International Business Machines Corporation

University of Limerick

Mark Alexander McGloin

Olgierd Stanislaw Pieczul

Joseph Celi, Jr

Mary Ellen Zurko

David S Kern

Juan Galiana Lara

Brent Allan Hepburn

Fang Lu

William M Quinn

Andrew T Penrose

Russell Holden

John Douglas Curtis

Brendan P Arthurs

Stuart J Clifford

Peter Otto Mierswa

Emmet R Clifford

Shadi Ghaith

Harshita Nersu

Bashar Nuseibeh

Sorren Hanvey

Jesus Garcia Galan

Matthieu Connan

Kiransingh Ghoorbin

David Manning

Mark Lawrence Rovelli

Ralph L Topete

Kamil Stepinski

Embodiments of the present invention include determining whether a cryptographic certificate can be trusted. A cryptographic certificate is received at a client device. The client device performs a first check on a first set of attributes of the cryptographic certificate. In addition, the client device sends the cryptographic certificate to a central verification server, which performs a second check on a second set of attributes of the cryptographic certificate. In the case that the first set of attributes passes the first check, and the second set of attributes passes the second check, the client device determines that the cryptographic certificate can be trusted.

Determining trustworthiness of a cryptographic certificate

A malware detection method for detecting client participation in malware activity, in respect of a target subjected to a given attack by a client system, which is operable to run a given host application is disclosed a given security service provider is configured, which is operably coupled to the client system, to make accessible given attack information that is reported by a given attack target. An attack status query is transmitted to the security service provider from an agent that is operably coupled to the client system. In response to receiving the attack status query, the security service provider is configured to send attack information reported in respect of a given attack target to the agent, and configuring the agent to diagnose whether its corresponding client system potentially comprises an attack source of the given attack subjected on the attack target, on a basis of the received attack information.

System and method for detecting client participation in malware activity

Concepts for linking source code with compliance requirements are presented. One example comprises analyzing a set of compliance requirements to identify one or more compliance topics. The example further comprises determining keywords for the identified one or more compliance topics. An item of source code is then analyzed to identify occurrences of the keywords in the source code. Mapping information representing a relationship between the item of source code and the compliance requirements is then generated based on the identified occurrence of the keywords.

Linking source code with compliance requirements

Embodiments of the present invention provide systems and methods for self-certification by a developer that the software components used during development are used in a secure manner, through the use of annotations. Input and return conditions are defined in an annotation for the software components of a system. The input and return conditions are compared for a match and a warning is generated when the input and return conditions do not match.

Annotations in software development

A method and associated systems for isolating a source of an attack that originates from a shared computing environment. A computer-security system tags outgoing packets originating from within the shared computing environment in a tamper-proof manner in order to identify which tenant of the shared environment is the true source of each packet. If one of those tenants transmits malicious packets to an external recipient, either because the tenant has malicious intent or becomes infected with malware, the transmitted malicious packets' tags allow the recipient to determine which tenant is the source of the unwanted transmissions. The recipient may then block further communications from the problematic tenant without blocking communications from other tenants of the shared environment.

Isolating a source of an attack that originates from a shared computing environment

A technique to provide runtime output sanitization filtering of web application content that contains multiple contexts in which dynamic output is included. To facilitate this operation, dynamically-generated content is prepared for sanitization in advance, preferably by being 'marked' by the web application itself (or by middleware). Preferably, given dynamically-generated content is marked by enclosing it between dynamic content indicators. After the document generation is completed but before it is output, the application-generated content is processed by a content sanitization filter. The filter uses the dynamic content identifiers to identify and locate the content that needs output escaping. The filter detects the appropriate context within which the dynamically-generated content has been placed and applies escaping. The output content is prepared for escaping in advance even if assembled from multiple sources that do not operate in the same runtime environment.

Method and apparatus for context-aware output escaping using dynamic content marking

Method and apparatus for dynamic content marking to facilitate context-aware output escaping

An authentication channel is established between a mobile device and a transaction terminal that uses a keypad for access control. The terminal keypad is assumed to be untrusted, whereas the mobile device has a trusted interface that only the device user can access and use. The transaction terminal includes a short-range communication device, and a keypad interface application configured to communicate with an external keypad device in lieu of the transaction terminal's own keypad. The mobile device includes a mobile app. In response to detecting a user access request, a handshake protocol is performed between the keypad interface application in the transaction terminal and the keypad interface function in the mobile device. If the handshake protocol succeeds, the user is notified that the transaction terminal is trusted. The user then enters his or her password and/or PIN on the mobile device in lieu of direct entry via the terminal keypad.

Mobile device-based keypad for enhanced security

An email filter updating system includes a tracking component, and a logic component. The tracking component is provided to track user navigation. This tracking compiles information about websites the user has visited and presumably may 'trust' in the event an email associated with one such site or application is later received by the user's email application. The logic component uses information and a set of configurable rule-based criteria to output a characterization that a particular email message has been initiated from a site that the user has visited or should otherwise trust. The characterization is then provided to the email filter to control whether in-bound email is passed to the user's email client inbox. Further, the logic component is operative to generate filter update commands that update the email filter in an automated manner, i.e., without user input.

Automated spam filter updating by tracking user navigation

A rich client performs single sign-on (SSO) to access a web- or cloud-based application. According to the described SSO approach, the rich client delegates to its native application server the task of obtaining a credential, such as a SAML assertion. The native server, acting on behalf of the user, obtains an assertion from a federated identity provider (IdP) that is then returned to the rich client. The rich client provides the assertion to a cloud-based proxy, which presents the assertion to an identity manager to attempt to prove that the user is entitled to access the web- or cloud-based application using the rich client. If the assertion can be verified, it is exchanged with a signed token, such as a token designed to protect against cross-site request forgery (CSRF). The rich client then accesses the web- or cloud-based application making a REST call that includes the signed token. The application, which recognizes the request as trustworthy, responds to the call with the requested data.

Method and system for authenticating a rich client to a web or cloud application

A method, and an associated computer system and computer program product. A login request is received from a user, to log into a computing resource, wherein the login request includes a password and a user identifier of the user. The received password is compared with a stored password to determine whether to grant access to the computing resource. Responsive to determining that the received password does not match the stored password, an authenticity of the login request is determined, based on one or more characteristics of the user and/or one or more checks performed against the received password. A score is calculated based on the determined authenticity of the login request. The login request is denied. Based on the calculated score, it is decided whether to lock the user and deny the user further access to the computing resource.

Accessing a computing resource

Denial-of-service attacks are prevented or mitigated in a cloud compute environment, such as a multi-tenant, collaborative SaaS system. This is achieved by providing a mechanism by which characterization of 'legitimate' behavior is defined for tenant applications or application classes, preferably along with actions to be taken in the event a request to execute an application is anticipated to exceed defined workflow limits. A set of application profiles are generated. Typically, a profile comprises information, such as a request defined by one or more request variables, one or more 'constraints,' one or more &#x201c;request mappings,&#x201d; and one or more &#x201c;actions.&#x201d; A constraint is a maximum permitted workload for the application. A request mapping maps a request variable to the constraint, either directly or indirectly. The profile information defines how a request is mapped to a workload to determine whether the request is in policy or, if not, what action to take.

Growing community of inventors

Dublin, Ireland

Mark Alexander McGloin