International Business Machines Corporation

Lawrence H Koved

Pau-Chen Cheng

Marco Pistoia

Kapil Kumar Singh

Gelareh Taban

Anthony Joseph Nadalin

Wilfried Teiken

Stephen Carl Gates

Ian M Molloy

Liangzhao Zeng

Guerney D H Hunt

Bo Zhang

Xiaolan Zhang

Trent Ray Jaeger

Suresh N Chari

Jonathan Paul Munson

Sharon Mary Trewin

Alaa Salah Youssef

Giovanni Pacifici

Calvin Bruce Swart

Magda Mahmoud Mourad

Aaron Stephen Jay Kershenbaum

Krishna Chaitanya Ratakonda

Nataraj Nagaratnam

Edwin Joseph Selker

Divyesh Jadav

Marc Philippe Stoecklin

Youngja Park

Yuan-Chi Chang

Lin Luo

Bruce Arland Rich

Douglas Lee Schales

Matt Richard Hogstrom

Reiner Sailer

Ramesh Ambat Gopinath

Josyula R Rao

Christian Alexander Lang

Xin Hu

David Granshaw

Hagai Aronowitz

Gabriel Alatorre

Ted A Habeck

Paul Harry Abbott

Simon Christopher Nash

Bert Vincent Laonipon

Ann Eleanor Dalton

Marco Pistola

Aaron Kershenbaum

Igor Sominsky

Brigid Mcdermott

Rabimba Karanjai

Jeff McAffer

Adjustments to be made to a system for authenticating users may be made by performing the following operations: obtaining a stochastic model of the system, wherein the stochastic model includes two or more classes of requests; obtaining a set of preferences for handling authentication requests and a set of operational parameter values; determining, based at least in part on the stochastic model and the set of operational parameter values, that adjusting an authentication scheme will improve a probable degree to which the authentication system will meet the set of preferences; responsive to the determination that adjusting the authentication scheme will improve the probable degree to which the system for authenticating users will meet the set of preferences, adjusting the authentication scheme of the system for authenticating users; and performing an authentication of a user based on the adjusted authentication scheme.

Queue management and load shedding for complex authentication schemes

An example operation may include one or more of receiving one or more transaction requests to complete one or more transactions, recording the one or more transaction requests in a blockchain, requesting one or more transaction confirmations from an out-of-band device to confirm the one or more transactions, and committing the one or more confirmed transactions to the blockchain.

Providing out-of-band verification for blockchain transactions

Authenticated base digital document(s) are issued to client(s) by an issuing party, and aggregate digital document(s) are received. An aggregate digital document includes base digital document(s) and attachment(s). Authenticity of the aggregate digital document(s) is verified, resulting in authenticated aggregate digital document(s), which are stored and/or redistributed. Authentication challenge(s) are sent by a verifying party to a client requesting part or all of an aggregate digital document from the client be verified. The part or all of the aggregate digital document is received and authenticity and integrity are verified, resulting in an authenticated aggregate digital document. The client verifies authenticity of a base digital document and receives the authentication challenge(s) for an authenticated aggregate digital document and sends part or all of the authenticated aggregate digital document to the verifying party for verification by the verifying party.

Mobile multi-party digitally signed documents and techniques for using these allowing detection of tamper

Using a stochastic queuing model to determine adjustments to be made to authentication system operation. In light of operational parameter values and the stochastic queuing model, a determination is made that adjusting the value of a particular parameter for handling authentication requests is likely to improve some aspect of system performance, and the request handling parameter is adjusted accordingly.

A certified checkpoint is provided for a ledger comprising a blockchain and a world state. The certified checkpoint enables a third party to recognize and verify that the ledger has integrity, a known starting state, and immutability properties starting at a specific point in time. Certification means that all of the validating peers reached consensus on the state of the ledger at that point in time. Thus, the certified checkpoint state represents an agreed-upon state, and that one or more subsequent operations on the ledger are relative to that agreed-upon state. Preferably, before a checkpoint is certified, it must be consistent, meaning that all validating peers have reached the same value for the checkpoint. Preferably, the checkpoint is a compression of the current blockchain world state into a compact representation (e.g., a hash) of the ledger that based on an agreed-upon consensus protocol is consistent across the (validating) peers.

Blockchain checkpoints and certified checkpoints

A certified checkpoint is provided for a ledger comprising a blockchain and a world state. The certified checkpoint enables a third party to recognize and verify that the ledger has integrity, a known starting state, and immutability properties starting at a specific point in time. Certification means that all of the validating peers reached consensus on the state of the ledger at that point in time. Thus, the certified checkpoint state represents an agreed-upon state, and that one or more subsequent operations on the ledger are relative to that agreed-upon state. Preferably, before a checkpoint is certified, it must be consistent, meaning that all validating peers have reached the same value for the checkpoint. Preferably, the checkpoint is a compression of the current blockchain world state into a compact representation (e.g., a hash) of the ledger that based on an agreed-upon consensus protocol is consistent across the (validating) peers. The approach also is extended to a permissionless blockchain.

Checkpoints for permissionless blockchains

A certified checkpoint is provided for a ledger comprising a blockchain and a world state. The certified checkpoint enables a third party to recognize and verify that the ledger has integrity, a known starting state, and immutability properties starting at a specific point in time. Certification means that all of the validating peers reached consensus on the state of the ledger at that point in time. Thus, the certified checkpoint state represents an agreed-upon state, and that one or more subsequent operations on the ledger are relative to that agreed-upon state. Preferably, before a checkpoint is certified, it must be consistent, meaning that all validating peers have reached the same value for the checkpoint. Preferably, the checkpoint is a compression of the current blockchain world state into a compact representation (e.g., a hash) of the ledger that based on an agreed-upon consensus protocol is consistent across the (validating) peers. A technique to certify a blockchain checkpoint also is described.

Auditing certified blockchain checkpoints

Dynamic multi-factor authentication challenge selection is provided. A risk associated with an operation that requires authentication of a user of a client device is determined. A plurality of authentication methods is identified. Each respective authentication method associated with a level of security offsetting the risk and a computing cost associated with a respective authentication method. One or more authentication methods are selected from the plurality of authentication methods according to the risk and to minimize the computing cost associated with authenticating the operation.

Dynamic multi-factor authentication challenge generation

Systems and methods for protecting a data item include, upon initiation of transfer of the data item from a server to a client device, determining a sensitivity score and a current protection, level of the data item. A policy is applied to determine an appropriate protection for the data item based upon the sensitivity score and the current protection level. A protected data item is provided to the client device by applying the appropriate protection to the data item.

System and method to provide server control for access to mobile client data

Authenticating a user is provided. A decryption key corresponding to an authentication account of the user of a client device and authentication credential data obtained from the user of the client device is received during authentication. Encrypted authentication credential data corresponding to the user is decrypted using the received decryption key corresponding to the authentication account of the user. The decrypted authentication credential data is compared with the received authentication credential data to authenticate the user of the client device.

Protection and verification of user authentication credentials against server compromise

Dynamic risk communication associated with a computer device may include automatically detecting one or more security risk factors for the computer device based on current context information associated with the computer device. Whether an attempt is being made via the computer device to manipulate the one or more risk factors in an attempt to reduce a security level of a computer-implemented authentication procedure may be determined. Responsive to determining that the attempt is being made to manipulate the one or more risk factors, a new challenge for additional identification may be communicated for presentation on a user interface device of the computer device while suppressing one or more security risk factors from being presented on the user interface device. Responsive to determining that an attempt is not being made to manipulate the one or more risk factors, the new challenge and one or more security risk factors may be communicated.

Suppression of authorization risk feedback to mitigate risk factor manipulation in an authorization system

Distribution of verification of passwords for electronic account. Password verification is distributed (divided) across multiple entities to reduce potential exposure in the event of a server exposure.

Distributed password verification

Embodiments include a network data collection and response system for enhancing security in an enterprise network providing a user-supplied computing device with access to the network. A network data collection and response system tracks network activity of the device and maintains a device inventory recording the device type and configuration information for the device along with a resource utilization profile for the device. The network data collection and response system detects high-risk or unauthorized network activity involving the device through passive monitoring without utilization of a data monitoring agent installed on the device and implements a response action to mitigate the high-risk or unauthorized network.

Network data collection and response system

Generating a behavior profile is provided. A newness score is calculated for a data point corresponding to a context of an access request to a resource made by a user of a client device. Newness scores for a plurality of data points corresponding to contexts of a plurality of access requests are aggregated to form an aggregated newness score. In response to determining that the aggregated newness score is greater than or equal to a pre-defined newness score threshold, data points stored in a data point cache and a long-term storage are used to generate a new behavior profile for the user or update an existing behavior profile for the user.

Adaptive behavior profiling and anomaly scoring through continuous learning

Growing community of inventors

Somers, NY, United States of America

Lawrence H Koved