International Business Machines Corporation

Oracle International Corporation

University of Limerick

Olgierd Stanislaw Pieczul

Mark Alexander McGloin

Mary Ellen Zurko

Robert Graham Clark

Joseph Celi, Jr

Mustansir Banatwala

Stephen Paul Kruger

Vincent P Burckhardt

Mariusz Pajecki

Xiao Feng Yu

David S Kern

Juan Galiana Lara

Jürgen Schmidt

Izabela Pogorzelska-Pieczul

Andre Fischer

Nitin Srinivasa Rao Jami

Jinhui Wang

Shrey Arora

Hubert Alexander Foskett

Carlos C Manias Diez

Brent Allan Hepburn

Andrew T Penrose

Russell Holden

John Douglas Curtis

Brendan P Arthurs

Peter Otto Mierswa

Vincent Burckhardt

Joseph J Kubik

Stephen John Foley

Harshita Nersu

Bashar Nuseibeh

Ralph L Topete

Kamil Stepinski

Deepanjan Pal

Tasneem Singh

Arunkumar Sadasivan

Junaid Khan

Anusha Gururaja Manur

Sorren Hanvey

Mark Lawrence Rovelli

Jesus Garcia Galan

Isabela Pogorzelska-Pieczul

Subaru Arthur Ueno

Mark M McGloin

A framework for determining capabilities for execution of a system call a container and/or process within a computing system. For example, techniques for determining capabilities prerequisite for execution of a system call and determining whether the system call has been assigned the capabilities prerequisite for execution of the system call.

Process security capability requirements identification

A system for analyzing security threat changes of proposed changes to an infrastructure environment. For example, system and approaches for determining actions to be performed based on security threat changes corresponding to proposed changes to the infrastructure environment is disclosed.

Threat change analysis system

A computer system may receive one or more requests for access to one or more cloud services and may store the one or more requests in a request log. The computer system may receive one or more access rules applicable to cloud service access rights. The computer system may aggregate the one or more requests of the request log to determine access requirements for a container, the container being configured to store one or more applications. The computer system may generate and store container access policies that define access of a container and the one or more cloud services, the container access policies based at least in part on the aggregated one or more requests and the one or more access rules. The computer system may send the container access policies to a request forwarder of a compute instance in a production environment.

Techniques for automatically configuring minimal cloud service access rights for container applications

A scanner service can be configured to scan one or more nodes associated with a container management service. The container management service can be configured to manage a set of services by allocating managed containers associated with the set of services to the one or more nodes. The scanner service can be configured to identify vulnerabilities of processes running on the one or more nodes. The vulnerabilities can be attributed to the containers and/or the associated services rather than to the nodes. The scanner service is aware of the container management service and communicates vulnerabilities of associated containers.

Container orchestration framework aware port scanning

Techniques are described for assessing container images for vulnerabilities without actually scanning the container images. A vulnerability assessment system (VAS) is described that is configured to perform vulnerabilities assessment for container images. The VAS is configured to perform the vulnerability assessment without scanning the container images. In certain embodiments, the VAS calculates a vulnerability score for the container image where the vulnerability score is indicative of a probability that the container image contains a vulnerability.

Techniques for assessing container images for vulnerabilities

A method, system and computer program product relating to an application server operable to manage a microservice-based application, i.e. app, on behalf of clients, the clients being available for use by system actors who may be, for example, end users, bots, developers or other apps. A permissions validator is used to compute effective permissions in response to client requests. The requests are granted or denied conditional on the effective permissions being at least a subset of the permissions required to be given by any of the app's microservices that are needed for the resource being requested. The effective permissions are computed from an intersection of a set of actor permissions, a set of client permissions and a set of resource permissions.

Access control in microservice architectures

Techniques are disclosed for automatically inferring software-defined network policies from the observed workload in a computing environment. The disclosed techniques include monitoring network traffic flow originating from network interfaces corresponding to containers that execute components of an application, recording details of a new network connection or a change in the existing network connection, obtaining information concerning the components of the application, identifying metadata for a component involved in the new network connection or the change in an existing network connection based on a comparison of the details of the new network connection or a change in the existing network connection and the information concerning the components of the application, generating a network policy for the component using at least the metadata for the component, and integrating the network policy for the component into a deployment package for the application.

Automatically inferring software-defined network policies from the observed workload in a computing environment

A system and technique for a Request Forwarder as for a computer network architecture is disclosed to provide selective access to one or more cloud services. In some implementations, a computer system may receive a request for access to a cloud service, the request including a container credential. The computer system may determine an identification of the container using the container credential. The computer system may verify that the container requesting access to the cloud service is authorized based at least in part on stored policies. Based at least in part on the determination that the container requesting access to the cloud service is authorized: receiving instance credential from a metadata service. The computer system may include the instance credential with the request. The computer system may send the request to the cloud service. In various examples, the Request Forwarder can be provided as a service.

Techniques for selective container access to cloud services based on hosting node

Techniques are disclosed for associating environmental condition information with a software component so that the environmental conditions can be automatically verified when a software package containing the software component is deployed. As a result, environmental conditions can be established when a software component is initially developed by the operators who may be best-suited to determine appropriate environmental conditions. Further, environmental condition enforcement can be performed automatically at the time of deployment, without human intervention. For example, when the software component is about to deployed, a deployment system can automatically examine the information about the target environment to verify that target environment satisfies the encoded environmental conditions.

Enforcement of environmental conditions for cloud applications

In some aspects, a server device may identify one or more services of a cloud infrastructure via a management layer. The server device may determine service information and configuration information for the one or more services. The server device may generate an environment model based at least in part on the service information and the configuration information, the environment model providing information on relationship between one or more components of the cloud infrastructure. The server device may determine one or more threats to the one or more services based at least in part on analyzing the environment model and accessing a threat information database. The server device may generate a threat model that lists the one or more threats to the one or more services. The server device may generate one or more recommendations for the cloud infrastructure based at least on the threat model.

System and techniques for inferring a threat model in a cloud-native environment

A method, system and computer program product for secure access management for tools within a secure environment. A virtual file system for a user in memory on a server side in the secure environment is accessed as part of an authenticated user session including a user command instigated by a user. At the virtual file system, an encrypted file stored in the secure environment is obtained, where the file is encrypted using a public key of a user. A read operation at the virtual file system of the encrypted file is intercepted and the encrypted file is sent to a client at a user system external to the secure environment over a secure connection for decryption by a remote cryptography device of the user system using the user's private key. The decrypted file is then received at the virtual file system enabling the user to run the required user command.

Secure access management for tools within a secure environment

Growing community of inventors

Dublin, Ireland

Olgierd Stanislaw Pieczul