International Business Machines Corporation

Kimberly DaShawn Simon

Sridhar R Muppidi

Damir Anthony Jamsek

Ronald B Williams

George Robert Blakley, Iii

Diana Jeanne Arroyo

Sandra K Johnson

Vaijayanthimala K Anand

David R Safford

Emily Jane Ratliff

Joy Marie Latten

Janice Marie Girouard

Dustin C Kirkland

Linda Jones Scott

Terry G Thomas, Jr

Vaijayanthiamala K Anand

Jeffrey Wijono

A system, apparatus, computer program product and method for authorizing information flows between devices of a data processing system are provided. In one illustrative embodiment, an information flow request is received from a first device to authorize an information flow from the first device to a second device. The information flow request includes an identifier of the second device. Based on an identifier of the first device and the second device, security information identifying an authorization level of the first device and second device is retrieved. A sensitivity of an information object that is to be transferred in the information flow is determined and the information flow is authorized or denied based only on the sensitivity of the information object and the authorization level of the first and second devices irregardless of the particular action being performed on the information object as part of the information flow.

Authorizing information flows based on a sensitivity of an information object

The invention generally relates to electronic collaboration sessions and, more particularly, to systems and methods for providing reconnection to and migration of electronic collaboration sessions. A method for managing a collaboration session includes providing a computer infrastructure structured and arranged to store data regarding a plurality of clients of a collaboration session, and monitor a connection of each of the plurality of clients to a host system. The computer infrastructure is further operable to (i) migrate the plurality of clients to a new host system after determining that a number of the plurality of clients experiencing connection problems with the first host system exceeds a threshold value and/or (ii) present customized summary data to at least one of the plurality of clients after the at least one of the plurality of clients reconnects to the collaboration session after having been disconnected from the collaboration session.

Reconnection to and migration of electronic collaboration sessions

Authorizing information flows between devices of a data processing system is provided. In one illustrative embodiment, an information flow request is received from a first device to authorize an information flow from the first device to a second device. The information flow request includes an identifier of the second device. Based on an identifier of the first device and the second device, security information identifying an authorization level of the first device and second device is retrieved. A sensitivity of an information object that is to be transferred in the information flow is determined and the information flow is authorized or denied based only on the sensitivity of the information object and the authorization level of the first and second devices irregardless of the particular action being performed on the information object as part of the information flow.

Authorizing information flows

A hash key is generated based on an information object and a lookup operation is performed in a hash table based on the hash key. A determination is made whether an entry in the hash table at an index corresponding to the hash key identifies a labelset for the information object. A labelset, identifying a sensitivity of the information object, is stored in the entry at the index corresponding to the hash key for the information object if a labelset for the information object is not identified in the entry in the hash table. Information flows involving the information object are authorized based on a lookup of the labelset associated with the information object in the hash table. The hash table may be a multidimensional hash table.

Associating security information with information objects

An intrusion detection mechanism is provided for flexible, automatic, thorough, and consistent security checking and vulnerability resolution in a heterogeneous environment. The mechanism may provide a predefined number of default intrusion analysis approaches, such as signature-based, anomaly-based, scan-based, and danger theory. The intrusion detection mechanism also allows a limitless number of intrusion analysis approaches to be added on the fly. Using an intrusion detection skin, the mechanism allows various weights to be assigned to specific intrusion analysis approaches. The mechanism may adjust these weights dynamically. The score ration can be tailored to determine if an intrusion occurred and adjusted dynamically. Also, multiple security policies for any type of computing element may be enforced.

System and method of dynamically weighted analysis for intrusion decision-making

A system and method in a data processing system for error checking and resolving failed input/output open calls. A configuration mechanism configures the options, such as the information stored in databases, details of how each error check is performed, and what actions should be taken when improper error checking occurs. Based on data stored in databases, such as an I/O calls database, a rules with syntax database, and an usage calls database, a code analyzer analyzes code in software programs for an error check of a failed input/output open call. A reporting mechanism reports data from the analyzed code to a report file, such as why software programs have proper and improper error-checking instances, sends errors from the analyzed code to an error file, and enables these files to be displayed on a display. Finally, the code analyzer enables resolving an improper error check for the failed input/output open call.

System and method for error checking of failed I/O open calls

A method, system, and program provide for voice mail management. A voice mail filtering controller calculates a separate Bayesian score for each voice mail message from among multiple voice mail message entries received into a voice mailbox for a user, wherein each separate Bayesian score indicates a probability that the associated voice mail message is unwanted by said user. During playback, the voice mail filtering controller automatically deletes a selection of the voice mail messages each with a separate Bayesian score greater than a particular Bayesian score of the last played voice mail message from the voice mailbox.

Internet telephone voice mail management

A reference monitor that authorizes information flows between elements of a data processing system is provided. The elements of the data processing system are associated with security data structures in a reference monitor. An information flow request is received from a first element to authorize an information flow from the first element to a second element. A first security data structure associated with the first element and a second security data structure associated with the second element are retrieved. At least one set theory operation is then performed on the first security data structure and the second security data structure to determine if the information flow from the first element to the second element is to be authorized. The security data structures may be labelsets having one or more labels identifying security policies to be applied to information flows involving the associated element.

Reference monitor for enforcing information flow policies

A method for authorizing information flows based on security information associated with information objects is provided. A hash key is generated based on an information object and a lookup operation is performed in a hash table based on the hash key. A determination is made whether an entry in the hash table at an index corresponding to the hash key identifies a labelset for the information object. A labelset, identifying a sensitivity of the information object, is stored in the entry at the index corresponding to the hash key for the information object if a labelset for the information object is not identified in the entry in the hash table. Information flows involving the information object are authorized based on a lookup of the labelset associated with the information object in the hash table. The hash table may be a multidimensional hash table.

Associating security information with information objects in a data processing system

A reference monitor system, apparatus, computer program product and method are provided. In one illustrative embodiment, elements of the data processing system are associated with security data structures in a reference monitor. An information flow request is received from a first element to authorize an information flow from the first element to a second element. A first security data structure associated with the first element and a second security data structure associated with the second element are retrieved. At least one set theory operation is then performed on the first security data structure and the second security data structure to determine if the information flow from the first element to the second element is to be authorized. The security data structures may be labelsets having one or more labels identifying security policies to be applied to information flows involving the associated element.

Reference monitor method for enforcing information flow policies

A system and method in a data processing system for error checking and resolving failed input/output open calls. A configuration mechanism configures the options, such as the information stored in databases, details of how each error check is performed, and what actions should be taken when improper error checking occurs. Based on data stored in databases, such as an I/O calls database, a rules with syntax database, and an usage calls database, an error check of a failed input/output open call is performed.

A method and system is provided for providing and storing annotations that pertain to travel directions to a particular destination, the annotations generally including ratings of the accuracy of the directions and errors observed in the directions by prior users. Annotations submitted by users are stored in a central repository, for access by those who subsequently become interested in the directions or the particular destination. A useful embodiment of the invention is directed to a method for providing travel directions over a selected network, wherein a request for directions regarding a specified destination is sent from a requester to a Directions Provider. The Provider retrieves the requested directions and furnishes them to the requestor. The method further includes generating annotations associated with the furnished directions in accordance with a set of rules resulting from one or more decisions made by the requester, and sending the annotations to the requester. The requestor then selectively provides annotations regarding the furnished directions to a central repository.

Method and system for providing travel direction annotations over a network

A memory coherence protocol is provided for using cache line access frequencies to dynamically switch from an invalidation protocol to an update protocol. A frequency access count (FAC) is associated with each line of data in a memory area, such as each cache line in a private cache corresponding to a CPU in a multiprocessor system. Each time the line is accessed, the FAC associated with the line is incremented. When the CPU, or process, receives an invalidate signal for a particular line, the CPU checks the FAC for the line. If the CPU, or process, determines that it is a frequent accessor of a particular line that has been modified by another CPU, or process, the CPU sends an update request in order to obtain the modified data. If the CPU is not a frequent accessor of a line that has been modified, the line is simply invalidated in the CPU's memory area. By dynamically switching from an invalidate protocol to an update protocol, based on cache line access frequencies, efficiency is maintained while cache misses are minimized. Preferably, all FACs are periodically reset in order to ensure that the most recent cache line access data in considered.

Memory coherence protocol enhancement using cache line access frequencies

A system and method for verifying database security across multiple platforms is presented. Servers are queried to obtain a user id access list of a particular database, directory, or file. The user id access list is compared with a validated access list. A report file is generated that includes user id's that have access to a database, directory, or file but do not have proper permission. The report file includes a submission of how to correct each security violation.

Growing community of inventors

Austin, TX, United States of America

Kimberly DaShawn Simon