International Business Machines Corporation

Khalid A Asad

Hiroshi Maruyama

Robert B Carroll

Hamid Bacha

Mark Fisk

Robert Burns

Paul Ilechko

Dieter Poetzschke

Adarsh Gupta

Mark E Carson

Hatem Ghafir

Drew Kittel

Paresh Patel

Lolo Lasida

Roger Reider

Robert Briggs

Larry An

Ku Lee

Srinivasa Kasturi

Raymond Good

David S Cruley

David J Mulley

Amit Pamecha

Michael A Brown

J Matthew Sebastian

Manjit Singh Kohli

John DiClemente

Janet A Cugini

Subodh A Samuel

Mudumbai Ranganathan

A method for event management in asynchronous work processing including timing at least one step in an asynchronous work process, wherein the at least one step is performed by an application and the at least one step has an expected time of completion; determining an error preventing step completion in response to the expected time of completion expiring; correcting the error; and re-performing the at least one step.

Event based model for managing application health and failure recovery for asynchronous processing systems

A data processing system and method stores a relational database in which audit records are stored without compromising the ability to detect data tampering. The technique provides for detection of unauthorized row modification, row deletion, and row insertion. Extra measures are incorporated to protect from administrator attacks. In addition, the technique enables integrity checking and audit log archiving without having to suspend or bring down the audit subsystem. These on-line capabilities are especially important in mission critical applications which must satisfy the requirement that the application be disabled if the audit subsystem is not functioning properly.

Apparatus and method for protecting against data tampering in an audit subsystem

A secure-end-to-end communication system for electronic business system and method of operation, e.g., the Internet, includes a web server&mdash;vault controller having personal storage vaults in the controller for users, registration and certification authorities. Each personal vault runs programs on the controller under a unique UNIX user ID. Data storage is provided by the controller wherein the storage is owned by the same user ID assigned to the vault. A registration authority running as a software application in the controller processes requests to issue, renew and revoke digital certificates issued by a certification authority using two pairs of public-private keys. The registration authority interacts with the vault controller to decide whether an applicant qualifies to receive a digital certificate. The certification authority running as software application in the controller includes a certificate management system that provides services such as issuing, revoking, suspending, resuming, and renewing a user's right to digital certificates.

Secure server using public key registration and methods of operation

Users and security aware applications are able to request operations on and manipulate role based digital certificates (and their corresponding private keys) distributed among multiple key rings through the use of a Key Ring Organizer (KRO). In a typical use of the KRO, the computer network is coupled to a secure server and at least one end-user terminal; a Registration Authority; and an organization server hosting secure applications. The end-user terminal includes a general purpose Web browser with a KRO plug-in module and a KRO managing a set of key rings, where each key ring may contain multiple keys. The KRO components include the KRO, a set of KRO catalogs (typically one), a built-in key ring, and multiple external key rings. A key ring can be of any type, including a smart card, key disk, or remote file. A catalog (typically a file) contains a set of entries in which each entry contains a set of attributes and a reference to a key record stored in a key ring. Public key data is stored in a catalog during key generation and later verified against the certificate to be stored in a key ring in order to maintain the integrity of the association between references in a catalog and the key pairs to which they refer. A built-in key ring is contained within each catalog and is managed by end-users like any other key ring; however, outside the KRO environment, a built-in key ring is not accessed independently from the catalog which contains it. This mechanism greatly increases mobility. In a typical client-server session the KRO is accessed by a secure server application using Key Ring Organizer Language (KROL) messages sent to the KRO plug-in over a secure protocol (e.g., SSL) to generate, store and select role based keys for use in signing documents or authenticating end-users. The KRO provides a mechanism whereby signature requests are always authorized by the owner of the signing private key. The KRO also allows digital key parameters to be configured by the end-user so that authentication request must be authorized by the user as well.

Key ring organizer for an electronic business using public key infrastructure

A secure process for untrusted windowing system client programs to transfer data between security domains is mediated by a special trusted client program, the Selection Manager. The mechanism used can be configured to meet the Compartmented Mode Workstation (CMW) requirements capability for regrading cut and paste operations. To meet the CMW cut and paste requirements and to prevent the regrading selection mechanism from acting as a covert channel, the regrading selection mechanism uses dummy window IDs in communicating to the lower level process during a Mandatory Access Control (MAC) upgrade operation, and for all regrading operations, an event is sent to the Selection Manager that causes the Selection Manager to put up a pop-up requesting user confirmation before the transfer is allowed to proceed. This selection mechanism supports configurable regrading selection operations for cutting and pasting (MAC upgrading for all users, MAC downgrading for privileged users, and information label upgrading and downgrading for all users).

Integrity mechanism for data transfer in a windowing system

Growing community of inventors

Frederick, MD, United States of America

Khalid A Asad