International Business Machines Corporation

John Leslie Harter

David Walsh Palmieri

Jeffrey Tobias Robke

Brian Robert Matthiesen

David Bruce Lection

James Michael Stafford

Joseph M Gdaniec

Michael John Morton

Gee Ngoo Chia

Timothy Peter Krein

Jeffrey A Craig

Brian Stuart Lauber

Peter S Wassel

Robert A Johnson

Frederick Aaron Schwartz

Peggy Pak-Fan Dixon

An identity and access management IAM system is augmented to provide for supervised, iterative machine learning (ML), preferably with a user-generated training set for classification. The training set may include various types of data, including characteristics or attributes of the account types, the users, or the like. A goal of the initial ML training, which may include one or multiple passes, is to enable the machine to identify specific characteristics or attributes that provide a good classification result, with the resulting classifications then applied within the IAM system. In particular, the output of the ML system may be used by the IAM system for enforcing rights associated with the identified accounts, managing accounts, and so forth.

Using classification data as training set for auto-classification of admin rights

An identity and access management (IAM) system is associated with a set of data sources from which data is collected. A set of vulnerabilities that the IAM system should attempt to detect is identified. For each vulnerability to be detected, a prioritized list of strategies used to detect that vulnerability is generated. Preferably, each strategy specifies the type(s) of data required to detect that vulnerability. An algorithm to determine a best strategy to be used for detecting each vulnerability, preferably based on the data available from the data sources, is then identified. The IAM system then collects data in an optimized manner. In particular, during the collection process, the IAM system preferably collects only what is necessary based on the configuration, even if the data source is capable of providing additional data. The collected data is then processed to detect security vulnerabilities associated with the IAM accounts.

Dynamic optimizing scanner for identity and access management (IAM) compliance verification

Receiving, by a first computer, a request from a second computer for a web page that contains embedded code. The first computer includes a plurality of versions of the embedded code. In response to determining, by the first computer, that the web page request includes a request for a specific version of the embedded code, the first computer modifies a default version of the web page to embed the requested specific code version and transmits the modified web page to the second computer. In another aspect, in response to determining, by the first computer, that the web page request does not include a request for a specific version of the embedded code, transmitting, by the first computer, the default version of the web page that contains a default version of the embedded code to the second computer.

On-demand code version switching

An identity management system is augmented to enable a manager to associate 'risk' metadata with different types of access requests representing computer system accounts that can be requested by authorized users. When an authorized user then requests access to a particular account, any 'risk' associated with that access is shown to the user, typically in the form of a visual &#x201c;badge&#x201d; or other such indicator. The badge includes an appropriate informational display (e.g., &#x201c;High Risk&#x201d; or &#x201c;Regulated&#x201d;) that provides an appropriate risk warning. The risk metadata badge information preferably also is displayed for risk-based access request approval routing; in such context, the risk metadata may also determine the risk approval workflow itself. Thus, for example, if the risk metadata is present when the authorized user requests access, an approval workflow may be modified so that the request approval is routed appropriately.

Visual display of risk-identifying metadata for identity management access requests

The present invention provides a method, system, and program product for composing a virtualized computing environment. Specifically, under the present invention, data and a definition file that contains application runtime requirements for the data are stored on a portable memory device. Application runtime requirements can be anything related to an environment in which the data was previously used. When the portable memory device is received in a computerized device, an auto-insert script can be executed that signals a provisioning system and/or transports the definition file to the provisioning system. The provisioning system will then interpret the definition file on the computerized device to retrieve the application runtime requirements. Then, the virtualized computing environment will be composed by adapting an environment of the computerized device according to the application runtime requirements retrieved from the definition file.

Method, system, and program product for composing a virtualized computing environment

Methods, systems and computer program products are provided which update firmware in a network computer by replacing the standard operating system to be loaded at the initialization of the network computer with a firmware update operating system. The firmware update operating system is then downloaded to the network computer and initiated to update the firmware of the network computer. The firmware update operating system may then be replaced with the standard operating system to be loaded at the initialization of the network computer. The network computer may then be reinitialized by, for example, a cold boot, so as to load the standard operating system. The cold boot may be server initiated so as to allow for firmware updates with intervention by an operator at the network computer.

Methods, systems and computer program products for secure firmware updates

A method, system and program product are described which allow a dynamically constructed desktop to be optimized for the capabilities of the browser in the target device. This enables a server to manage the distribution of applets to clients matching the capabilities of the browser, the Java runtime environment (JRE), the screen resolution, color depth, sound capabilities, link speed, communications links and any other items which can be differentiated that are supported by the client requesting use of the applet.

Distributed application launcher for optimizing desktops based on client characteristics information

A server and method allocates access to a digital video movie to clients for viewing upon demand. The server receives requests to view the movie and in response, compares a number of requests to concurrently view the movie to a threshold. If the number is less than the threshold, the server allocates access for a current request to an existing copy of the movie stored on one or more disks, using bandwidth previously reserved from the one or more disks for the movie. However, if the number exceeds the threshold, the server automatically reserves additional bandwidth for future viewers if available from the one or more disks for the movie. But, if the number exceeds the threshold but such additional bandwidth is not available, the server makes another copy of the movie on another disk provided the copy can be made before the most advanced viewer completes its viewing.

Growing community of inventors

Cary, NC, United States of America

John Leslie Harter