identifying a trigger for a work, automatic tuning is invoked. The trigger indicates that a performance goal for the work has been missed. The work is analyzed. A tuning operation is selected for the work based on a tuning history. The selected tuning operation is implemented for the work.

Tuning of work to meet performance goal

A method, system, and computer program product for providing information of a monitored system through a graphical user interface (GUI) of a monitoring application to support simplified or automatic identification of events. The method includes, among other possible operations, initiating an event pattern script recording. The method also includes keeping track of user actions on said GUI and on activated GUI panels during said event pattern script recording by requesting a user to specify, once the user activates a further GUI panel, which panel information in a current GUI panel triggered activation of said further GUI panel and based on what criterion the triggering occurred. The user specified information results in triggering information. The method also includes, in response to receiving an indication that an event has been identified, stopping said event pattern script recording. The method also includes, storing said event pattern script recording containing identification information identifying the event, GUI panel information about said activated GUI panels during said event pattern script recording and said triggering information.

Growing community of inventors

Aidlingen, Germany

Holger Karn