International Business Machines Corporation

Michiharu Kudo

Kazuhito Akiyama

Hiroaki Nakamura

Satoshi Hada

Naohiko Uramoto

Kohtaroh Miyamoto

Akihiko Tozawa

John David Wilson

Masayuki Numao

Hitomi Takahashi

Takuya Mishina

Naishin Seki

Naizhen Qi

Sanehiro Furuichi

Robbert C Van Der Linden

Robbert Van Der Linden

Makato Murata

Hiroshi Kawazoe

An example operation may include one or more of storing chaincode comprising executable steps of a multi-party process generated from a state diagram in which a blockchain is an intermediary between a plurality of off-chain systems, receiving a request to execute the multi-party process, processing a step of the multi-party process based on the request via execution of the stored chaincode including the executable steps of the multi-party process to generate a processed result for the step, and storing an identification of the processed step and the generated processed result via a data block among a hash-linked chain of data blocks of the blockchain.

Transformation of inter-organization process for execution via blockchain

An example operation may include one or more of receiving a plurality of state representations of a plurality of off-chain systems for performing a multi-party process via a blockchain, wherein each state representation identifies send and receive events of a respective off-chain system, removing one or more events from a state representation of an off-chain system to generate a reduced state representation, generating executable chaincode for the blockchain based on the plurality of state representations including the reduced state representation, and storing the generated chaincode via a blockchain node of the blockchain.

An example operation may include one or more of connecting, by a template generator node, to a blockchain that includes a plurality of user peers, retrieving, by the template generator node, a contract file from a ledger of the blockchain, executing, by the template generator node, chaincode to: extract a plurality of portions of the contract file based on a structure of a contract, determine common portions among the plurality of the portions, determine typical portions of the contract file from the common portions, generate a template based on the typical portions, format the template based on a state chart, and storing, by the template generator node, the template onto the ledger of the blockchain for access by the plurality of the user peers.

Generation of an industry template in blockchain networks

A method is for handling an anomaly in an industrial control system (ICS) connected to a network with a plurality of other ICSs and an anomaly analyzer. An ICS receives status data from its own industrial process, and stores this status data as normal pattern data. The ICS transmits its own status data to one or more other ICSs. The ICS receives an indication from the anomaly analyzer that the ICS is suspected of having an anomaly. The ICS transmits alternate status data based on the normal pattern data stored during non-suspect operation, and stores the status data received from its own industrial process as real status data. In response to receiving from the anomaly analyzer an indication that the ICS is not operating anomalously, the ICS transmits the stored real data, and switches back to transmitting its own status data to one or more other ICSs.

Anomaly detection system, anomaly detection method, and program for the same

An anomaly detection system for detecting an anomaly within a network as a first embodiment in order to provide an anomaly detection system, anomaly detection method, and program for the same. An anomaly detection system which has a plurality of industrial control systems (hereinafter 'ICS's) which are connected to the network, an integrated analyzer which receives the operational status of each ICS as monitoring data in order to identify an ICS for which an anomaly is suspected so as to perform an anomaly assessment, a receiving unit provided for each ICS which receives data from other ICSs, a transmission unit which transmits data to other ICSs and transmits the monitoring data to the integrated analyzer, a security policy which includes recording of data and generation rules, and a wrapper which refers to the security policy in order to control the data so as to transmit the same to other ICSs.

An improved method and system for providing path-level access control to a structured document in a collection stored in a database, where the structured document includes a plurality of nodes is disclosed. The method includes the steps of providing an access control policy for the collection, where the access control policy comprises a plurality of access control rules, generating a path for each node of the plurality of nodes in the document, and generating for each path associated with a node a corresponding value expression based on at least one access control rule of the plurality of access control rules. According to the method and system of the present invention, the corresponding value expression is utilized during access control evaluation to determine whether a user is allowed to access a node in the structured document.

Providing path-level access control for structured documents stored in a database

An anomaly detection system for detecting an anomaly in a plurality of control systems comprises a plurality of analysis devices that are associated with the respective control systems and that acquire an event occurring in an associated control system and analyze the event to determine whether there is an anomaly. A first analysis device among the plurality of analysis devices determines whether an event occurring in the associated control system is to be indicated to a second analysis device among the plurality of analysis devices, and the second analysis device determines that there is an anomaly on condition that the event indicated by the first analysis device has correlation with an event indicated by an analysis device other than the first analysis device.

Anomaly detection system for detecting anomaly in multiple control systems

A system for generating contexts of targets to estimate a high-order context is provided. The system includes: a detection device including: a sensor for detecting a target; a module for extracting the target and a primary context of the target based on data detected by the sensor; and a module for encrypting the primary context with a key corresponding to the target; a storage device for recording encrypted primary context from the detection device; and a processing device including: a module for receiving the encrypted primary context from the storage device; a module for receiving the key corresponding to the target involved in the encrypted primary context; a module for decrypting the encrypted primary context using the received key; and a module for estimating a high-order context using the decrypted primary context, where the processing device further includes a module for requesting the detection device to delete information on a key corresponding to a specific target.

Processing context information

A communication control method and system for controlling communication among multiple industrial control systems connected via a network. The communication control system includes: a communication relay apparatus for relaying communication between at least two of multiple industrial control systems; a monitoring section for monitoring the multiple industrial control systems; and a control section for switching, if the monitoring section detects an anomaly from at least one of the multiple industrial control systems, communication between an industrial control system detected with an anomaly and a second industrial control system so that the communication is performed via the communication relay apparatus.

Controlling communication among multiple industrial control systems

Method and system for providing path-level access control for structured documents stored in a database

A method for controlling access to a data source includes steps of: storing a plurality of access control policies in a database; generating a plurality of tree-structured data from the policies; merging the plurality of tree-structured data; determining that a user is attempting to access part of the data source; determining whether or not to permit access; verify consistency of the determination; store the merged tree-structured data; and designate the part of the data source by a path expression.

Access controller using tree-structured data

To provide a method and a system for creating a mini time key from a time key, a plurality of mini time keys are created within a unit time period. First, a unit time decryption key is prepared immediately after the unit time is created. Then, the last mini time key is created by applying a one-way function to the unit time decryption key. A desired mini time key is created by applying the one-way function to a mini time key following the desired mini time key. In other words, the mini time keys are created as a timed series arranged in a descending order beginning with the last mini time key. In this manner, even when a specific mini time key is externally leaked for a specific reason, a following mini time key in a timed series can not be created by using this mini time key. In addition, even when the mini time keys are sequentially published, the security of the unit time decryption key is maintained.

Mini time key creation memory medium and system

An access rights analysis including a query automaton generation unit for generating a query automaton from a path expression in which retrieval conditions for a database. An access control automaton generation unit generates an access control automaton from an access control policy; a schema automaton generation unit generates a schema automaton from a schema; and a logic operation unit performs a logic operation related to each of the generated automatons. By use of the above components, access rights in database retrieval using the path expressions are decided without checking the XML document itself in the XML database and checking by each node.

Information processor, database search system and access rights analysis method thereof

An access management apparatus, method and program storage device for permitting or prohibiting access to each of a plurality of nodes stored hierarchically, including means and steps for storing rule functions with a plurality of requesters to access a node, each of the rule functions for determining whether access should be permitted or rejected depending on the position of the node in the hierarchical structure or depending on the requester, receiving an access request from a requester, selecting the rule function, and executing the rule function which has been selected by the selector, and controlling permission of, or prohibition of, the access request on the basis of a result of executing the rule function.

Growing community of inventors

Kamakura, Japan

Michiharu Kudo