International Business Machines Corporation

Stefan Berger

Reiner Sailer

Kenneth Alan Goldman

Ronald Perez

Enriquillo Valdez

Chandrasekhar Narayanaswami

Dimitrios Pendarakis

Ramon Caceres

Trent Ray Jaeger

Mandayam Thondanur Raghunath

Ashish Kundu

Nataraj Nagaratnam

Marc Philippe Stoecklin

Sreekanth Ramakrishna Iyer

Paul Anthony Ashley

He Huang

Douglas Lee Schales

Ronald B Williams

Josyula R Rao

Xin Hu

Tian Cheng Liu

Yangyi Chen

Hui Lei

Chatschik Bisdikian

David R Safford

Steven A Bade

Vijay Krishnarao Naik

Arup Acharya

Daby Mousse Sow

Shu Tao

Mahmoud Naghshineh

Nathan J Lee

Leendert Peter Van Doorn

Jayaram Kallapalayam Radhakrishnan

Simon J Kofkin-Hansen

Deepa Srinivasan

Veronique Perret

Trenton Ray Jaeger

Dimitrious Pendarakis

A method includes collecting system calls and call parameters invoked by monitored applications for target computer systems. The system calls and call parameters are received from operating system kernels on the plurality of target computer systems. Sequences of systems calls and call parameters of the monitored applications are correlated among different target computer systems to deduce malicious activities. Remedial action(s) are performed in response to malicious activities being deduced as being malicious by the correlating. Another method includes determining that network activity at a specific time is deemed to be suspicious. Using IP addresses involved in the suspicious network activity, computer system(s) are determined that are sources of the suspicious network activity. Based on the specific time and the determined computer system(s), application(s) are determined that are executing on the determined computer system(s) that are causing the suspicious network activity. Remedial action(s) are performed for the determined computer system(s).

Computer implemented techniques for detecting, investigating and remediating security violations to IT infrastructure

A method, system, and program product for remotely attesting to a state of computing system is provided. Specifically, the present invention allows a remote system to establish trust in the properties of the computer system. The properties to be trusted are expanded from the usual system software layers and related configuration files to novel types of data such as static data specific to the computer system, dynamic data determined at system startup, or dynamic data created as the computer system runs applications.

Method, system, and program product for remotely attesting to a state of a computer system

Examples of techniques for deploying an application on a cloud environment satisfying integrity and geo-fencing constraints are disclosed herein. A computer implemented method may include: receiving a guest application for deployment on a cloud environment; receiving the integrity constraints on the integrity of each of the plurality of host where the application is to be deployed; receiving geo-fencing constraints identifying a geographic location where the guest application is to be deployed; determining for which of the plurality of hosts the integrity constraints and the geo-fencing constraints are satisfied; and deploying the guest application on at least one of the plurality of hosts that satisfy the integrity constraints and the geo-fencing constraints.

Application deployment and monitoring in a cloud environment to satisfy integrity and geo-fencing constraints

A method includes retrieving, from a memory accessible by a computer, a document comprising a workload definition document that defines an intended virtual configuration to include at least one virtual machine and at least one network appliance to be associated with at least one of the virtual machines in the intended virtual configuration, each network appliance respectively serving a role in the intended virtual configuration of transforming, inspecting, filtering, or otherwise manipulating all the network traffic, before it reaches an intended virtual machine, for purpose other than a data packet forwarding in a virtual configuration. The workload definition document is parsed to extract attributes of each of the network appliances, including one or more security policy to be applied to each network appliance. Configuration data is extracted from the parsed workload definition document that is related to any security policy of any of the network appliances to be deployed. A security template library is accessed to select a security template for each network appliance that will implement the one or more security policy for that network appliance to be deployed.

System and method for software defined deployment of security appliances using policy templates

A system for monitoring performance of a machine for detection of visible signs of failure, includes: a machine enclosure housing machine parts; at least one canal through the machine enclosure acting as a visual conduit for providing a view into the interior of the machine; a guide rail within the canal for moving a camera into the interior; an interface to the machine configured to receive images from the visual conduit; and a repair network for linking the interface to a monitoring center that provides for the repair of problems with the machine.

Sensor for imaging inside equipment

A computer implemented method for logging extensions to platform configuration registers inside a trusted platform module instance is provided. A request to extend the current state of at least one of a plurality of platform configuration register is received. At least one platform configuration register within the trusted platform module instance is extended. The extension of the at least one platform configuration register is logged inside the trusted platform module instance as a logged entry by storing at least a tuple of platform configuration register indexes and hash values used for extending the platform configuration register. Information about new entries in the consolidated logs can be retrieved by polling or by subscribing to events that are automatically generated. A report of an extend operation and its logged hash value is sent to subscribers interested in receiving notifications of extend operations on a set of PCR registers.

Method and apparatus for scalable integrity attestation in virtualization environments

A trusted platform module is presented that is capable of creating, dynamically, multiple virtual trusted platform modules in a hierarchical organization. A trusted platform module domain is created. The trusted platform module creates virtual trusted platform modules, as needed, in the trusted platform module domain. The virtual trusted platform modules can inherit the permissions of a parent trusted platform module to have the ability to create virtual trusted platform modules themselves. Each virtual trusted platform module is associated with a specific partition. Each partition is associated with an individual operating system. The hierarchy of created operating systems and their privilege of spawning new operating systems is reflected in the hierarchy of trusted platform modules and the privileges each of the trusted platform modules has.

Dynamic creation and hierarchical organization of trusted platform modules

A migration scheme for virtualized Trusted Platform Modules is presented. The procedure is capable of securely migrating an instance of a virtual Trusted Platform Module from one physical platform to another. A virtual Trusted Platform Module instance's state is downloaded from a source virtual Trusted Platform Module and all its state information is encrypted using a hybrid of public and symmetric key cryptography. The encrypted state is transferred to the target physical platform, decrypted and the state of the virtual Trusted Platform Module instance is rebuilt.

Migrating a virtual TPM instance and preserving uniqueness and completeness of the instance

Method and apparatus for migrating a virtual TPM instance and preserving uniqueness and completeness of the instance

A system for monitoring performance of a machine for detection of visible signs of failure, the system including: a machine enclosure housing a plurality of machine parts; a visual conduit for providing a view of an interior of the machine; an interface to the machine configured to receive images from the visual conduit; and a repair network for linking the interface to a monitoring center that provides for the repair of problems with the machine.

Growing community of inventors

New York, NY, United States of America

Stefan Berger