International Business Machines Corporation

Lenovo (singapore) Pte. Ltd.

Masana Murase

Kanna Shimizu

Wilfred Edmund Plouffe, Jr

Vladimir Zbarsky

Sanehiro Furuichi

Masaharu Sakamoto

Hideaki Komatsu

Seiichi Kawano

Takeo Yoshizawa

Kumiko Maeda

Munehiro Doi

Hassan Hajji

Tasuku Otani

Shivkumar Kalyanaraman

Susumu Shimotono

Noboru Kamijo

Toru Aihara

Shu Shimizu

Koichi Kamijo

Alwyn R Lobo

Gang Zhang

Yuriko Sawatani

Kiran Appasaheb Kate

Taskuku Otani

Yuriko Kanai

Susumu Shimetono

Methods and arrangements for processing face-to-face mobile phone transactions. An agreed-upon price for a product is accepted from a buyer mobile phone and a seller mobile phone. Distinct random numbers are assigned to each of the buyer and seller mobile phones. The random number assigned to the seller mobile phone is received from the buyer mobile phone, and the random number assigned to the buyer mobile phone is received from the seller mobile phone. A match is ascertained between the buyer and seller mobile phones based on receipt from the buyer mobile phone the random number assigned to the seller mobile phone and receipt from the seller mobile phone the random number assigned to the buyer mobile phone.

Systems and methods for face-to-face mobile phone mercantile transactions

Traffic data while the system is in operation is collected for a certain time as a preprocess. Typical patterns are extracted from the collected traffic data. Next, stream programs are created for the individual typical patterns and stored for the future reference. Next, the IDs of alternative tasks for transition among different stream programs are stored. In actual system operation, the system measures traffic data regularly or at any time, compares the resultant patterns with the typical patterns, and selects a stream program corresponding to the closest typical pattern as the next phase. Program shutdown time when shifting from the stream program in the present phase to the next phase can be reduced by gradually shifting empty tasks in the present phase to the next stream program as alternative tasks in consideration of the cost of switching between tasks, the cost of transferring data among resources, and so on.

Computer system, method, and program

A technique for increasing the speed of parallel running of logical processes without sacrificing the accuracy of data update timing in a parallel discrete event simulation system. A logical process involving a longer receiving time lag than that of sending is executed by an amount of initial shift for a predetermined period before the simulation. The initial shift is set to be one-half of a value of difference between the receiving time lag and the sending time lag. The logical process executed with timing displaced by the amount of initial shift runs by exchanging null messages with each other. Each null message is delivered to a correspondent logical process after the predetermined time lag, and each logical process further sends the correspondent logical process a null message upon receipt of the null message. Thus, there is a progression of simulation by synchronizing them through the null messages.

Simulation execution method, program, and system

A server apparatus includes: an output detector for detecting output-processing which is processing of outputting data from the application program into a shared area; and an output control section for storing instruction information in the shared area, instead of storing the output data outputted from the application program therein, in response to the detection of the output-processing, the instruction information specifying an acquisition method by which an authorized client apparatus acquires the output data. The client apparatus includes: a reading detection section for detecting reading-processing which is processing of reading data from the shared area; and a reading control section which reads the instruction information from the shared area in response to the detection of the reading-processing, and which acquires the output data by the acquisition method specified by the instruction information.

System for preventing unauthorized acquisition of information and method thereof

Whenever a drawing command is executed, a computer system having a graphic user interface such as a multi-window system determines, from the logical operation pattern of the drawing command, what kind of information is inherited by a drawing result from the drawing command, preferably without performing a complicated step such as an image process. At the same time, the computer system controls information flow of an image outputted to a screen by managing labeled area maps which correspond one to one to images on the screen and in a memory.

System, method and program for protecting information on computer screen

A method, computer program product, and data processing system for protecting sensitive program code and data (including persistently stored data) from unauthorized access. Dedicated hardware decrypts an encrypted kernel into memory for execution. When an application is to be executed, the kernel computes one or more secrets by cryptographically combining information contained in the application with secret information contained in the kernel itself. The kernel then deletes its secret information and passes the computed secrets to the application. To store data persistently in memory, the application uses one of the computed secrets to encrypt the data prior to storage. If the kernel starts another instance of the same application, the kernel (which will have been re-decrypted to restore the kernel's secrets) will compute the same one or more secrets, thus allowing the second application instance to access the data encrypted by the first application instance.

Application-specific secret generation

A system including a server apparatus executes an application program and a client apparatus enabling a user to utilize the application program by communicating with the server apparatus based on an instruction of the user. The server apparatus includes: an output detection section for detecting output-processing which is processing of outputting data from the application program into a shared area; and an output control section for storing instruction information in the shares area, instead of storing the output data outputted from the application program therein, in response to the detection of the output-processing, the instruction information specifying an acquisition method by which an authorized client apparatus acquires the output data. The client apparatus includes: a reading detection section for detecting reading-processing which is processing of reading data from the shared area; and a reading control section which reads the instruction information from the shared area in response to the detection of the reading-processing, and which acquires the output data by the acquisition method specified by the instruction information.

A method, computer program product, and data processing system are disclosed for ensuring that applications executed in the data processing system originate only from trusted sources are disclosed. In a preferred embodiment, a secure operating kernel maintains a 'key ring' containing keys corresponding to trusted software vendors. The secure kernel uses vendor keys to verify that a given application was signed by an approved vendor. To make it possible for users to execute software from independent software developers, an administrative user may disable the above-described vendor key-checking as an option.

Secure policy differentiation by secure kernel design

An information processing apparatus includes a storage device having an access-restricted area accessible if the password is properly authenticated and an access-unrestricted area accessible regardless of whether or not the password is authenticated. The information processing apparatus allows a password to be registered in a registration server beforehand, prompts a user to enter the password when accessing the access-restricted area and, if the password is not entered, reads from the access-unrestricted area a password retrieval program for retrieving the password from the registration server, activates and executes the password retrieval program to retrieve the password from the registration server, and causes the storage device to authenticate the retrieved password to place the access-restricted area in an accessible state.

Secure and convenient access control for storage devices supporting passwords for individual partitions

A method, computer program product, and data processing system are disclosed for ensuring that applications executed in the data processing system originate only from trusted sources are disclosed. In a preferred embodiment, a secure operating kernel maintains a 'key ring' containing keys corresponding to trusted software vendors. The secure kernel uses vendor keys to verify that a given application was signed by an approved vendor. To make it possible for independent developers to develop software for the herein-described platform, a 'global key pair' is provided in which both the public and private keys of the pair are publicly known, so that anyone may sign an application with the global key. Such an application may be allowed to execute by including the global key pair's public key in the key ring as a &#x201c;vendor key&#x201d; or, conversely, it may be disallowed by excluding the global public key from the key ring.

Support for multiple security policies on a unified authentication architecture

A method, system, and computer-usable medium are disclosed for controlling unauthorized access to encrypted application program code. Predetermined program code is encrypted with a first key. The hash value of an application verification certificate associated with a second key is calculated by performing a one-way hash function. Binding operations are then performed with the first key and the calculated hash value to generate a third key, which is a binding key. The binding key is encrypted with a fourth key to generate an encrypted binding key, which is then embedded in the application. The application is digitally signed with a fifth key to generate an encrypted and signed program code image. To decrypt the encrypted program code, the application verification key certificate is verified and in turn is used to verify the authenticity of the encrypted and signed program code image. The encrypted binding key is then decrypted with a sixth key to extract the binding key. The hash value of the application verification certificate associated with the second key is then calculated and used with the extracted binding key to extract the first key. The extracted first key is then used to decrypt the encrypted application code.

Method to protect secrets against encrypted section attack

A boot block that contains a first public key is activated and a system Basic Input/Output System (BIOS) that contains a second public key and a first digital signature is verified, the verifying being performed by confirming that the first and second public keys match. In response to a determination that the first and second public keys match, the BIOS is activated and a system image is loaded to a real device. The system image is verified by confirming that the first digital signature that is stored in the system BIOS matches a second digital signature that is stored in a mass storage device. In response to the first and second digital signatures matching, a virtual mass storage device is created. Control of the virtual mass storage device is transferred to a boot strap code in an operating system image and the operating system image is booted from the virtual mass storage device.

Information processing system, program product, and information processing method

A method of invoking power processor element (PPE) serviced C library functions on a synergistic processing element (SPE) running in isolated mode. When the SPE initiates a PPE-serviced function, an SPE stub routine allocates a parameter buffer in an open area of a local store (LS) memory within the SPE. The LS memory includes an open area accessible to the PPE, and an isolated area inaccessible to the PPE. The SPE stub routine copies function parameters corresponding to the PPE-serviced function to a buffer within the open area of the LS memory, and writes a message word, which contains an identification variable of the PPE-serviced function and a location variable of the function parameters, to the open area. When execution is temporarily suspended on the SPE, the PPE reads the message word from the open area of the LS memory and executes the PPE-serviced function.

Invoking externally assisted calls from an isolated environment

A method, computer program product, and data processing system for executing larger-than-physical-memory applications while protecting sensitive program code (and also data) from unauthorized access in a memory space not subject to protection fault or page fault detection are disclosed. Large applications are accommodated by providing a mechanism for secure program overlays, in which a single large application is broken into two or more smaller applications (overlays) that can be executed from the same memory space by overwriting one of the smaller applications with another of the smaller applications when the latter needs to be executed. So that the data may be shared among these smaller applications, each of the applications contains embedded cryptographic keys, which may be used to encrypt or decrypt information to be stored persistently while control is transferred from one application to the other.

Growing community of inventors

Yokohama, Japan

Masana Murase