International Business Machines Corporation

John C Dayka

Tamas Visegrady

Mark A Nelson

James W Sweeny

Richard Henry Guski

Donna N Dillenberger

Peter Grimm Sutton

Dimitrios Pendarakis

Richard Harold Boivie

Kenneth Alan Goldman

Michael Charles Osborne

James Alan Ruddy

Mohit Kapur

Eysha S Powers

Alyson Comer

Michael J Jordan

Enriquillo Valdez

Anthony Thomas Sofia

Thomas B Mathias

Michael Page Kasper

Walter Barlett Farrell

Reinhard Theodor Buendgen

William J Rooney

Birgit Monika Pfitzmann

James A O'Connor

Khary J Alexander

Utz Bacher

K Paul Muller

Craig Raymond Walters

Todd Weston Arnold

Tiberiu (Jim) Suto

Messaoud Benantar

Patrick Joseph Callaghan

Elaine Rivette Palmer

Kevin H Peters

Matthias Schunter

Eric David Rossman

Guenter Karjoth

Wayne Erwin Rhoten

Peter G Spera

Kurt Norman Schroeder

Stefan Usenbinz

Michael P Waidner

Linda Nancy Betz

Cecilia Carranza Lewis

Sean M Swehla

Thomas L Gindin

Geoffrey George Jackson

Steven R Hart

Donald W Schmidt

Glen Alan Jaquette

Peter Kenneth Szwed

Steven G Glassen

Marco Kraemer

Timothy James Hahn

Steven A Bade

Klaus Werner

Edward W Chencinski

Donald Fred Ault

James Richard Coon

Patrick S Botz

Garry Joseph Sullivan

Richard J Gusefski

Harvey Tildon McGee

Bruce Robert Wells

Margaret K LaBelle

John J Petreshock

Eric Charles Finkelstein

Enriquilo Valdez

A computer-implemented method according to one embodiment includes identifying a creation of a container within a system, selecting a security policy for the container, based on one or more attributes, identifying a key label associated with the security policy for the container, retrieving a data encryption key, utilizing the key label, and encrypting the container, utilizing the data encryption key. This may enable a highly granular level of automatic container-level security within the system that may be transparently implemented within the system, which may streamline container security and reduce an amount of stored data and processing necessary for implementing container security, and may thereby improve the performance of the system.

Implementing policy-based container-level encryption

A computer-implemented method according to one embodiment includes identifying a first request from a user to access a container, determining whether the user has a first authorization to access the container, allowing the user to access the container, in response to determining that the user has the first authorization to access the container, identifying a second request from the user to access content within the container, where the content is encrypted, retrieving a key label associated with the container, determining whether the user has a second authorization to access the key label, retrieving a data encryption key, utilizing the key label, in response to determining that the user has the second authorization to access the key label, and allowing the user to access the content that is encrypted by performing one or more decryption actions, utilizing the data encryption key.

Implementing a separation of duties for container security

Batched execution of encryption operations is performed. A batched set of data for which format-preserving encryption is to be performed is obtained. The batched set of data includes a plurality of fields of data, which are independent of one another. Multiple rounds of format-preserving encryption are performed on the plurality of fields of data to provide an output of format-preserved encrypted data. A round of format-preserving encryption includes calling an encryption function to perform one or more encryption operations on the plurality of fields of data in parallel.

Batched execution of encryption operations

A processor-implemented method for a secure processing environment for protecting sensitive information is provided. The processor-implemented method may include receiving encrypted data and routing the encrypted data to the secure processing environment. Then the encrypted data may be decrypted and fields containing sensitive information may be found. The method may also include obfuscating the sensitive information and returning, by the secure processing environment, the decrypted data and obfuscated data.

Secure processing environment for protecting sensitive information

A computer program product for cross-site request forgery (CSRF) prevention is provided and includes a computer readable storage medium having program instructions embodied therewith. The program instructions are readable and executable by a processing circuit to cause the processing circuit to issue a server request for a certificate, which is associated with a user, responsive to a client request to visit a uniform resource indicator (URI) being received, validate the certificate upon receipt in fulfillment of the server request, compare a referrer listed in a header of the client request with a list of certificate elements in the certificate, authenticate the user in accordance with correlation between the referrer and at least one of the certificate elements and authorize the client request to visit the URI upon the user being authenticated.

Cross-site request forgery (CSRF) prevention

A computer-implemented method, a computer system, and a computer program product are provided for enforcing multi-level security (MLS) on a message transmitted over a network that may be insecure. The method includes the processor obtaining a request from a source to send a message to a target, where the request includes the message and a context indicating a requested security level for the message. The processor encrypts the message based on ascertaining the message received in the request is a plaintext. The processor authenticates the encrypted message based on ascertaining the encrypted message is a ciphertext, where the target is enabled to trace the authenticated ciphertext back to the source. The processor transmits the authenticated encrypted message to the target across the network.

Multi-level security enforcement utilizing data typing

Embodiments include a method, system, and computer program product for acquiring a data repository, the data repository being associated with a log configured to receive metadata. Then, a content of the log with respect to at least one manipulation of the data repository is modified by adding first metadata of the metadata. Further, signatures that identify control statements configured to govern the at least one manipulation of the data repository are collected by adding second metadata of the metadata into the log.

Establishing a chain of trust in a system log

Technical solutions are described for securely deploying a shrouded virtual server. An example method includes sending, by a host manager, authentication information of a hosting system to a client device in response to a request from the client device. The \method also includes receiving a request to deploy a virtual server using a shrouded mode. The method also includes deploying a preconfigured hypervisor on the hosting system, where the preconfigured hypervisor is deployed in an immutable mode that disables changes to security settings of the preconfigured hypervisor. The method also includes deploying, by the preconfigured hypervisor, a preconfigured boot image as an instance of the virtual server on the preconfigured hypervisor. The method also includes sending, by the host manager, an identifier of the virtual server for receipt by the client device.

End-to end protection for shrouded virtual servers

Growing community of inventors

New Paltz, NY, United States of America

John C Dayka