International Business Machines Corporation

Matthew Francis Rutkowski

Thomas Alexander Bellwood

Robert Bryant Chumbley

Jeffrey Bruce Lotspiech

Robert Glenn Deen

Liam S Harpur

Jonathan D Dunne

Travis M Grigsby

Jacob Daniel Eisinger

Christian Lita

Rabindranath Dutta

Julio Eloy Ruano

Merle Douglas Sterling

Michael John Walker

Alexander Tarpinian

Richard Barnett Allen

Hongxia Jin

Robert Carl Barrett

Amal Ahmed Shaheen

Sigfredo Ismael Nin

Leugim A Bustelo

Ronald W Bassett

Julian A Cerruti

Anup Raj Kunwar

KwangYoung Oh

James Edwards

A controller for an emergency response system, a computer program product for an emergency response system, and a method for facilitating rescue One embodiment may comprise a processor coupled to a memory, the memory containing program instructions. The program instructions, when executed on the processor, may cause the controller to collect waypoint data during a user's activity, detect a first trigger event indicating that the user needs assistance, determine a first response plan for an autonomous vehicle (AV) for the first trigger event based on the collected waypoint data, and execute the first response plan.

Emergency response system

A tool for generating an identifier for an electronic device. The tool identifies a target memory segment. The tool accesses the target memory segment utilizing an access procedure. The tool corrupts the target memory segment, wherein corrupting includes exposing the target memory segment to one or more degrading programming cycles with a heightened frequency to degrade and corrupt the target memory segment on the electronic device to cause degradation and corruption of the electronic device, identifying one or more memory locations in the plurality of memory locations that are unused, and marking the one or more memory locations as corruptible. The tool monitors one or more execution behavioral properties, the one or more execution behavioral properties being associated with execution of the access procedure. The tool generates a device identifier based, at least in part, on the one or more execution behavioral properties.

Electronic device identification

A method of generating an identifier for an electronic device, wherein the electronic device includes a processor and a memory. The memory is communicatively coupled to the processor and includes a plurality of memory locations. The method includes identifying a target memory segment. The target memory segment includes a subset of the plurality of the memory locations. The method further includes accessing, by an access procedure, the target memory segment. One or more execution behavioral properties associated with the execution of the access procedure are monitored. A device identifier is generated based on the one or more execution behavioral properties. A computer-implemented method for authenticating the device identifier of an electronic device is also disclosed. Computer systems and computer program products corresponding to the invention are also disclosed.

Provided are techniques to enable, using broadcast encryption, a device to locate a service offered by a server with the knowledge that the service offered by the server is a trusted service. A signed enhanced Management Key Block (eMKB) includes a trusted service locator (TSL) that includes one or more records, or 'trusted service data records' (TSDRs), each identifying a particular service and a corresponding location of the service is generated and transmitted over a network. Devices authorized to access a particular service parse the eMKB for the end point of the service, connect to the appropriate server and transmit a request.

Identifying and locating authenticated services using broadcast encryption

Provided are techniques for the distribution and control of digital content such that Quality of Experience (QoE) is maintained. Content is protected from when the content is encrypted to when it is used. To ensure the QoE of particular content, a content owner embeds a list of required or preferred components that must be employed to render the content. The content owner's list of required or preferred components specifies specific components 'trusted' to correctly process the content. The specified chain of preferred components is compared to possible devices in the system that processes the content. If there are multiple acceptable devices for a specific link, a preference system is employed to determine the device that executed the particular part of the chain. The preference system is based upon a number of factors, such as, but not limited to, performance characteristics, user preferences, expected stability, power requirements and system preferences.

Content protection continuity through authorized chains of components

Tenants in a multi-tenant shared deployment are provided their own distinct key spaces over which they control a key management system. In this manner, virtual key management domains are created on a per-tenant (per-customer) basis so that, whenever a particular customer's data is co-tenanted, stored, transmitted or virtualized in the IT infrastructure of the provider's datacenter(s), it is secured using key management materials specific to that customer. This assures that the entirety of a tenant's data remains secure by cryptographically isolating it from other tenants' applications. The virtual key management domains are established using a broadcast encryption (BE) protocol and, in particular, a multiple management key variant scheme of that protocol. The broadcast encryption-based virtual key management system (VKMS) and protocol achieves per-tenant (as well as per-application) secured isolation of data and can be used across any combination of resources in or across all levels of a co-tenanted IT infrastructure.

Virtual key management and isolation of data deployments in multi-tenant environments

Provided are techniques for verifying, by a first device, that a management key block of a second device is valid. A management key block that includes a plurality of verification data, each of the plurality associated with a plurality of security classes ranked from a high to low, is generated. The first device, which is associated with a security class that is higher than a security class associated with the second device, verifies a management key block of the second device by calculating a management key precursor associated with the higher security class and verifying verification data associated with the higher security class. In this manner, the second device is unable to pass an unauthorized, or 'spoofed,' management key block.

Broadcast encryption based media key block security class-based signing

Provided are techniques for the creation and storage of an archive for binding IDs corresponding to a cluster of devices that render content protected by a broadcast encryption scheme. When two or more clusters are merged, a binding ID corresponding to one of the clusters is selected and a new management key is generated. Binding IDs associated with the clusters other than the cluster associated with the selected binding ID are encrypted using the new management key and stored on a cluster-authorized device in a binding ID archive. Content stored in conformity with an outdated binding ID is retrieved by decrypting the binding ID archive with the management key, recalculating an old management key and decrypting the stored content.

Device archiving of past cluster binding information on a broadcast encryption-based network

Provided is techniques for the distribution and control of digital content such that Quality of Experience (QoE) is maintained. Content is protected from when the content is encrypted to when it is used. To ensure the QoE of particular content, a content owner embeds a list of required or preferred components that must be employed to render the content. The content owner's list of required or preferred components specifies specific components 'trusted' to correctly process the content. The specified chain of preferred components is compared to possible devices in the system that processes the content. If there are multiple acceptable devices for a specific link, a preference system is employed to determine the device that executed the particular part of the chain. The preference system is based upon a number of factors, such as, but not limited to, performance characteristics, user preferences, expected stability, power requirements and system preferences.

Provided are techniques to enable a device that provides a service to authorize a second device for receiving the service and the delivery of the service to the second device and other devices within a trusted network. A signed Management Key Block (MKB) is generated and transmitted over a network. Devices authorized to access a particular service parse the MKB and transmit a request. A server associated with the service determines whether or not the device is authorized to access the service based upon data included in the request. The first device may issue a challenge to the second device for authentication purposes. If service is approved, service is initiated, either from the first device or another authorized device. Devices may be organized into classes such that devices of a specific class are authorized to access the service.

Authentication and authorization of a device by a service using broadcast encryption

Provided are techniques for providing a home or business security system that relies upon data encryption for both communication and the storage of content. The disclosed technology incorporates all the devices necessary for a comprehensive security system, including, but not limited to, controllers, monitors, alarms and communication media. The system may include an unlimited number of devices and, further, individual devices may be added and removed as needed. Users may define and change the boundaries of a security system or, in other words, decide what devices to include or not include in such a system. A defined boundary does not need to be confined to a single location. In one embodiment, the claimed subject matter incorporates xCP based broadcast encryption technology.

Broadcast encryption based security system

Embodiments of the invention relate to obtaining forensic information for an anonymous attack of digital content without variations in a broadcast encryption system. In one embodiment a media device, being configured to record digital content on recordable media, receives digital content, a unified media key block, and a recording key table. The device calculates a set of recording keys from the recording key table using a media key variant from the unified media key block. The device then generates a title key and encrypts by the digital content in the generated title key. The device then encrypts the generated title key in each one of the calculated recording keys, adds a header including the encrypted titles keys to the encrypted digital content, and stores the encrypted digital content with the header on recordable media.

Growing community of inventors

Pflugerville, TX, United States of America

Matthew Francis Rutkowski