International Business Machines Corporation

Karl David Schmitz

Bryan Childs

Michael Page Kasper

Kin Choi

Kathryn Voss

Elpida Tzortzatos

Steven M Partlow

Harris M Morgenstern

Peter Jeremy Relson

David Hom

Peter G Spera

Michael Gary Spiegel

Peter A Fatzinger

James G McClure

Stanley R Shubert

Patricia A Donica

A system includes a memory system and a processing system operably coupled to the memory system. The memory system includes a plurality of address spaces. The processing system is configured to perform operations including creating a data space from within a primary address space and a primary address space number access list entry referencing the data space. An unauthorized caller routine in a home address space configured to issue a service request including an address space-switching program call from the home address space to a program call target routine in the primary address space. The address space-switching program call references the primary address space number access list entry in the primary address space. A vulnerability identifier associated with the program call target routine is created and logged based on one or more conditions indicative of a cross-memory integrity violation detected responsive to the service request.

Cyber security for space-switching program calls

A system includes a memory system and a processing system operably coupled to the memory system. The processing system is configured to perform operations including setting a target register to point to a first protected storage location of the memory system resulting in a protection exception upon access, calling an authorized service, and confirming that the authorized service uses the target register based on detecting the protection exception. The target register is adjusted to point to a parameter list including one or more known values and a pointer to a second protected storage location resulting in the protection exception upon access to confirm use of a value of the parameter list responsive to calling the authorized service. Parameter list testing and target register testing is repeated for locations in the parameter list and target registers to construct a testing profile for vulnerability testing of the authorized service.

Cyber security testing for authorized services

Embodiments are provided for implementing a transparent conversion of common virtual storage requests to storage with limited access. Embodiments include providing a storage manager configured to perform address translation for requests, providing a data address translation (DAT) structure configured to connect a higher-level DAT table to a lower-level DAT table, and creating the DAT structure based on a request from a process. Embodiments also include responsive to receiving a storage request, performing a DAT fault process based on validating user credentials associated with an entry of the higher-level DAT table corresponding to the storage request, and responsive to the validation, updating the higher-level DAT table entry to allow access to the restricted-use portion of the common virtual storage, and otherwise, returning a DAT fault for the higher-level DAT table entry.

Transparent conversion of common virtual storage

Embodiments include methods, and computer system, and computer program products for testing directly and indirectly anchored interfaces for vulnerabilities regarding storage protection keys. Aspects include: defining a test template for each parameter area interface for a given system service's interface for vulnerabilities regarding storage protection keys by replacing each parameter area interface with unauthorized parameters to generate expected failures, defining a test template for each parameter area interface having variable-length fields for vulnerabilities regarding buffer overflows in an attempt to access a protected storage area beyond an unprotected storage area with a larger length field to generate expected failures, defining a test template for each control block to replicate copies that will generate expected failures from the system service's validation, executing at least one test for each test template generated, summarizing results of the tests executed, and returning an overall return code based on summarized results.

Methods and systems of testing interfaces of computer storage for storage vulnerabilities

A technique is provided for detecting vulnerabilities in system code on a computer. Supervisor call routines and program call routines of the system code are analyzed to determine which are available to a caller program that is an unauthorized program and has a PSW key-. Predefined input parameters are provided to test cases for use by the supervisor call routines and the program call routines in order to generate an output for analysis. The output is analyzed to determine when supervisor call routines and/or program call routines performed a potential vulnerability action. The potential vulnerability action include reading from fetch protected storage, writing to system key (key-) storage, and attempting to access unallocated storage while running with a PSW key-

Automatic discovery of system integrity exposures in system code

In order to reduce operating system overhead and to reduce the amount of time that work is queued in a computer operating system environment, flexibility enhancements are made to initiator address spaces allowing them to be created, destroyed, assigned, reassigned and reclaimed. Furthermore, initiator structures are provided with tailorable features which allow them to be readily tuned and honed for computer work associated with the particular classes or groups of work. A method for deployment of initiator address spaces is provided so as to meet response time goals set by system programmers and/or managers. Additionally, system operators are freed from the chore of real-time initiator management.

Growing community of inventors

Poughkeepsie, NY, United States of America

Karl David Schmitz