International Business Machines Corporation

Kristin Marie Hazlewood

Gary Dale Williams

Yogesh Vilas Golwalkar

Magesh Rajamani

Daw Feng

Krishna Kishore Yellepeddy

John Mark McConaughy

John Thomas Peck

Mark Joseph Cavage

Shevaun-Ann M Fontenot

Annemarie Rose Fitterer

Richard Heller

John A Morganti

Jason Murray Bell

Rajalakshmi S Iyer

Andy Hazlewood

John Ryan McGarvey

Karla Kay Arndt

Shia-San Gong

John Ryan Mcgarvey

Richard Allyn Heller

Use of cryptographic key-store hardware security modules is optimized in a system having a first scarce high-security key storage device and a second more plentiful low-security key storage device comprising securing a cryptographic key to the higher security level by initially storing the key in the first storage device, then responsive to an event, evaluating the stored key against one or more rules, and subsequent to the evaluation, reclassifying the stored key for relocation, encrypting the reclassified key using a key-encryption key; relocating the reclassified key into the second, lower-security storage device, and storing the key-encryption key in the first storage device.

Optimizing use of hardware security modules

A method, a data processing system, and a computer program product for managing cryptographic information. A determination is made as to whether a first time stamp of when cryptographic information was created is more recent than a second time stamp of a backup of the cryptographic information in response to receiving a request for the cryptographic information from a requester. The cryptographic information is used to encrypt data. The cryptographic information is prevented from being provided to the requester in response to a determination that the first time stamp of cryptographic information creation is more recent than the second time stamp of the backup of the cryptographic information.

Managing keys used for encrypting data

A computer implemented method, apparatus, and computer program product for managing requests. Responsive to receiving a request from a client, a determination is made as to whether a connection within a pool of connections has a set of outstanding requests for the client to handle a previous request from the same client. Responsive to a determination that the connection has any outstanding request, a determination is made as to whether a set of requests queued for the connection is equal to or exceeds a threshold. Responsive to a determination that the set of outstanding requests is equal to or exceeds the threshold, subsequent requests from the client are unprocessed until the set of outstanding requests becomes less than the threshold.

Flow control in a distributed environment

The invention describes techniques for enforcing password policy within a distributed directory environment that includes one or more distributed directory servers and a proxy server that acts as an intermediate agent between a client and the distributed directory environment. In one aspect, the proxy server is enhanced to support the passing (from the backend server to the client) of password policy controls. In particular, controls returned from a backend server are parsed and cached (for re-use) for the life of a given client connection. According to another aspect, the proxy server ensures that all compare operations for a single user's password are directed to the same backend server in the distributed directory environment. This insures that a user's most current password is used, and that failed operation counts, resets and operational attributes are up-to-date. According to still another aspect, the proxy server enforces password policy on bind plug-ins and, in particular, through a pair of pre-bind and post-bind extended operations. In particular, pre-bind processing includes checking if an account is locked. Post-bind processing includes checking for expired passwords, grace logins and updating failed/successful bind counters.

Method and system for enforcing password policy in a distributed directory

A method, system, and computer usable program product for certificate distribution using a secure handshake are provided in the illustrative embodiments. A client sends an indication in a request, the request being a part of a secure data communication with a server. The indication indicates an ability of the client to accept a certificate as a part of a response from the server. The server retrieves a new certificate. The server sends as a result of the indication, a new certificate in the response corresponding to the request. The client receives as a result of the indication, the new certificate in a response that corresponds to the request. The client separates the new certificate from the response and uses the new certificate in the secure data communication with the server. The server uses the new certificate in the secure data communication with the client.

Certificate distribution using secure handshake

The illustrative embodiments provide for automatically and proactively retrieving administrative maintenance tasks or potential issues from a set of directory servers without direct intervention from an administrator. Responsive to an operation request being sent from a requesting application to the set of directory servers and an administrative maintenance control mechanism being active, an administrative maintenance control is automatically sent to the set of directory servers. Responsive to receiving the response to the administrative maintenance control, an end user application within the data processing system is notified that the at least one of the administrative maintenance tasks or the potential issues have been received.

Lightweight directory access protocol (LDAP) administrator task notification control

In association with a data processing system that includes one or more servers, one or more clients and a partitionable distributed directory contained in a database, a computer implemented method is provided for selectively processing data entries that reside in the directory. The method comprises the steps of generating a request to perform an operation on each data entry in a specified group of intended entries, and specifying a hashing control index that uniquely identifies each entry of the specified group, and excludes all other entries. The requested operation is applied only to data entries in the directory that are identified by the specified hashing control index.

Using a hashing mechanism to select data entries in a directory for use with requested operations

A method, system, and computer usable program product for deploying directory instances are provided in the illustrative embodiments. A configuration of an existing directory instance is cloned to the new directory instance. The existing directory instance may execute in a first data processing system and the new directory instance may execute in a second data processing system. A schema of the existing directory instance is cloned to the new directory instance. A determination is made whether the new directory instance is a peer of the existing directory instance. Data from the existing directory instance is cloned to the new directory instance if the new directory instance is a peer of the existing directory instance. The new directory instance is made operational in a directory topology.

Deploying directory instances

A method, operable on a processing device, for assessment of skills of a user may include receiving, by the processing device, an error message reporting an error associated with the user. The method may also include determining, by the processing device, a categorization of the error. Determining the categorization of the error may include assigning one of a plurality of predetermined skill ratings to the user. Each predetermined skill rating may be associated with a predefined condition. The method may additionally include generating, by the processing device, a report for assessment of the skills of the user. The report may include an identification of the user, the error, identification of a system if a system associated error, identification of a product if a product associated error, the categorization of the error and the predetermined skill rating assigned to the user.

Assessment of skills of a user

Processing data in a multithreaded application to alleviate impaired or substandard performance conditions is provided. Work items that are pending processing by the multithreaded application are placed into a data structure. The work items are processed by a plurality of threads within the multithreaded application in accordance with a first algorithm, e.g., first-in first-out (FIFO). A thread within the multithreaded application is configured apart from the plurality of threads such that it processes work items in accordance with a second algorithm that differs from the first algorithm, thereby avoiding the impairing condition. For example, the thread may process a pending work item only if it has a particular characteristic. The thread restricts its own processing of work items by intermittently evaluating workflow conditions for the plurality of threads; if the workflow conditions improve or are unimpaired, then the thread does not process any work items.

Growing community of inventors

Austin, TX, United States of America

Kristin Marie Hazlewood