International Business Machines Corporation

Other

Michael Charles Osborne

Tamas Visegrady

Michael Peter Kuyper-Hammond

Silvio Dragone

Michael Baentsch

John C Dayka

Elaine Rivette Palmer

Laurent Frelechoux

Thorsten Kramp

Harold D Dykeman

Peter Buhler

Thomas D Weigold

Marcus B Oestreicher

Robert Haas

William Santiago-Fernandez

Anja Lehmann

Reto Josef Hermann

Thomas Eirich

Mark Korondi

Jan Leonard Camenisch

Ilias Iliadis

Paolo Scotton

Michael J Jordan

Frank Hoering

James W Sweeny

Daniel Kovacs

Klaus Kursawe

Dániel Kovács

Roman Maeder

Frank Horing

Klaus Departement Elektrotechniek - Esat Kursawe

The present invention discloses a method for managing priority-arbitrated access to a set of one or more computational engines of a physical computing device. The method includes providing a multiplexer module and a network bus in the physical computing device, wherein the multiplexer module is connected to the network bus. The method further includes receiving, by the multiplexer module, a first data processing request from a driver and inferring, by the multiplexer module, a first priority class from the first data processing request according to at least one property of the first data processing request. The method further includes manipulating, by the multiplexer module, a priority according to which the physical computing device handles data associated with the first data processing request in relation to data associated with other data processing requests, wherein the priority is determined by the first priority class.

Priority-arbitrated access to a set of one or more computational engines

A key identifier that identifies a cryptographic key is transmitted to a cryptographic coprocessor. A first set of attributes is received from the cryptographic coprocessor. The first set of attributes and a second set of attributes are serialized into a first sequence of attributes. The first sequence of attributes are stored to an attribute frame. One or more attributes in the second set of attributes are associated with the cryptographic key and originate from a key attribute storage of the key management system. The second set of attributes is different from the first set of attributes. The first sequence of attributes is transmitted to the cryptographic coprocessor. A first message authentication code (MAC) calculated from the first sequence of attributes is received from the cryptographic coprocessor. The attribute frame is verified by comparing the first MAC, or a value derived from the first MAC, to a reference value.

Key attribute verification

A method including: receiving, via a processor, established upper bounds for dynamic structures in a multi-tenant system; creating, via the processor, arrays comprising related memory-management unit (MMU) mappings to be placed together; and placing the dynamic structures within the arrays, the placing comprising for each array: skipping an element of the array based on determining that placing a dynamic structure in that element would cause the array to become overcommitted and result in a layout where accessing all elements would impose a translation look aside buffer (TLB) replacement action; and scanning for an array-start entry by placing the start of a first element at an address from which an entire array can be placed without TLB contention, and accessing, via the processors, all non-skipped elements without incurring TLB replacements.

Reducing impact of context switches through dynamic memory-mapping overallocation

Batched execution of encryption operations is performed. A batched set of data for which format-preserving encryption is to be performed is obtained. The batched set of data includes a plurality of fields of data, which are independent of one another. Multiple rounds of format-preserving encryption are performed on the plurality of fields of data to provide an output of format-preserved encrypted data. A round of format-preserving encryption includes calling an encryption function to perform one or more encryption operations on the plurality of fields of data in parallel.

Batched execution of encryption operations

The present disclosure relates to a computer-implemented method for controlling operation of multiple computational engines of a physical computing device. The computer-implemented method includes providing a multiplexer module in the device, the multiplexer module including a first and second memory region. The multiplexer module may receive from a first driver at the multiplexer module a data processing request to be processed by a first set of one or more computational engines of the computational engines. Subsequent to receiving the data processing request, the multiplexer module may assign a request sub-region of the first region and a response sub-region of the second region to the first driver. Data indicative of the request sub-region and the response sub-region may be submitted to the first driver. Results of processing the request may be received at the response sub-region.

Controlling operation of multiple computational engines

A data-source computer provides message data, having associated id data, to be sent to a data-collection computer; produces a blinded id by blinding the id data using a nonce; sends the blinded id to a tokenization computer; and sends the nonce and the message data via a network for receipt by the data-collection computer. In response, the tokenization computer produces a blinded token comprising a function, blinded with the nonce, of the id data and a secret key of the tokenization computer, and sends the blinded token to the data-collection computer. The data-collection computer, in response, uses the nonce to unblind the blinded token to obtain an id token which comprises a deterministic function of the id data and the secret key. The data-collection computer then stores the id token and the message data in storage operatively coupled to the data-collection computer.

Data tokenization

Graph data of a DAG is received. The data describes a module to be started by way of nodes connected by edges, wherein some nodes are submodule nodes that correspond to submodules of said module. Submodule nodes are connected via edge(s) that reflect a data dependency between the corresponding submodules. Each of said submodules is a hardware module or a software submodule, capable of producing and/or consuming data that can be consumed and/or produced, by other submodule(s) of said module, based on the DAG. Asynchronous execution is started of two of said submodules, respectively corresponding to two submodule nodes located in independent branches of the DAG. A third submodule node(s) is determined that is a descendant of each of said two submodule nodes, according to an outcome of the execution of the corresponding two submodules. Execution is started of a third submodule that corresponds to the determined third submodule node.

Methods and systems for starting computerized system modules

A security device () is provided for facilitating management of secret data items such as cryptographic keys which are used by a remote server () to authenticate operations of the server (). The device () has a user interface (), control logic () and a computer interface () for connecting the device () to a local user computer () for communication with the remote server () via a data communications network (). The control logic is adapted to establish via the user computer () a mutually-authenticated connection for encrypted end-to-end communications between the device () and server (). In a backup operation, the secret data items are received from the server () via this connection. The control logic interacts with the user via the user interface () to obtain user authorization to backup secret data items and, in response, stores the secret data items in memory (). To restore secret data items to the server, the control logic interacts with the user via the user interface () to obtain user authorization to restore secret data items and, in response, sends the secret data items to the server () via said connection.

Management of secret data items used for server authentication

A computer-implemented method, a computer system, and a computer program product are provided for enforcing multi-level security (MLS) on a message transmitted over a network that may be insecure. The method includes the processor obtaining a request from a source to send a message to a target, where the request includes the message and a context indicating a requested security level for the message. The processor encrypts the message based on ascertaining the message received in the request is a plaintext. The processor authenticates the encrypted message based on ascertaining the encrypted message is a ciphertext, where the target is enabled to trace the authenticated ciphertext back to the source. The processor transmits the authenticated encrypted message to the target across the network.

Multi-level security enforcement utilizing data typing

Embodiments of the present invention may involve providing security to a computing device. The providing security to a computing device may involve performing crypto-operations. A security system may include a central processing unit and a pre-processing unit. The pre-processing unit may be configured for receiving an incoming encapsulated request, parsing header infrastructure information of the encapsulated request, decapsulating the request, and providing the decapsulated request to the central processing unit for further processing.

Multi-level security enforcement

Systems and methods are provided for preserving data in a data deduplication system. A hash tree-based deduplication system balancing memory utilization and duplication-related storage access overhead is disclosed. The system preferably relies on distributed file system infrastructure and the system modifies this infrastructure. The data structures may be adapted to accommodate file-block distribution properties at runtime, such as runtime-specializing the hash tree to detect replicated chunks.

Distributed content deduplication using hash-trees with adaptive resource utilization in distributed file systems

Embodiments are directed to an IC device comprising a set of N elements, and an interconnect system for enabling communication between the set of elements. Each element of the set of elements is configured according to a first communication plan to receive attestation data of each other element of the set of elements. Upon receiving the attestation data the element may determine whether each of the received attestation data from the other elements match an attestation pattern as defined in the first communication plan. In case the received attestation data match the first communication plan, the element may determine whether the received attestation data is attested by N&#x2212;1 elements of the set of elements. In case the attestation data is attested by N&#x2212;1 elements of the set of elements, the element may indicate the presence of the set of elements before the time interval has lapsed.

Growing community of inventors

Richterswil, Switzerland

Michael Charles Osborne