International Business Machines Corporation

James Robert Magowan

Angel Nunez Mencias

Bin Jia

James Steven Luke

Anbazhagan Mani

Moriyoshi Ohara

Stefan Liesche

Graham White

Nicolas Maeding

Dirk Herrendoerfer

Peter Morjan

Edward J Biddle

Preethi Polepalli Yeshwanth

Securing pods in a container orchestration environment is provided. A container runtime interface command is verified to perform an orchestration action on a set of containers comprising an application workload that corresponds to a service based on matching the container runtime interface command to a rule contained in a trusted execution environment contract included in a pod sandbox virtual machine of a trusted execution environment. It is determined whether the container runtime interface command to perform the orchestration action on the set of containers is valid based finding a matching rule in the trusted execution environment contract. In response to determining that the container runtime interface command to perform the orchestration action on the set of containers is valid, the container runtime interface command is executed to perform the orchestration action on the set of containers in the pod sandbox virtual machine of the trusted execution environment.

Securing pods in a container orchestration environment

Aspects of the invention include loading an image of a virtual server onto a boot partition of a trusted execution environment (TEE), wherein a first key is embedded in the image. A second key is received from an end customer of an application. Data is received from an independent software vendor (ISV) of the application, wherein the data includes a third key. The second key and the third key are combined inside the TEE to create a fourth key. An available memory space in an independent memory device is encrypted using the fourth key to create a secure data volume. Encrypted data is stored in the secure data volume.

Storage encryption for a trusted execution environment

Aspects of the invention include a computer-implemented method including providing, by a processor, a computing cluster having a plurality of cluster nodes and services. The method provides, by the processor, a limited catalog of services and restricts, by the processor, access of an administrator of the computing cluster to use of a service deployer, wherein the service deployer restricts administrator access to installation and administration of clusters and deployment of only the limited catalog of services.

Locked-down cluster

Aspects of the present disclosure relate to training a conversational agent. A conversational agent is initiated with a set of atomic operators, each atomic operator having one or more atomic operator rules for executing operations. A natural language input is received from a user on a conversational interface. A determination is made whether the natural language input maps to an existing script by referencing a rules engine. In response to a determination that the natural language does not map to an existing script, training is requested from the user. Training is then received from the user which maps the natural language input to a script. A mapping rule which maps the natural language input to the script is stored, and the script is executed.

Training of conversational agent using natural language

Systems, methods and computer program products for processing natural language input are provided. Natural language input is processed by one or more processing rules. The processing rules may specify one or more actions to be performed. The processing rules may alternatively or additionally split up the natural language input into a plurality of simpler sub-inputs, each of which may then be processed by one or more processing rules. The processing rules themselves may be generalized, which generalization may be based on user input. In the event that a suitable processing rule cannot be found, a request may be made to a user to provide instructions for processing the natural language input.

Natural language processing with adaptable rules based on user inputs

A method for processing a data object for a database, the database containing data representing a first data model and a set of one or more mapping rules, includes receiving a data object that conforms to a second data model. The method then selects one or more of the mapping rules. The mapping rules provide a mapping between a set of elements of the second data model and a corresponding set of elements of the first data model. The method applies the selected mapping rules to transform a set of elements of the received data object into a corresponding set of elements of a target data object conforming to the first data model. The method then searches the database for the set of elements of the target data object to identify instances of the target data object in the database. A corresponding computer program product and apparatus are also disclosed.

Growing community of inventors

Woking, United Kingdom

James Robert Magowan