International Business Machines Corporation

Messaoud Benantar

David Yu Chang

Vishwanath Venkataramappa

Virgil Anthony Albaugh

Yen-Fu Chen

Randolph Michael Forlenza

John W Dunsmoir

Hari Haranath Madduri

Anthony Joseph Nadalin

George Robert Blakley, Iii

Sandra Juni Schlosser

Wei Liu

Thomas L Gindin

James W Sweeny

Philip Yen-tang Chang

Liam S Harpur

John C Dayka

Robert Howard High, Jr

John Yow-Chun Chang

Bo Yang

Ivan Matthew Milman

Anca Sailer

Ajay Mohindra

John Y Chang

Patrick Michael Commarford

John Alexander Buslawski

Ajay Reddy Karkala

John J Petreshock

Liane Elizabeth Haybnes Acker

Mahesh Kumar Rathi

An example operation may include one or more of connecting, by a recipient node, to a source node via a blockchain network, receiving, by the recipient node, a data block, a digest of the data block encrypted by a private key of the source node, a public key paired to the private key and an IP address of the source node, calculating, by the recipient node, a digest of the data block, decrypting, by the recipient node, the digest of the data block by the public key, comparing, by the recipient node, the decrypted digest against the digest, and in response to a match, storing the encrypted digest, the public key and the IP address of the source node onto a ledger of the recipient node.

Management of a size of a ledger

The present disclosure provides techniques for data transmission. According to one technique, a request from a data sender for sending data to a data receiver is received, wherein the request comprises a content indicating a verification code. Then, a first solution to the verification code based on the request can be obtained. The verification code can be sent to the data receiver. A second solution to the verification code can be received from the data receiver, wherein the second solution is generated by the data receiver. Transmission of the data from the data sender to the data receiver can be enabled in response to the first solution consistent with the second solution.

Data transmission based on verification codes

A topic based conversation retrieval system and method may include receiving a first conversation between a first plurality of users a second conversation between the first plurality of users or a second plurality of users, the second conversation being conducted on a second communication mode different than the first communication mode, analyzing the first conversation and the second conversation, determining one or more topics of discussion in the first conversation and the second conversation, and retrieving a portion of each of the first conversation and the second conversation, where the portion is related to a topic chosen to be retrieved.

Topic based conversation retrieval

A method, computer program product, and a device for establishing a direct communications connection between gateways of two computing systems includes a processor(s) of a first system receiving configuration instructions in a generic format and translating the configuration instructions into a first set of gateway configuration commands that are in a format compatible with a first gateway of the first system. The processor(s) executes the first set to configure the first gateway. The processor(s) transmits, via a communication protocol, the configuration instructions, to a program(s) of a second computing systems, the program(s) translates the configuration instructions into a second set of gateway configuration commands, in a format compatible with the second gateway, and executes the second set to configure the second gateway. The processor(s) establishes a direct communications connection between the first gateway and the second gateway, based on the configurations matching.

Establishing cross-vendor secure connectivity in a shared computing environment

An authentication and authorization plug-in model for a cloud computing environment enables cloud customers to retain control over their enterprise information when their applications are deployed in the cloud. The cloud service provider provides a pluggable interface for customer security modules. When a customer deploys an application, the cloud environment administrator allocates a resource group for the customer's application and data. The customer registers its own authentication and authorization security module with the cloud security service, and that security module is then used to control what persons or entities can access information associated with the deployed application. To further balance the rights of the various parties, a third party notary service protects the privacy and the access right of the customer when its application and information are deployed in the cloud.

Authentication and authorization methods for cloud computing platform security

A computer implemented method, data processing system, and computer program product for dynamically binding business process activities to human entities at deployment time. Identification information about a staff activity in a business process is received from a process server at an access control system external to the process server. Responsive to initiation of the business process, the staff activity is resolved at the access control system at runtime by assigning the staff activity to a user based on an access policy of the access control system to form a staff activity assignment. The staff activity assignment is communicated from the access control system to the process server. The process allows the development of the business process to be entirely decoupled from staff activity resolution at runtime.

Policy-based access control approach to staff activities of a business process

An authentication and authorization plug-in model for a cloud computing environment enables cloud customers to retain control over their enterprise information when their applications are deployed in the cloud. The cloud service provider provides a pluggable interface for customer security modules. When a customer deploys an application, the cloud environment administrator allocates a resource group (e.g., processors, storage, and memory) for the customer's application and data. The customer registers its own authentication and authorization security module with the cloud security service, and that security module is then used to control what persons or entities can access information associated with the deployed application. The cloud environment administrator, however, typically is not registered (as a permitted user) within the customer's security module; thus, the cloud environment administrator is not able to access (or release to others, or to the cloud's general resource pool) the resources assigned to the cloud customer (even though the administrator itself assigned those resources) or the associated business information. To further balance the rights of the various parties, a third party notary service protects the privacy and the access right of the customer when its application and information are deployed in the cloud.

Authentication and authorization methods for cloud computing security

This disclosure describes a secure and computationally-efficient method to establish a single authentication context for multiple identities. The method is implemented in an authentication system using a key exchange protocol, namely, the Diffie-Hellman key exchange. One or more entities that desire to authenticate (either individually or jointly) register with the authentication system and receive private Diffie-Hellman keys (the PINs). Later, during an authentication operation, each entity provides the PIN to the authentication system, preferably over a secure transport. The authentication system, using Diffie-Hellman key exchange artifacts, generates a Diffie-Hellman cryptographic value for each PIN, although the value need not be maintained private. The authentication system orders the Diffie-Hellman values as a 'partially ordered set' to form a lattice. An authentication context is derived from the Diffie-Hellman values in the lattice. Thus, for example, during authentication of multiple entities, a shared key is computed incrementally as the Diffie-Hellman keys arrive from the entities for which a multi-identity authentication is required. The shared key represents a proof of group authentication.

Lattice scheme for establishing a secure multi-identity authentication context

Multiple security domains can be created and associated with various scopes within the cell allowing security configurations of each scope to be managed collectively. Examples of scopes include the entire cell, one or more application servers, one or more applications, one or more clusters, one or more service integration buses, one or more nodes, etc. Security configurations associated with the security domains can be applied to the scopes based on a hierarchy of the security domains. In addition, new security domains may be created automatically based on security requirements of newly installed applications.

Associating multiple security domains to application servers

A method, system, apparatus, and computer program product are presented for managing digital certificates. When entities need to engage in a secure transaction or open a secure communication link, they may exchange digital certificates in order to provide a public key or reference information to a public key for the opposing entity, thereby requiring validation of a received certificate. Rather than construct a trust path for each validation event, hierarchical certifications and peer-to-peer cross-certifications among a set of certificate authorities are represented by a set of trust relations, and trust path information is generated using a transitive closure computation and an 'all pairs shortest paths' computation over the set of trust relations and then incrementally updated as the set of trust relations changes. Computations related to trust paths can be delegated to a central agent in a trust web.

Method and system for computing digital certificate trust paths using transitive closures

A methodology is presented for a network single sign-on (SSO) authentication process using digital certificates. A user has access to protected resources, such as legacy applications, that require verification of a user's authentication data prior to providing access. The user's authentication data is encrypted using the public key of the user, and an attribute certificate containing the encrypted authentication data is generated by an attribute-certificate-issuing authority. When a user requires access to the protected resource, an SSO agent performs an initial authentication process against the user. The SSO agent then retrieves the user's attribute certificate, and for subsequent authentication requests for other protected resources, the SSO agent uses the authentication data from the attribute certificate that corresponds to the targeted protected resource. The SSO agent forwards the required authentication data to the protected resource, and the protected resource then authenticates a user based on the provided authentication data.

Method and system for network single-sign-on using a public key certificate and an associated attribute certificate

A Centralized Authentication & Authorization (CAA) system that facilitates secure communication between service clients and service providers. CAA comprises a Service Request Filter (SRF), a Service Client Authentication Program (SCAP), a Service Authorization Program (SAP), and an Authorization Database (ADB). The SRF intercepts service requests, extracts the service client's identifier from a digital certificate attached to the request, and stores the identifier in memory accessible to service providers. In the preferred embodiment, the SRF forwards the service request to a web service manager. The web service manager invokes SCAP. SCAP matches the identifier with a record stored in ADB. SAP queries ADB to determine if the service request is valid for the service client. If the service request is valid, SAP authorizes the service request and the appropriate service provider processes the service request.

Architecture and design for central authentication and authorization in an on-demand utility environment

An infrastructure for on-demand service delivery receiving a request for a service to be performed from a service consumer with an information payload; decomposing requested service into essential or primitive functions; dynamically composing a sequence of a plurality of service elements corresponding to the essential or primitive functions to accomplish the service by employing a function call and return decomposition and recomposition paradigm; creating a control header and information payload, the control header encapsulating the sequence; repeatedly dispatching the control header to each service element in the sequence until all service elements have processed the information payload; and returning the processed information payload to the service consumer.

Dynamic service-on-demand delivery messaging hub

A Centralized Authentication & Authorization (CAA) system that prevents unauthorized access to client data using a secure global hashtable residing in the application server in a web services environment. CAA comprises a Service Request Filter (SRF) and Security Program (SP). The SRF intercepts service requests, extracts the service client's identifier from a digital certificate attached to the request, and stores the identifier in memory accessible to service providers. The client identifier is secured by the SP using a key unique to the client identifier. When the web services manager requests the client identifier, the web services manager must present the key to the SP in order to access the client identifier. Thus, the present invention prevents a malicious user from attempting to obtain sensitive data within the application server once the malicious user has gained access past the firewall.

Growing community of inventors

Austin, TX, United States of America

Messaoud Benantar