International Business Machines Corporation

James F Riordan

Daniela Bourges-Waldegg

Ruediger Rissmann

Diego M Zamboni

Christian Hoertnagl

Andreas Schade

Andreas Wespi

Yann Duponchel

Christian Hörtnagl

Dominique Alessandrl

Diego M Zambonl

Alessandri Dominique

Dominique Alessandri

Rüdiger Rissmann

A method of preserving privacy and confidentiality in a system where information is associated with an existing web page having an address. The method includes receiving a store command from a first user system, the store command including at least a database key and information to be associated with the web page, wherein the database key was created by performing a cryptographic hash function on the address of the web page; storing the information at a location in a storage database; associating the location with the database key; receiving a retrieve command from a second user system, the retrieve command including the database key calculated by the second user system; retrieving stored information from one or more locations in the database associated with the database key; and transmitting the stored information to the second user system.

Privacy and confidentiality preserving reporting of URLs

A method of acquiring tags using web search includes receiving a search query in a search engine, processing the search query and returning a list of candidate resources corresponding to the search query, determining a candidate resource out of the list of candidate resources, extracting tags from the search query, and tagging the candidate resource with the extracted tags.

Tagging system using internet search engine

Described is a technique for detecting attacks on a data communications network having a plurality of addresses for assignment to data processing systems in the network. The technique involves identifying data traffic on the network originating at any assigned address and addressed to any unassigned address. Any data traffic so identified is inspected for data indicative of an attack. On detection of data indicative of an attack, an alert signal is generated.

Detecting attacks on a data communication network

A method and apparatus are provided for detecting peer-to-peer communication on a data communication network, between an internal client machine within an internal address space and an external client machine. The method includes routing all messages addressed to internal client machines to an analysis device. The analysis device identifies messages pertaining to peer-to-peer communication and identifies the internal client machine to which the messages of a specified nature were addressed. The analysis device terminates the connection with the external client machine if the establishing of the peer-to-peer communication is in violation of a pre-determined internal network rule.

Detection and control of peer-to-peer communication

A method is provided for adding intended meaning to digital signatures. A message, being base content, is received to be signed. Assertions, ontologies, and description of a reasoner are adjoined to the message. Ontologies are a formal specification of vocabulary and rules used to state the assertions. The reasoner validates the assertions against the corresponding ontologies. A compound message is formed including the message, the assertions, the ontologies, and the reasoner. The compound message is signed using a cryptographic digital signature, where the assertions indicate an intended meaning of the digital signature. During verification of semantic signatures, a digital signature is received for a compound message, where the compound message includes assertions, ontologies, and reasoner. The digital signature is verified, and the compound message structure is checked for semantic signature conformance. In response to proper verification, the reasoner is utilized to verify a conformance of the assertions to the ontologies.

Semantic digital signatures

Methods and apparatus are provided for managing an IP network interconnecting a plurality of network hosts (). Status information, indicative of status of a host, is automatically acquired from each host (). The status information, such as MAC address, security and/or operational information, acquired from a host () is automatically recorded in at least one DNS record, associated with the IP address of that host (), of a DNS server (). The host status information in the DNS records can then be accessed for network management operations. The automatic acquisition and recording of the status information may be performed by a DHCP server () of the network on allocation of dynamic IP addresses to hosts ().

IP network management based on automatically acquired network entity status information

The invention relates to a method for operating virtual networks. The method comprises providing a first virtual network comprising a first set of network ports assigned to a first virtualization tag (T) and a second virtual network comprising a second set of network ports assigned to a second virtualization tag (T), the first and the second virtual network having compatible address ranges and being adapted to only pass data packets within them, providing a first network node having a source address (SA) in the first virtual network and being operationally connected to a first port (P) assigned to the first virtual network by means of the first virtualization tag (T), monitoring the first network node in order to detect a predetermined condition, and, on detection of the predetermined condition, reassigning the first port (P) to the second virtual network by means of assigning the second virtualization tag (T) to the first port (P), such that no data packet can be passed from the first network node (N) to a second network node (N) connected to a second port (P) assigned to the first virtual network by means of the first virtualization tag (T) directly and keeping of the source address (SA) for the first network node (N) in the second virtual network (). The invention further relates to a further method for operation virtual networks, a data network system and a computer program product adapted to perform the inventive methods.

Methods for operating virtual networks, data network system, computer program and computer program product

Described is apparatus for testing an intrusion detection system in a data processing system. The apparatus comprises an attack generator for generating attack traffic on a communications path in the data processing system. A collector receives responses generated by the intrusion detection system on receipt of the attack traffic. A controller coupled to the attack generator and the collector varies the attack traffic generated by the attack generator in dependence on the response received from the intrusion detection system by the collector.

Intrusion detection in data processing systems

Detection of an attack on a data processing system. An example method comprising, in the data processing system: providing an initial secret; binding the initial secret to data indicative of an initial state of the system via a cryptographic function; recording state changing administrative actions performed on the system in a log; prior to performing each state changing administrative action, generating a new secret by performing the cryptographic function on a combination of data indicative of the administrative action and the previous secret, and erasing the previous secret; evolving the initial secret based on the log to produce an evolved secret; comparing the evolved secret with the new secret; determining that the system is uncorrupted if the comparison indicates a match between the evolved secret and the new secret; and, determining that the system in corrupted if the comparison indicate a mismatch between the evolved secret and the new secret.

Data processing systems

The invention provides a form of reacting on security or vulnerability information relevant for a system comprising computer software and/or hardware or electronics, wherein a service provider with a first subsystem () is providing activation tokens to be received by a customer with a second subsystem (). The activation tokens including activation information and naming of system characteristics in machine readable and filterable manner. The second subsystem () comprises receiving means () for controlling the receiving of the activation tokens, checking means () for automatically determining whether the activation information is relevant for the second subsystem () by checking whether the second subsystem has characteristics corresponding to the naming of an activation token, and transforming means () for transforming relevant activation information into at least one activation measure for the second subsystem (). The activation measures will reduce the vulnerability of the second subsystem.

System, method and software for supplying activation information to a subsystem

The invention provides a mechanism for a secure password entry by using cryptographic functions. This mechanism is applicable to the access of computers and programs. Upon a request of a program E a password p is read-in by receiving a program-specific identifier H(E) from the program E, receiving the password p, and generating from at least the program-specific identifier H(E) and the received password p a program-password-specific identifier F(H(E),p). The program-password-specific identifier F(H(E),p) is sent to the program E which then further processes the program-password-specific identifier F(H(E),p).

Growing community of inventors

Rueschlikon, Switzerland

James F Riordan