International Business Machines Corporation

Niteesh Kumar Dubey

Joefon Jann

Ramanjaneya Sarma Burugula

Pratap Chandra Pattnaik

Hao Yu

Ravi Shankar

Saurabh Desai

Ching-Farn Eric Wu

Murali Vaddagiri

Drew Thomas Walters

Rodney Carlton Burnett

Xinya Wang

Wu Zheng

Yantian Tom Lu

Ravl A Shankar

A method, a computer program product, and a system for mitigating unauthorized encryptions of filesystem objects stored on a computing system. The method includes allocating a backup memory area for storing pre-encrypted filesystem objects, setting data bits in an encryption register that allow for monitoring a filesystem object marked for ransomware protection. The method also includes calculating an encryption rate of an encryption occurring on the filesystem object and determining that the encryption rate of the filesystem object exceeds an encryption-rate threshold. The encryption-rate threshold can be set by an administrator when marking the filesystem object for ransomware protection. The method further includes generating an alert to an administrator that the encryption rate of the filesystem object exceeds the encryption rate threshold and storing a backup of the filesystem object for a predetermined amount of time in the backup memory area.

Filesystem object protection from ransomware attacks

A method, a computer program product, and a system for initializing components to monitor for unauthorized encryptions of filesystem objects stored on a computing system. The method includes configuring an encryption monitor register to establish monitoring preferences of filesystem objects and allocating a predetermined size of persistent memory as a backup memory area for storing pre-encrypted versions of the filesystem objects. The method also includes inserting a starting address of the backup memory area in data bits of the encryption monitor register, and setting encryption monitor bits of page table entries in a hardware page table that correspond to at least one filesystem object, thereby establishing encryption monitoring of the filesystem object.

Encryption monitor register and system

Communication endpoints associated with a virtual machine for migration can be discovered. Properties associated with the communication endpoints can be discovered. The communication endpoints can be matched to establish a communication channel between the endpoints. The communication endpoints, the properties and the at least one communication channel can be used in recreating the communication channel for a migrated version of the virtual machine.

Discovery and recreation of communication endpoints in virtual machine migration

A server LPAR operating in a virtualized computer shares pages with client LPARs using a shared memory region (SMR). A virtualization function of the computer receives a get-page-ID request associated with a client LPAR to identify a physical page corresponding to a shared page included in the SMR. The virtualization function requests the server LPAR to provide an identity of the physical page. The virtualization function receives a page-ID response comprising the identity of a server LPAR logical page that corresponds to the physical page. The virtualization element determines a physical page identity and communicates the physical page identity to the client LPAR. The virtualization element receives a page ID enter request and enters an identity of the physical page into a translation element of the computer to associate a client LPAR logical page with the physical page.

Shared memory in a virtual environment

A server logical partition (LPAR) of a virtualized computer includes shared memory regions (SMRs). The SMRs include pages of the server LPAR memory to share with client LPARs. A hypervisor utilizes an export vector to associate logical pages of the server LPAR with SMRs. The hypervisor further utilizes a reference array to associate SMRs with client LPARs that have mapped at least one physical memory page of the SMR from a logical page of the client LPAR memory. In processing an operation to unmap one or more shared physical pages from one or more LPARs, the hypervisor uses the export vector and reference array to determine which LPARs have had a mapping to the physical pages.

Invalidation of shared memory in a virtual environment

A method, apparatus, and computer usable program product for automatic activation of roles is provided. When a user initiates an action, a set of roles needed for the action is identified. A set of roles assigned to the user is also identified. From the two sets of roles, all roles that are common to both sets are identified in a subset of roles. Roles in this subset are assigned to the user and are sufficient for the action. One or more roles from this subset of roles is selected for activation depending on system policies in effect. Selected roles are automatically activated without requiring any intervention from the user. Once the selected roles are activated, they can become inactive upon completion of the current action, or remain active for subsequent actions by the user during all or part of a user session. System policies can decide how the roles are selected for activation, and the duration of which the roles remain active once activated.

Automatic role activation

A method and structure for OS event notification, including a central processing unit (CPU) and a memory including instructions for an event notification mechanism for monitoring operating system events in an operating system (OS) being executed by the CPU. The OS includes a kernel having a plurality of kernel subcomponents that provide services to one or more applications executing in the OS in a user mode, using system calls to the kernel. The OS event notification mechanism is capable of monitoring events within the kernel, at a level below the user mode level. The OS event notification mechanism includes Application Program Interfaces (APIs) that are standard for the OS.

Method and apparatus for operating system event notification mechanism using file system interface

System, method and computer program product for supporting a plurality of Access Control List types for a file system in an operating system in a data processing system. An Access Control List supporting system for managing access to a file system in a data processing system has at least one file system in an operating system of the data processing system, and an Access Control List management framework in the operating system and external to the at least one file system for managing access to the at least one file system. The Access Control List supporting system of the invention removes ACL management and access check-related functions from the at least one file system to an external Access Control List management framework, thus enabling an operating system to support a plurality of Access Control List types using the same Access Control List management framework and enabling new Access Control List types to be added to the operating system dynamically while the operating system is running.

System and method for supporting a plurality of access control list types for a file system in an operating system

A method and structure for notifying operating system events, includes standard filesystem interfaces provided for event consumers to use for one or more of registering for event notifications of a set of events, receiving an event notification when each event occurs, and getting details of events that have occurred.

A computer implemented method, apparatus, and computer program product for access control in a mixed discretionary access control and role based access control environment. In one embodiment, an execution access for a command is determined using a set of role based authorizations for a user invoking the command. In response to a determination that the user invoking the command is authorized based on the set of role based authorizations, a privilege in a set of privileges associated with the command is raised. Raising the privilege in the set of privileges bypasses discretionary access control checks. In response to a determination that the user invoking the command is unauthorized based on the set of role based authorizations, an execution access for the command is determined using a set of discretionary access mode bits associated with the command.

Determination of access checks in a mixed role based access control and discretionary access control environment

A computer implemented method, computer program product, and system for managing objects. Responsive to receiving a find-rule method, and a path-rule table, wherein the path-rule table contains a set of paths, wherein each path references an object, wherein a file system locates the object using the path, and wherein the object has at least one attribute not known to the file system, a path-rule table identifier is created. The path-rule table is associated with the path-rule table identifier to form an associated path-rule table. The find-rule method is associated with the path-rule table identifier to form an associated find-rule method. The path-rule table identifier, the associated path-rule table, and the associated find-rule method are stored. The path-rule table identifier is returned.

Growing community of inventors

Yorktown Heights, NY, United States of America

Niteesh Kumar Dubey