International Business Machines Corporation

Lenovo (singapore) Pte. Ltd.

Google Inc.

Mohammad Peyravian

Nevenko Zunic

Stephen Michael Matyas, Jr

Allen Leonid Roginsky

Clark Debs Jeffries

Kevin David Himberger

Daniel Alan Brokenshire

Harm Peter Hofstee

Ganesh Balakrishnan

Srinivasan Ramani

Ken Van Vu

Brian Michael Rogers

Ravinder Kumar Sabhikhi

Fabrice Jean Verplanken

Jean Louis Calvignac

James P Gray

Jeffrey S Hines

Michael Steven Siegel

David R Safford

Mark Anthony Rinaldi

Paul Ashley Karger

Rosario Gennaro

Raif O Onvural

John Fred Davis

David Carroll Challener

David Jones Craft

Donald B Johnson

Marcel Mordechay Yung

Stephen M Matyas

Russell Alan Resnick

John G Dudley

Joseph Franklin Garvey

Gene Y Tsudik

Brian Edward Carpenter

Ravinder Kumar Sabhiki

A method and technique for protecting against denial of service attacks includes maintaining a session count indicating a quantity of active client sessions a server is maintaining and a session threshold specifying a maximum quantity of concurrent client sessions the server can maintain. Responsive to receiving a request from a client, a request count maintained by the server is verified to be less than the session threshold and, if so, a challenge message is sent to the client and the request count is incremented. Responsive to receiving a response message to the challenge message from the client, the response message is verified, a session with the client is established, and the session count is incremented. Responsive to terminating the session with the client, the session count and the request count are decremented.

Front-end protocol for server protection

Aspects of an embodiment of the invention disclose a method, computer program product, and system for managing the energy efficiency of servers providing multi-class computing services with Quality of Service (QoS) assurance. Computing resources are clustered into at least three groups, where each group has a separate power management policy (PMP). A plurality of requests are received from a plurality of devices, and are sorted into at least three service classes based on the requests' QoS criteria. Each request is assigned to one of at least three service queues based on the request's service class, and each service group is processed by a group of computing resources. The power management policies are configured such that each group of computing resources may service requests at an energy efficient point while meeting the QoS criteria of the service class.

Managing servers with quality of service assurances

A method and technique for protecting against denial of service attacks includes maintaining a window over a sequence number space that includes sequence numbers that are sequentially assigned to challenge messages where the window has a leading edge and a trailing edge. Responsive to receiving a request from a client, the leading edge of the window is advanced and a leading edge sequence number is selected as a challenge sequence number. A challenge message including the challenge sequence number is sent to a client. Responsive to receiving a response message from the client, it is verified that a challenge sequence number included with the response message is within the window and does not correspond to a marked sequence number within the window.

The present invention provides for protecting against denial of service attacks. A request is sent by a client, the request comprises client indicia. The request is received at a server. A request count is incremented by the server. A sequence number is assigned as a function of the client indicia. A problem is selected by the server. The problem is sent by the server to the client. A solution to the problem is sent to the server. It is determined if the solution by client is correct. If the solution is correct, a session is performed. If the solution is not correct, the request is discarded. This can substantially decrease the amount of attacks performed by a rogue client, as the session set-up time can be substantial.

A method for managing processor power optimization is provided. The method may include receiving a plurality of tasks for processing by a processor environment. The method may also include allocating a portion of a compute resource corresponding to the processor environment to each of the received plurality of tasks, the allocating of the portion being based on both an execution time and a response time associated with each of the received plurality of tasks.

Processor power optimization with response time assurance

The present invention provides for authenticating a message. A security function is performed upon the message. The message is sent to a target. The output of the security function is sent to the target. At least one publicly known constant is sent to the target. The received message is authenticated as a function of at least a shared key, the received publicly known constants, the security function, the received message, and the output of the security function. If the output of the security function received by the target is the same as the output generated as a function of at least the received message, the received publicly known constants, the security function, and the shared key, neither the message nor the constants have been altered.

Authenticating messages using cryptographic algorithm constants supplied to a storage-constrained target

The present invention provides for authenticating a message, A security function is performed upon the message, The message is sent to a target. The output of the security function is sent to the target. At least one publicly known constant is sent to the target. The received message is authenticated as a function of at least a shared key, the received publicly known constants, the security function, the received message, and the output of the security function. If the output of the security function received by the target is the same as the output generated as a function of at least the received message, the received publicly known constants, the security function, and the shared key, neither the message nor the constants have been altered.

Supplying cryptographic algorithm constants to a storage-constrained target

A system for secure communication is provided. A random value generator is configured to generate a random value. A message validation code generator is coupled to the random value generator and configured to generate a message validation code based on a predetermined key, a message, and the random value. A one-time pad generator is coupled to the random number generator and configured to generate a one-time pad based on the random value and the predetermined key. And a masked message generator is coupled to the one-time pad generator and configured to generate a masked message based on the one-time pad and the message. A protected message envelope generator is coupled to the random value generator, the message validation code generator, and the masked message generator, and is configured to generate a protected message envelope based on the random value, the message validation code, and the masked message.

Unidirectional message masking and validation system and method

A router includes a relatively low bandwidth communication connection to a small computer, a relatively high bandwidth communication connection to a communication network; and a processing unit for executing in the router a set of permit rules for permitting flow of communication packets with respect to the connections for user initiated sessions, the permit rules including a default rule for discarding all packets with respect to the small computer in traffic not pertaining to sessions initiated by the small computer.

System and method for detection and mitigation of distributed denial of service attacks

A remote user, two-way authentication and password change protocol that also allows parties to optionally establish a session key which can be used to protect subsequent communication. In a preferred embodiment, a challenge token is generated and exchanged which is a onetime value that includes a random value that changes from session to session. The construction and use of the challenge token avoids transmission of the password or even the transmission of a digest of the password itself. Thus the challenge token does not reveal any information about a secret password or a digest of the password.

Efficient method for providing secure remote access

A Resource Reservation System includes a Token Generation Unit (TGU) which generates and circulates among nodes of a communications system a Slotted Token (SLT) message having sub-fields to carry identification number for each input port in a node and the resource available for each input port. On receiving the message the Resource Control Unit (RCU) in each node can write port identification number, available resource in appropriate sub-fields of the SLT message, and reserve resources in other nodes by adjusting information in the sub-field associated with the other nodes.

Apparatus and method to reserve resources in communications system

Growing community of inventors

Cary, NC, United States of America

Mohammad Peyravian