International Business Machines Corporation

Patrick Ryan Wardrop

Heather Maria Hinton

Dolapo Martin Falola

Matthew Paul Duggan

Anthony Scott Moran

Ivan Matthew Milman

Ariel Farkash

Shane Bradley Weeden

Brian Robert Matthiesen

Ilgen Banu Yuceer

Igor Gokhman

Matthew Elsner

David G Druker

Christopher John Hockings

Trevor Scott Norvill

Pranam C Sreedhar

Timothy Walter Moore

Philip A Nye

Asha Shivalingaiah

Timothy James Hahn

Jacob Daniel Eisinger

Ritchard Leonard Schacher

Jennifer Elizabeth King

Timothy R Chavez

Simon Gilbert Canning

William Alexander Reichert, Iii

Calvin D Lawrence

David Werner Bachmann

Michael G McIntosh

Simon Helsen

Jose Angel Rodriguez

Parley Avery Salmon

Jiayue Chen

Nicholas George Harlow

Sreedhar C Pranam

Miguel A Ortiz

The example embodiments are directed to a system and method for managing blockchain transaction processing. In an example, the method includes one or more of receiving a message transmitted from a client device, the message including a predefined structural format for processing by a service providing computing system, determining a type of the message and detecting one or more sensitive fields within the message based on the determined type of the message, anonymizing values of the one or more sensitive fields within the message while leaving the predefined structural format intact, and transmitting the anonymized message including the one or more anonymized values with the predefined structural format remaining intact to the service providing computing system. The system can anonymize data from a private network before it is transmitted to a public service.

Data sanitization system for public host platform

A method, system and computer-usable medium for performing an adaptive security operation comprising: performing an authentication operation via a first device, the authentication operation analyzing an obligation performed by a first user; establishing access to a protected resource by the first device based upon the obligation performed by the first user; generating an attribute list comprising at least one attribute of the first device; analyzing a second device to determine whether the second device comprises an attribute corresponding to the at least one attribute of the first device; and, allowing access to the protected resource by the second device when the second device comprises the attribute corresponding to the at least one attribute of the first device.

Federating devices to improve user experience with adaptive security

According to a non-limiting embodiment, a multiple identity resolution system includes an IDaaS integrated with a PaaS. The IDaaS is integrated with a cloud-based network, and an application module installed in the cloud-based network. The application module is configured to deliver content to at least one electronic device. The multiple identity resolution system further includes a service module in signal communication with the application module. The service module is configured to identify a physical user operating the at least one electronic device based on at least one user authentication credential received by the at least one electronic user device and at least one device attribute of the at least one electronic device.

System to resolve multiple identity crisis in indentity-as-a-service application environment

An enterprise server is provisioned with an authentication response language, where the authentication response language allows the enterprise server to issue instructions for authentication steps to an enterprise client, which enables the enterprise client to execute a set of instructions for navigating an authentication sequence. The set of instructions installed into and served by the enterprise server varies depending on a protocol inherently used by the authentication topology. The enterprise client, when accessing a protected resource, and not already authenticated, receives a set of authentication instructions from the enterprise server formulated in the authentication response language. The client starts to interpret the provided authentication instructions, but controls the presentation layer and interface of any user interactions. The client follows the sequence by sending requests and receiving responses from one or more servers in the topology until the sequence is complete.

Abstracting an authentication sequence using HTTP

A computer receives a request for protected user data with an access token presented by a client as authorization for the client to access the protected user data in a delegated environment. The computer parses the request to create a device fingerprint identifying the device submitting the request for the client. The computer compares the device fingerprint of the request to a previously stored device fingerprint of an authorized device associated with the access token. The computer automatically determines whether to identify the access token as potentially misappropriated based on the comparison of the device fingerprint of the request to the previously stored device fingerprint.

Identifying and destroying potentially misappropriated access tokens

The confidentiality of JavaScript Object Notation (JSON) message data is secured using an encryption scheme. The encryption scheme implements a JSON encryption syntax, together with a set of processing rules for creating encrypting arbitrary data in JSON messages in a platform/language independent manner. A method for encrypting a data item in a JSON message begins by applying an encryption method and a key to the data item to generate a cipher value. A data object is then constructed that represents an encryption of the data item. The data item in the JSON message is then replaced with the data object, and the resulting modified JSON message is then output from a sending entity. At a receiving entity, information in the data object is used to re-generate the data item, which is then placed back in the original message.

Method and system for encrypting JavaScript object notation (JSON) messages

An aspect of recovery from rolling security token loss includes storing, in a memory device accessible by a server computer, a token pair (B) transmitted to a client device. The token pair (B) includes an access token (a) and a refresh token (r) and is generated as part of a refresh operation. An aspect also includes storing, in the memory device, a refresh token (r) that was generated by the server computer before generation of the token pair B. The refresh token (r) and the refresh token (r) are each tagged as a valid refresh token. An aspect further includes receiving, at the server computer, a request to access a network resource that includes the access token (a), invalidating the refresh token (r), and providing the client device with access to the network resource.

Recovery from rolling security token loss

A method, system, and computer usable program product for token caching in a trust chain processing are provided in the illustrative embodiments. An information in a token associated with a first request is mapped. A determination is made whether a requester of the first request has provided a constraint in the first request, the constraint concerning the token, the constraint forming a client constraint. The client constraint is stored. The information and the mapped information is stored, forming stored information. The token is received in a second request. The stored information is reused if the client constraint allows reusing the stored information. A further determination may be made whether a target system receiving the mapped information has provided a server constraint, the second constraint concerning the mapped information, the second constraint forming a server constraint. The stored information may be reused if the server constraint allows reusing the stored information.

Token caching in trust chain processing

Methods, systems, and computer program products are provided for controlling a GUI display for a plug-in in an application supporting plug-ins. Embodiments include receiving, at run time, in the application from the plug-in a request to display a GUI object; responsive to the request, retrieving an XML representation of the GUI object; and displaying the GUI object in dependence upon the retrieved XML representation of the GUI object. Typical embodiments also include receiving from the plug-in a request to retrieve user input responsive to the GUI object; and returning to the plug-in responsive user input.

Controlling a GUI display for a plug-in

A method and system is presented to parse a WSDL description and build a hierarchical protected object namespace for authorization of access to the resource, wherein the protected object namespace is based on the abstract part of a WSDL but can be used to assist in authorization decisions for multiple different concrete bindings of this WSDL, wherein the concrete binding/request is based on the WS-Addressing endpoint reference.

Method and system for creating a protected object namespace for a WSDL resource description

A method, system and program are provided for managing the installation and configuration of a software product by using a proxy service to loosely couple the installation and/or configuration of constituent modules within the installation/configuration flow of the software product. The proxy service invokes the installation/configuration processing of an existing software component, thereby reducing the complexity associated with installing new component installation processes every time a component is to be supported, especially where the software products and new component(s) do not share the same installation/configuration platforms.

Loosely coupled product install and configuration

Methods, systems, and computer program products are provided for cross domain security information conversion. Embodiments include receiving from a system entity, in a security service, security information in a native format of a first security domain regarding a system entity having an identity in at least one security domain; translating the security information to a canonical format for security information; transforming the security information in the canonical format using a predefined mapping from the first security domain to a second security domain; translating the transformed security information in the canonical format to a native format of the second security domain; and returning to the system entity the security information in the native format of the second security domain.

Cross domain security information conversion

Growing community of inventors

Austin, TX, United States of America

Patrick Ryan Wardrop