International Business Machines Corporation

Satoshi Makino

Michiaki Tatsubori

Takeshi Imamura

Toshiro Takase

Masayoshi Teraguchi

Kent Tamura

Todd Eric Kaplinger

Yuichi Nakamura

Naohiko Uramoto

Hisashi Miyashita

Yuhichi Nakamura

Ai Ishida

Hyen Vui Chung

Kenichiro Ueno

Markup language security messages are processed. A template corresponding to a markup language security message is identified. The markup language security message is parsed for variable values using the template. A transition sequence is generated that represents the entire markup language security message. Each transition in the transition sequence is associated with a portion of the markup language security message. A lightweight data model of the markup language security message is populated using the transition sequence. The lightweight data model includes nodes for the variable values and a set of selected constant values.

Processing extensible markup language security messages using delta parsing technology

A executable content message stream filter applies a plurality of executable content filters to a stream of parsed elements of a network message. Each of the plurality of executable content filters targets executable content and is instantiated based on a set of one or more rule sets selected based, at least in part, on a type of the network message. For each of the plurality of executable content filters, it is determined if one or more of the stream of parsed elements includes executable content targeted by the executable content filter. The executable content message stream filter modifies those of the stream of parsed elements that include the executable content targeted by the plurality of executable content filters to disable the executable content.

Executable content filtering

A method, apparatus, and machine-readable medium to implement executable content filtering is disclosed. According to a one example embodiment, a method is provided which comprises analyzing a stream of one or more parsed elements of a network message with a set of one or more executable content filters, wherein the stream of one or more elements are streamed from a network message parser. The described method embodiment further comprises modifying the stream of one or more parsed elements to disable executable content in the network message based, at least in part, on a set of one or more rule sets being applied with the set of one or more executable content filters to the stream of parsed elements.

The invention provides security policy generation methods and devices for generating a security policy that is set up for an information processing apparatus comprises a step of generating an application model having a transmitter and a receiver of a message decided, for each of a plurality of messages that are communicated, a step of storing in advance a plurality of security patterns with a signer of electronic signature appended to the message as an undecided parameter, a step of selecting a security pattern that is a model of security policy to be setup for the transmitter or receiver of the message, corresponding to each of the plurality of messages included in the application model, and a step of substituting the identification information of the transmitter or receiver of each message included in the application model for the undecided parameter of the security pattern selected corresponding to the message.

Security policy generation

A transformation processing system input data including a data record area for storing target date and a transformation processing identification information record area for storing transformation processing identification information about transformation processing executed upon the target data. The transformation processing system includes: a reverse transformation information recording unit which records a target data pointer indicating the data record area in transformed data, a transformation processing identification information pointer indicating the transformation processing identification information record area, and reverse transformation processing identification information about reverse transformation processing; a target data transformation unit which transforms the target data and records it in the data record area; and a transformation processing identification information recording unit which adds the transformation processing identification information about the transformation processing executed by the target data transformation unit to the transformation processing identification information record area in the input data.

Information, transformation and reverse transformation processing

The invention provides security policy generation methods and devices for generating a security policy that is set up for an information processing apparatus comprises a step of generating an application model having a transmitter and a receiver of a message decided, for each of a plurality of messages that are communicated, a step of storing in advance a plurality of security patterns with a signer of electronic signature appended to the message as an undecided parameter, a step of selecting a security pattern that is a model of security policy to be set up for the transmitter or receiver of the message, corresponding to each of the plurality of messages included in the application model, and a step of substituting the identification information of the transmitter or receiver of each message included in the application model for the undecided parameter of the security pattern selected corresponding to the message.

Provides structured-document processing device for detecting a relationship of approximateness between structured documents effectively. State-transition-diagram information storing means stores information concerning a state transition diagram where source nodes of a source structured document transit in order of occurrence from the head thereof. Extracting means extracting, a pair consisting of a new node and a corresponding source node in accordance with order of occurrence. Matching means determining whether the source and new nodes in the selection pair have matchingness, on the basis of their descriptions. Node qualifying means qualifying the source node as a node to be used for the new node. Transition-history information generating means generates, as transition-history information, information concerning a transition history regarding the node to be used. Degree-of-approximateness detecting means detects a degree of approximateness between the source structured document and the new structured document on the basis of the transition-history information.

Growing community of inventors

Kanagawa-ken, Japan

Satoshi Makino