International Business Machines Corporation

Hewlett-packard Development Company, L.p.

Cisco Technology, Inc.

Nuance Communications, Inc.

Compaq Information Technologies Group, L.p.

Mary Ellen Zurko

Olgierd Stanislaw Pieczul

Mark Alexander McGloin

Mustansir Banatwala

Steven A Bade

Patrick Joseph O'Sullivan

Ruthie D Lyle

Gary Denner

George Robert Blakley, Iii

Cynthia E Barber-Mingo

Harold Moss

Morrie Gasser

Robert Leslie Yates

Andrew Halstead Mason

Harold B Moss, Iii

Clifford Earl Kahn

Judith Shelhorse Hall

Steven B Lipner

Paul Douglas Sawyer

Leslie Richard Kendall

Thomas Andrew Casey, Jr

Joseph Celi, Jr

Christopher Joseph Paul

Satwiksai Seshasai

Charles P De Saint-Aignan

Robert M Congdon

David J Toth

Brett J Gavagni

David S Kern

Mary Elizabeth Raven

Razeyah Stephen

Mariusz Pajecki

Jonathan Mayer Sobel

Jamie Taylor

Brent Allan Hepburn

Mark M McGloin

Jason A Young

Isabela Pogorzelska-Pieczul

Prashant S Kulkarni

Carl Bruggeman

Vernoica Morales

Veronica Morales

Managing file distribution in an online file sharing system implemented by at least one server includes inviting a first entity to access a shared file hosted by the online file sharing system, and allowing the first entity to reshare the shared the through the online file sharing system with at least a second entity only to an extent permitted by a resharing policy stored by the online file sharing system.

File resharing management

A query for a tag within the collaborative tagging system is received. The query can specify at least one attribute of the tag and a particular selected artifact, wherein the attribute includes a security level of a user who created the tag. Tag records that match the query can be determined as query results. Access control privileges can be applied to the query results. Applying the access control privileges can include filtering the tag records by removing tag records that have an assigned security level exceeding a security level of a user that initiated the query. At least a portion of each tag record in the query results that has a security level that does not exceed the security level of the user that initiated the query can be written to a display.

Employing organizational context within a collaborative tagging system

A computer-implemented method of employing organizational context within a collaborative tagging system can include receiving at least one tag for an artifact from a user, determining at least one attribute of the user, and storing a tag record including the tag, the attribute of the user, and an association of the tag with the artifact.

A technique to provide runtime output sanitization filtering of web application content that contains multiple contexts in which dynamic output is included. To facilitate this operation, dynamically-generated content is prepared for sanitization in advance, preferably by being 'marked' by the web application itself (or by middleware). Preferably, given dynamically-generated content is marked by enclosing it between dynamic content indicators. After the document generation is completed but before it is output, the application-generated content is processed by a content sanitization filter. The filter uses the dynamic content identifiers to identify and locate the content that needs output escaping. The filter detects the appropriate context within which the dynamically-generated content has been placed and applies escaping. The output content is prepared for escaping in advance even if assembled from multiple sources that do not operate in the same runtime environment.

Method and apparatus for context-aware output escaping using dynamic content marking

Method and apparatus for dynamic content marking to facilitate context-aware output escaping

Embodiments of the present invention provide a method, system and computer program product for supporting weak password authentication in a multi-user application environment. In an embodiment of the invention, a method for supporting weak password authentication in a multi-user application environment can be provided. The method can include acquiring log in data for a log in attempt by an end user amongst end users in a multi-user application. The method also can include messaging the log in data to others of the end users for subjective analysis by the others of the end users in detecting an unauthorized log in attempt.

Weak password support in a multi-user environment

Source code verification, including receiving a declaration of a variable as a secret type, determining if any source code is configured to use the variable as a type other than secret, and if it is determined that there is source code that will use the variable as a type other than secret, creating an exception in the source code verification process.

Securing secret information in source code verification and at runtime

A rich client performs single sign-on (SSO) to access a web- or cloud-based application. According to the described SSO approach, the rich client delegates to its native application server the task of obtaining a credential, such as a SAML assertion. The native server, acting on behalf of the user, obtains an assertion from a federated identity provider (IdP) that is then returned to the rich client. The rich client provides the assertion to a cloud-based proxy, which presents the assertion to an identity manager to attempt to prove that the user is entitled to access the web- or cloud-based application using the rich client. If the assertion can be verified, it is exchanged with a signed token, such as a token designed to protect against cross-site request forgery (CSRF). The rich client then accesses the web- or cloud-based application making a REST call that includes the signed token. The application, which recognizes the request as trustworthy, responds to the call with the requested data.

Method and system for authenticating a rich client to a web or cloud application

An information sharing paradigm for a cloud computing solution enables flexible organizational boundaries with respect to cloud resources. Cloud service customers manage their own organization boundary but can extend that boundary selectively by associating cloud resources they own with sets of domain names that may be associated with requests for cloud resources that the organization may be willing to share with other organizations that are using the cloud environment, and by ensuring that any such requests for resources that are shared in this manner are associated with one or more message handling policies that have been defined by (or otherwise associated with) the resource-owning organization. Cloud resources owned by an organization (even those marked as 'internal only') may be selectively shared with one or more other organizations using the cloud environment depending on the domain names associated with the requests. Message handling policies are enforced with respect to shared resources.

Extending organizational boundaries throughout a cloud architecture

Managing file distribution in an online file sharing system implemented by at least one server includes inviting a first entity to access a shared file hosted by the online file sharing system, and allowing the first entity to reshare the shared file through the online file sharing system with at least a second entity only to an extent permitted by a resharing policy stored by the online file sharing system.

These and other objectives are attained with a method and system for evaluating an access policy change. The method comprises the step of providing an access control mechanism having a first policy, and an audit log having entries of accesses made under that first policy. The method comprises the further steps of submitting a second policy to the access control mechanism, comparing the log entries to the second policy, and based on the results of the comparing step, taking one of a predetermined number of actions.

Retrospective policy safety net

An embodiment of the invention includes initially registering information with a data system, wherein the registered information pertains to a user of a mobile device and includes credential information, and further includes a message address associated with the user. An enrollment request, together with the specified credential information, is sent to a management server. Responsive thereto, the server sends a message of specified type to the message address associated with the user, wherein such message includes a pin code. The pin code is then sent from the device to the server, and responsive to receiving the pin code, the server is operated to deliver a security token, for use in authenticating the mobile device to selectively access the particular data processing system.

Mobile device identification for secure device access

A web application user is authenticated directly upon selecting a link in a notification email. In this approach, the user's web browser stores a first data string provided by the web application (e.g., in a cookie) during a prior session. The first data string encodes first data about the user that can be verified by the application. Later, the user receives the notification email that includes the link. The link encodes a second data string from which second data about the user can be verified by the application. When the end user selects the link, an authentication request is transmitted to the application. The authentication request includes both the first and second data strings. If both the first data and the second data (as obtained from their respective data strings) can be verified, the user is authenticated without having to perform any additional steps (e.g., manual entry of credentials).

Safe auto-login links in notification emails

Growing community of inventors

Groton, MA, United States of America

Mary Ellen Zurko