International Business Machines Corporation

James Richard Coon

Garry Joseph Sullivan

Richard J Gusefski

Jakob Christopher Lang

Michael J Jordan

Michael J Miele

Brian D Valentine

Victor M Lourenco

Franz Hardt

Roger D Krsnak

Jan Schneider

Paul Reuben Day

Daniel Paul Kolz

Peter Kenneth Szwed

Steven G Glassen

Marco Kraemer

Richard Victor Kisley

Peter Joseph Heyrman

John C Dayka

Christopher V Derobertis

Michael E Aho

David Alan Christenson

Christopher Thomas Gloe

Klaus Werner

David L Johnson

Thomas B Mathias

Edward W Chencinski

Jessica P Doherty

David Wayne Glass

David Howard Evans

Jonathan William Edwards

Clifford L Hansen

Kyong Jin Shim

Scott Douglas McCreadie

Michael J Young

Timothy R Seeger

Jody E Berk

Harold Olaf Romo

Jessica Doherty

Michael Joseph Jordan

Michael Young

A computer-implemented method for remote management of hardware security modules (HSMs) includes receiving a command request from a mobile device. The command request includes an encrypted key part and an encrypted signing key. The HSM decrypts the command request using a key associated with a security zone of the mobile device. The HSM decrypts the encrypted key part and the encrypted signing key. Decrypting the encrypted key part and the encrypted signing key includes using the key associated with the security zone of the mobile device and a key associated with a remote administrator associated with the mobile device. A command is generated for a domain with a target HSM. The command is generated using the decrypted key part and the decrypted signing key. The command is transmitted to the domain for execution by the target HSM. Various other methods, systems, and computer-readable media are also disclosed.

Remote management of hardware security modules

Processing within a computing environment is facilitated by generating a hybrid security certificate using multiple cryptosystems. The generating includes obtaining data for inclusion in the hybrid security certificate, and generating a first digital signature associated with a first cryptosystem to cover the data, and a second digital signature associated with a second cryptosystem to cover the data. The generating further includes providing the hybrid security certificate, where the hybrid security certificate includes the data, the first digital signature associated with the first cryptosystem, and the second digital signature associated with the second cryptosystem, and where the first digital signature has no dependency on a key of the second cryptosystem or the second digital signature, and the second digital signature has no dependency on a key of the first cryptosystem or the first digital signature.

Generating a hybrid security certificate using multiple cryptosystems

The solutions disclosed enable security credentials to be shared between two entities. Embodiments of the present invention can be used to facilitate the transfer security credentials associated with a first level of permission of a first entity to a second entity that does not have the security credentials associated with the first level of permission in response to receiving a request to share security credentials between two entities.

Authenticated copying of encryption keys between secure zones

A system and method of managing a plurality of assets by associating a smart card with a compute subsystem by installing a database on the smart card and embedding an identifier of the compute subsystem. The system and method, in turn, may receive a request to access an asset of a compute subsystem; verify that a feature of the database is enabled in response to the request, the feature corresponding to the asset; and grant the access to access the asset upon the verifying of the feature.

Asset protection based on redundantly associated trusted entitlement verification

A computer program product for integrated key serving is provided. The computer program product includes a tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method. The method includes using a smart card of two or more smart cards with a support element of two or more support elements to create an encryption key and storing the encryption key in an encrypted file that can only be decrypted by the smart card and the support element used to create the encryption key.

Integrated key server

Methods, apparatus, and computer program products for variable dynamic throttling of network traffic for intrusion prevention are disclosed that include initializing, as throttling parameters, a predefined time interval, a packet count, a packet count threshold, a throttle rate, a keepers count, and a discards count; starting a timer, the timer remaining on no longer than the predefined time interval; maintaining, while the timer is on, statistics including the packet count, the keepers count, and the discards count; for each data communications packet received by the network host, determining, in dependence upon the statistics and the throttle rate, whether to discard the packet and determining whether the packet count exceeds the packet count threshold; and if the packet count exceeds the packet count threshold: resetting the statistics, incrementing the throttle rate, and restarting the timer.

Variable dynamic throttling of network traffic for intrusion prevention

A method, apparatus and computer program product are provided for protecting ongoing system integrity of a software product using digital signatures. A core product load manifest for protecting ongoing system integrity of a software product having a plurality of pieces includes a manifest header including header attributes of the software product. A list of a plurality of manifest items is stored with the manifest header. Each manifest item identifies a corresponding piece of the software product. Each manifest item includes at least one attribute. A manifest digital signature is stored with the manifest header. The manifest header, the header attributes, each of the plurality of items, and each item attribute are included in the manifest digital signature. A digital signature is computed for each signable piece of the software product and is stored with the piece of the software product. The digital signature of each signed software product piece is excluded from the core product load manifest. An amended manifest is created for identifying added and deleted pieces of the software product and is chained to the core product load manifest. Each signable, added item in the amended manifest has a digital signature that is excluded from the amended manifest.

Method and apparatus for protecting ongoing system integrity of a software product using digital signatures

The disclosed data stream optimization process is containing two logical entities, the first being the pre-comparison optimizer component and the second being the comparison component. The pre-comparison optimizer component performs two discrete tasks. First, the input data stream is written into a next state buffer. Second, the elimination of redundancies involves detecting and removing redundant screen attributes, since the terminal's execution time for processing a screen attribute is more than that required for a data character. The comparison component contains three distinct sub-components. First, non-data constructs such as commands and orders are optimized and placed in the outgoing data stream. Second, the screen image that is represented by the data stream is compared to the existing screen image to further reduce the outgoing data stream. This reduced version is further reduced when repeated characters and fields are replaced with repeat orders which take up less space within the outgoing data stream. Lastly, the reduced outgoing data stream is operated on by a post-optimizer sub-component. The post-optimizer sub-component will first determine whether repeated characters existing at the end of the outgoing data stream can be replaced a single repeat order. Then, the sub-component proceeds to remove any unnecessary cursor control orders. Upon completion, the fully optimized data stream is routed to the terminal or conversion facility.

Data stream optimizer utilizing difference coding between a current

Growing community of inventors

Rochester, MN, United States of America

James Richard Coon