International Business Machines Corporation

Mark Elliott Hack

Lokesh M Gupta

Matthew G Borlick

Todd Charles Sorenson

Larry Juarez

Andrew Dunshea

Jos Manuel Accapadi

Micah Robison

Agustin Mena, Iii

Michael Paul Groover

Thomas Fiege

Mathew Accapadi

Herve G P Andre

Brian Anthony Rinaldi

Michael Jay Shapiro

Louis Bennie Capps, Jr

Enrique Q Garcia

Mysore Sathyanaranyana Srinivas

Mysore Sathyanarayana Srinivas

Gordon David McIntosh

Steven Paul Hartman

Ricardo Sedillos Padilla

Kanisha Patel

David Lee Randall

Yolanda Colpo

John Charles Elliott

Alongkorn Kitamorn

David R Willoughby

Ronald David Martens

George John Dawkins

Michael Stephen Williams

Matthew D Carson

Milton Devon Miller, Ii

Ashwini Kulkarni

Jiwu Duan

Matthew Accapadi

Warren W Grunbok

Alistair Leask Symon

Rosana Ramos Morales

Described are techniques for a secure roles-based access control (RBAC) setup during boot of a connected computational system. The techniques include a method comprising deploying a preconfigured default user profile during booting of a computational system. The techniques further include creating, using the preconfigured default user profile, a plurality of user profiles having administrator and/or root authorities, where each of the plurality of user profiles is associated with a respective custom password. The techniques further include completing booting of the computational system using the plurality of user profiles having the administrator and/or root authorities.

Secure preconfigured profile for role-based access control setup

Aspects of the present disclosure relate to encryption management. A determination can be made whether an encryption algorithm is at-risk. In response to determining that the encryption algorithm is at-risk, data protected by the encryption algorithm can be identified. A security action can then be executed on the data protected by the encryption algorithm.

Encryption management

Aspects of the present disclosure relate to encryption management. An indication of a data set to be tagged with an encryption tag is received. A location for the encryption tag is determined. The encryption tag is stored at the location, where the encryption tag includes an encryption status indicator specifying whether or not the data is encrypted and an encryption algorithm indicator specifying an encryption algorithm used to encrypt the data.

Dynamic compression with dynamic multi-stage encryption for a data storage system in accordance with the present description includes, in one aspect of the present description, preserves end-to-end encryption between a host and a storage controller while compressing data which was received from the host in encrypted but uncompressed form, using MIPs and other processing resources of the storage controller instead of the host. In one embodiment, the storage controller decrypts encrypted but uncompressed data received from the host to unencrypted data and compresses the unencrypted data to compressed data. The storage controller then encrypts the compressed data to encrypted, compressed data and stores the encrypted, compressed data in a storage device controlled by the storage controller. Other aspects and advantages may be realized, depending upon the particular application.

Dynamic compression with dynamic multi-stage encryption for a data storage system

Provided are a computer program product, system, and method for using public keys provided by an authentication server to verify digital signatures. A plurality of public keys from a plurality of public-private key pairs and stored in a local key store. A request is received to access computational resources in the system. A challenge is returned in response to the request. A response to the challenge is received comprising a purported digitally signed challenge. A determination is made as to whether the purported digitally signed challenge is verified using a first public key of the public keys in the local key store. A determination is made as to whether the purported digitally signed challenge is verified using a second public key of the public keys in the local key store in response to determining that the first public key did not verify the purported digitally signed challenge.

Using public keys provided by an authentication server to verify digital signatures

Provided are a computer program product, system, and method for generating public/private key pairs to deploy public keys at computing devices to verify digital signatures. A plurality of public-private key pairs are generated to store in a key store. A set of public keys of the public-private key pairs is distributed to the computing systems to use to verify purported digitally signed challenges. One of the public-private key pairs is selected to use a private key of the selected one of the public-private key pairs as a current private key to use to digitally sign challenges from the computing systems. A determination is made to retire the current private key. Another one of the public-private key pairs is selected and the current private key is set to a private key of the selected another one of the public-private key pairs to use to digitally sign challenges from the computing systems.

Generating public/private key pairs to deploy public keys at computing devices to verify digital signatures

Provided are a computer program product, system, and method for embedding and executing trace functions in code to gather trace data. A plurality of trace functions are embedded in the code. For each embedded trace function, a trace level is included indicating code to which the trace applies. The trace level comprises one of a plurality of levels. During the execution of the code, the embedded trace functions having one of the levels associated with a specified at least one level specified are executed. The embedded trace functions associated with at least one level not comprising one of the at least one specified level are not invoked.

Embedding and executing trace functions in code to gather trace data

Provided are a computer program product, system, and method for adjusting an extended power line disruption time and end-of-life for at least one battery backup unit used in a system. A request is received to change from a first extended power line disruption time currently used in the system to a second extended power line disruption time. A first end-of-life and a second end-of-life correspond to the first extended power line disruption time and the second extended power line disruption time, respectively. A message is sent to a power distribution unit with information on the second extended power line disruption time to cause the power distribution unit to initiate a graceful shutdown of the system after power is supplied from the at least one battery backup unit for the second extended power line disruption time.

Adjusting an extended power line disruption time and end-of-life used for at least one battery backup unit in a system

A method for dynamically changing system recovery actions based on system load. The method includes measuring a value of a workload characteristic of a computer system over a period of time, detecting an error in the computer system, determining a workload level of the computer system, and selecting a set of error recovery actions in response to the system workload analysis module determining the workload level of the computer system. A workload characteristic defines a type of work performed by the computer system. A workload level can be based on user defined parameters or a measurement of the value of one or more workload characteristics.

System, apparatus, and method to dynamically change system recoveries based on system load

A computer program product for scheduling threads in a multiprocessor computer comprises computer program instructions configured to select a thread in a ready queue to be dispatched to a processor and determine whether an interrupt mask flag is set in a thread control block associated with the thread. If the interrupt mask flag is set in the thread control block associated with the thread, the computer program instructions are configured to select a processor, set a current processor priority register of the selected processor to least favored, and dispatch the thread from the ready queue to the selected processor.

Computer program product for scheduling ready threads in a multiprocessor computer based on an interrupt mask flag value associated with a thread and a current processor priority register value

Methods, systems, and computer program products are provided for scheduling threads in a multiprocessor computer. Embodiments include selecting a thread in a ready queue to be dispatched to a processor and determining whether an interrupt mask flag is set in a thread control block associated with the thread. If the interrupt mask flag is set in the thread control block associated with the thread, embodiments typically include selecting a processor, setting a current processor priority register of the selected processor to least favored, and dispatching the thread from the ready queue to the selected processor. In some embodiments, setting the current processor priority register of the selected processor to least favored is carried out by storing a value associated with the highest interrupt priority in the current processor priority register.

Scheduling threads in a multiprocessor computer

Growing community of inventors

Austin, TX, United States of America

Mark Elliott Hack