International Business Machines Corporation

Peter Daniel Birk

Ching-Yun Chao

Hyen Vui Chung

Gordan G Greenlee

Richard James McCarty

Keys Dylan Botzum

Nader M Nassar

Vishwanath Venkataramappa

Carlton Keith Mason

Cesar Eduardo Gonzalez Borjon

Ajaykumar Karkala Reddy

James Lee Lentz

Mickella Ann Rosiles

Ching Yun Chao

Hyen-Vui Chung

Alaine DeMyers

Ut Van Lee

Facilities are provided herein for authenticating a user to use a processing device. A user predefines authenticators of one or more types and associates these with graphical images. Upon on attempt to activate the processing device, a graphical image, of the graphical images, is selected for presentation to the user. The selected graphical image is presented to the user, who then provides input to authenticate with the device. A determination is made as to whether the user is authenticated to use the device. The determination is made based on input received from the user and based further on the authenticator associated with the selected graphical image. Varying the selection of image(s), each associated with a predefined authenticator and authentication type, enables variability in the authenticator that is suitable for unlocking a device at a given time, providing greater security to the authentication process.

Variable image presentation for authenticating a user

A real-time plugin command-driven administrative control interface is provided that implements direct real-time command-driven control of operational functionality of application server plugins deployed at a group of application servers. One of request-level application server functionality and server-level application server functionality of at least one of the group of application servers is changed by issuing a real-time application-server plugin command received from the real-time plugin command-driven administrative control interface to a deployed application server plugin.

Dynamic extensible application server management

The present invention relates to a secure caching technique for shared distributed caches. A method in accordance with an embodiment of the present invention includes: encrypting a key K to provide a secure key, the key K corresponding to a value to be stored in a cache; and storing the value in the cache using the secure key.

Secure caching technique for shared distributed caches

An administrative control interface is provided that controls deployed application server plugins that operate within an application-server plugin framework deployed at a group of application servers. The administrative control interface controls dynamic adjustment of runtime application server plugin configurations that perform request-level management and server-level management of the group of application servers. Request-level application server functionality and server-level application server functionality of at least one of the group of application servers is controlled using at least one of the deployed application server plugins as specified by application-server plugin commands received from the administrative control interface.

A method and apparatus for preventing rogue implementations of a security-sensitive class interface are provided. With the method and apparatus, a unique identifier (UID) is created by a server process when the server process is started. Anytime the server process, i.e. a server runtime environment, instantiates a new credential object following start-up of the server process, the encrypted UID is placed into a private field within the new credential object. In addition, the UID is encrypted and stored in a private class of the server runtime environment. A verification class is provided within the server runtime environment which includes one or more methods that receive the credential object as a parameter and return true or false as to the validity of the credential object. These one or more methods determine the validity of the credential object by retrieving the encrypted UID from the private class stored in the server runtime environment, decrypting the UID and comparing it to the decrypted UID stored in the private field of the credential object. If the two UIDs match, a determination is made that the credential object was created by the server runtime environment rather than a rogue application. If the two UIDs do not match, or if there is no UID in the credential object, then a false result will be returned by the verification class.

Method and apparatus for preventing rogue implementations of a security-sensitive class interface

Systems, methods and media for managing and generating encryption keys are disclosed. In one embodiment, a processor executes encryption key processing computer code to receive requests for keys from an application program. The processor determines whether the requesting application program executes on a node or server that is within the scope of machines authorized to receive the requested keys. If authorized, the processor produces a key map and sends the key map to the application program, enabling the application program to access one or more keys in the key map. The keys are updated automatically according to a specifiable schedule.

Systems and methods for management and auto-generation of encryption keys

Objects on application servers are distributed to one or more application servers; a user is allowed to declare in a list which objects residing on each application server are to be protected; the list is read by an interceptor; responsive to exportation of a Common Object Request Broker Architecture ('CORBA') compliant Interoperable Object Reference ('IOR') for a listed object, the interceptor associates one or more application server security flags with interfaces to the listed objects by tagging components of the IOR with one or more security flags; and one or more security operations are performed by an application server according to the security flags tagged to the IOR when a client accesses an application server-stored object, the security operations including an operation besides establishing secure communications between the client process and the server-stored object.

Application server object-level security for distributed computing domains

A system and method for tracking user security credentials in a distributed computing environment. The security credentials of an authenticated user includes not just his unique user identifier, but also a set of security attributes such as the time of authentication, the location where the user is authenticated (i.e., intranet user v. internet user), the authentication strength, and so on. The security attributes are used in access control decisions. The same user can be given different authorization if he has a different security attribute value. Security credentials may be generated either by WebSphere security code or by third party security provider code. This invention stores the user credentials in a distributed cache and provides a system and method to compute the unique key based on the dynamic security credentials for cache lookup.

Dynamic cache lookup based on dynamic data

Preventing rogue implementations of a security-sensitive class interface

An extensible token framework is provided for identifying purpose and behavior of run time security objects. The framework includes a set of marker token interfaces, which extends from a default token interface. A service provider may implement one or more marker token interfaces for a Subject or a thread of execution. A service provider may also implement its own custom marker tokens to perform custom operations. The security infrastructure runtime recognizes behavior and purpose of run time security objects based on the marker or custom marker token interfaces the token implements and handles the security objects accordingly.

Method and apparatus for identifying purpose and behavior of run time security objects using an extensible token framework

A method for tracking security attributes along invocation chain using secure propagation token. When a user is authenticated, a propagation token is created. The propagation token includes a caller list, a host list, and custom attributes. The propagation token may be propagated downstream along with other marker tokens. A service provider may associate custom attributes in the propagation token or create custom propagation token to be propagated. The propagation token tracks the original caller and subsequent callers when user switches occur and a list of hosts at which the propagation token lands on.

Growing community of inventors

Austin, TX, United States of America

Peter Daniel Birk