International Business Machines Corporation

Nithya Alagu Renganathan

Shawn Patrick Mullen

Elvin Dalipe Tubillara

Karen Mariela Siles

Rick A Hamilton, Ii

Fernando J Diaz

Shawn L Berger

Navneet Gupta

A encrypted verification system and method includes detecting an attempt to access a service requiring multi-factor authentication from a first user computing device, requesting a trusted platform module (TPM) public key of a second user computing device, the second user computing device being coupled to the first user computing device, generating a nonce in response to receiving the TPM public key of the second user computing device, sending the nonce for signature by a TPM private key of the second user computing device, receiving a signed nonce, wherein the signed nonce is signed by the TPM private key and decrypted using the TPM public key of the second user computing device, and determining that a value of the signed nonce matches a value of the nonce to authenticate the first user computing device and allowing access to the service.

Automating verification using secure encrypted phone verification

An Attestation Identity Key pair (AIK pair) is created from a hardware identifier of a hardware machine and a geographical location. the AIK pair includes a private AIK and a public AIK. The public AIK and the geographical location are stored in a repository. the public AIK is matched with a key used to sign a data request. A geographical restriction policy corresponding to the geographical location associated with the public AIK is executed. When the geographical restriction policy determines that a type of the data request corresponds to an authorized request type from the geographical location, a service is instructed to process the data request.

Enforcing locational restrictions on stateless transactions

Embodiments of the present invention utilize a data hash and an associated geotag for authentication of geolocation policies for data object storage in a cloud system. The geotag may be an alphanumeric identifier such as a city name, postal (ZIP) code, and/or latitude-longitude pair. Embodiments include a post-authenticate process, in which, after a data object is retrieved from a BMS, the geographic location of the source is confirmed to ensure the location policies have not been violated. Additionally, embodiments include a pre-authenticate process, in which, prior to storing a data object in a BMS, the geographic location of the BMS that is to receive the data object is confirmed to ensure the location policies will not be violated. Embodiments may use pre-authenticate, post-authenticate, or both pre-authenticate and post-authenticate, in order to implement and verify the location policies.

Location control of cloud data stores

Growing community of inventors

Austin, TX, United States of America

Nithya Alagu Renganathan