International Business Machines Corporation

Jonathan M Barney

Cataldo Mega

Edmond Plattier

Daniel Suski

Carlos A Hoyos

David Lebutsch

Tim Waizenegger

Stefan Schleipen

Tamer E Abuelsaad

Daniel C Krook

Robert R Wentworth

Ryan G Dejana

In response to at least one message received by a processor of a gateway server from a user device wherein each message requests that an encryption key be downloaded to the user device, the processor generates at least one unique encryption key for each message and sends the at least one generated encryption key to the user device, but does not store any of the generated encryption keys in the cloud. For each encryption key having been sent to the user device, the processor receives each encryption key returned from the user device. For each encryption key received from the user device, the processor stores each received encryption key in the cloud.

Managing security in a computing environment

Embodiments of the present invention disclose a method, system, and computer program product for intelligent access control. A computer detects a new user or modifications made to an existing user in an access control list. The computer determines which other users share an attribute with the newly added or modified employee and then determines which asset(s) are associated with the determined group(s). The computer determines the correlation value between the group(s) and the asset. Based on the determined correlation value, the computer determines whether the newly added or modified employee should have access to the asset.

Intelligent access control

A method and system for managing data security in a computing environment. A processor at the gateway server receives, from a user device, at least one message. Each message requests that an encryption key be downloaded to the user device. The gateway server interfaces between the user device and a cloud that includes interconnected computing systems external to the user device. In response to the received at least one message, the processor generates at least one unique encryption key for each message and sends the at least one generated encryption key to the user device, but does not store any of the generated encryption keys in the cloud. For each encryption key having been sent to the user device, the processor receives each encryption key returned from the user device. For each encryption key received from the user device, the processor stores each received encryption key in the cloud.

Method and system for managing security in a computing environment

A data processing and storage apparatus has a hardware security module and a data storage medium storing encrypted data objects and a hierarchical data maintenance structure of encrypted partition tables and hash-nodes forming a rooted tree, where a given partition table comprises a first reference to a given encrypted data object and a first cryptographic key for decryption thereof, where a given hash-node comprises a second reference to a partition tables or hash-node and a second cryptographic key being suitable for decryption thereof, and where the root node is decipherable using a master cryptographic key stored in the hardware security module, the given data object being assigned to the root node via the first and second references of the given partition table and the given hash-nodes forming a set of successive nodes in the rooted tree.

Deletion of content in digital storage systems

A client computer extracts contextual information associated with a file that is created. The client computer generates scores for the file by utilizing the contextual information that is extracted. The client computer assigns a value to the file, based on an aggregation of the scores that are generated. The client computer monitors activities on the client computer, wherein the activities trigger an event on the client computer. The client computer determines whether the event is in violation of one or more computer security policies on a server computer, wherein the one or more computer security policies require work-related files to be deleted or encrypted. The client computer classifies the file as personal data or work-related business data. The client computer secures the file, if the file is classified as work-related business data.

Growing community of inventors

Kingston, NY, United States of America

Jonathan M Barney