International Business Machines Corporation

Other

Linwood Hugh Overby, Jr

Patricia Ann Jakubik

David John Wierbowski

Roy Frank Brabson

Bala Rajaraman

James Russell Godwin

Patrick Michael Livecchi

Lynn Douglas Long

Joyce Anne Porter

Scott Allan Campbell

Kira Sterling Attwood

Dinakaran B Joseph

Lap Thiet Huynh

Michael G Fitzpatrick

Constantinos Kassimis

Mark Richard Gambino

Gary Owen McAfee

Andrew Hilliard Arrowood

Wesley McMillan Devine

Sivaram Gottimukkala

Andrea Lynn Fitzpatrick

Gerd Breiter

Michael Man Behrendt

Christopher Meyer

Scott Christopher Moonen

Adolfo Francisco Rodriguez

Barry Mosakowski

Michael S Law

Anthony Ffrench

Curtis Matthew Gearhart

Dale C Gugliotta

David Aro Bruton, Iii

Masashi E Miyake

Chien-En Sun

Richard Allen Wenklar

Brian Sean Perry

Arthur James Stagg

Balachandar Rajaraman

Louis Frank Menditto

David Andrew Jones

Wuchieh James Jong

Kevin J Cunningham

Frederic Duminy

Paul Reichl

A method for secure live migration of a virtual machine (VM) in a virtualized computing environment can include selecting a VM in a secure virtualized computing environment for live migration to a different virtualized computing environment and blocking data communications with the selected VM and other VMs in the secure virtualized computing environment. The selected VM can be live migrated to the different virtualized computing environment and the VM can be restarted in the different virtualized computing environment. Notably, a secure communicative link can be established between the restarted VM and at least one other of the VMs in the secure virtualized computing environment. Finally, data communications between the restarted VM and the at least one other of the VMs can be enabled over the secure communicative link.

Securing live migration of a virtual machine including blocking communication with other virtual machines

Embodiments of the present disclosure relate to automatically and dynamically elevating permissions on a mainframe system. Initially, a user may request an elevation class which corresponds to elevated class resources of the mainframe system. The elevation class may enable the user to perform actions to datasets, files, applications, or systems of the mainframe system the user may not otherwise be able to perform. If the user has permission to the elevation class, a user identification corresponding to the user and the elevation class is registered in an elevated permission structure. An access control environment element (ACEE) is dynamically created with the elevated permission structure and the elevated class resources of the elevation class are associated with the ACEE. The user can then be validated with access to the elevated class resources. At the expiration of a limited duration of time, the elevated class resources are automatically disassociated with the ACEE.

Method to dynamically elevate permissions on the mainframe

A method, apparatus and computer program product for improved load balancing provides for the grouping under a same workload of both application instances in an application tier, and data sharing members in a data tier. This grouping enables a workload manager to make recommendations (to load balancer appliances) about how to distribute workload connections, e.g., based on metrics gathered from both the application and data tiers. In this approach, both applications and data sources are grouped into a workload grouping, and health, status and capacity information about both of these tiers (application and data) is then used to determine an overall distribution policy for the workload. These different tiers can reside on the same or different operating system environments.

Combining application and data tiers on different platforms to create workload distribution recommendations

An application deployed in a public cloud is enabled to access an on-premises resource securely and without requiring additional ports on a firewall. A pair of security gateways is instantiated, one at the cloud, and another located on-premises. Each gateway can access information that is necessary to locate and establish a secure connection to the on-premises resource. In response to a determination that the application needs to access the on-premises resource, the data set is used to locate the resource. A communication request is then issued from the cloud gateway to the on-premises gateway over a socket-based communication channel established between the gateways. The communication request is sent over an HTTP-based protocol such that the application is able to access the on-premises resource without requiring an additional IP address/port to be defined at the firewall. Proxied connectivity is then enabled from the application to the on-premises resource.

Enabling an on-premises resource to be exposed to a public cloud application securely and seamlessly

A method that provides for the grouping under a same workload of both application instances in an application tier, and data sharing members in a data tier. This grouping enables a workload manager to make recommendations (to load balancer appliances) about how to distribute workload connections, e.g., based on metrics gathered from both the application and data tiers. In this approach, both applications and data sources are grouped into a workload grouping, and health, status and capacity information about both of these tiers (application and data) is then used to determine an overall distribution policy for the workload. These different tiers can reside on the same or different operating system environments.

Preventing duplicate sources in a network that uses network address port translation on an established connection. In response to receiving an inbound packet at a destination host, input values are obtained therefrom and used to consult a mapping. If no match is found, a translation is performed, whereby a determination is made as to whether or not a port number is available within a range of port numbers that comply with a security association governing the connection. If so, an available port number is assigned to the connection, thereby avoiding a possibility of a duplicate source. If a port number is not available, the packet is rejected.

Preventing duplicate sources from clients served by a network address port translator

A network node for communicating data packets secured with a security protocol over a communications network includes a host information handling system (IHS) and one or more external security offload devices coupled by a secure data link. The host IHS communicates state information about data packets, and the external offload security device provides stateless secure data encapsulation and decapsulation of packets using a security protocol. An external network interface controller or internal network interface controller communicates encapsulated data packets over the communications network to a final destination. Encapsulation and decapsulation of packets by the external security offload device reduces network latency and reduces the computational load on the processor in the host IHS. Maintaining state information in the host IHS allows hot-swapping of external security offload devices without information loss. The external security offload device may be included in a firewall, or intrusion detection device, and may implement IPsec protocol.

Network node with network-attached stateless security offload device employing out-of-band processing

Preventing duplicate sources on a protocol connection that uses network addresses, protocols and port numbers to identify connections that include port number translation. In response to an inbound IPsec packet from a remote source client, a determination is made as to whether or not a port number is available within a range of port numbers that comply with a security association governing the connection. If so, an available port number is assigned to the connection, thereby avoiding a possibility of a duplicate source. If a port number is not available, the packet is rejected.

The invention detects a denial of service attack at a node by monitoring the number of discarded packets in relationship to the number of inbound packets. When an attack is detected, relevant inbound packet information is collected during the attack to help characterize the attack and at least to pinpoint the source of the last hop to the attacked node.

Technique of detecting denial of service attacks

A computer-implemented method of enabling security in network resources provisioned as part of a service landscape instance is provided. The method includes initiating an orchestration process for creating a landscape service instance to provide services to a service subscriber over a data communications network. The method further includes deriving from the orchestration process at least one parameter, and generating at least one security configuration profile based upon the at least one parameter for at least one system of the landscape service instance.

Method of automating and personalizing systems to satisfy security requirements in an end-to-end service landscape

A computer-implemented method is provided for updating network security policy rules when network resources are provisioned in a service landscape instance. The method includes categorizing network resources in a service landscape instance based on a service landscape model. The method further includes responding to the provisioning of a network resource by automatically generating one or more security policy rules for a newly-provisioned network resource. Additionally, the method includes updating security policy rules of pre-existing network resources in the service landscape instance that are determined to be eligible to communicate with the newly-provisioned network resource so as to include the newly-provisioned network resource as a remote resource based on the service landscape model.

Method of dynamically updating network security policy rules when new network resources are provisioned in a service landscape

Growing community of inventors

Raleigh, NC, United States of America

Linwood Hugh Overby, Jr