International Business Machines Corporation

Green Market Square Limited

Timo Kussmaul

Uwe Karl Hansmann

Thomas Steinheber

Andreas Nauerz

Thomas Stober

Stephan Laertz

Kai Brennenstuhl

Hendrik Haddorp

Andreas Prokoph

Daniel Blum

Richard Jacob

Klaus Rindtorff

Stefan Schmitt

Andreas Stay

Joachim Hagmeier

Joachim Bruchlos

Vijay Ekambaram

Angel Nunez Mencias

Andreas Arning

Matthias Falkenberg

Stefan Liesche

Dietmar Kuebler

Stefan Behl

Oliver Then

Jan Paul Buchwald

Daniel Kaulen

Peng Hui Jiang

Smitkumar Narotambhai Marvaniya

Dieter Buehler

Thomas Pohl

Carsten Leue

Torsten Teich

Harald Daur

Stephen Laertz

Dennis Zeisberg

Armelle Parfaite Gaha Tchamabe

Sugandha Agrawal

Sneha Mondal

Xiang Dong Hu

Jan Engehausen

Jean-Baptiste Joret

Sebastian Hense

Dimitrij Pankratz

Florian Fritz

Padmanabha Venkatagiri Seshadri

Michael Man Behrendt

Oliver Koeth

Stefan Koch

Peter Fischer

Torsten Steinbach

Sven Sterbling

Stephan Hesmer

Ralf Altrichter

Udo Schoene

Martin Tröster

Simon Spinner

Ralf Schaufler

Muhammad Usman Karim Khan

Gregor Möhler

Sachin Lingadahalli Vittal

Michael Haide

Manuela Kohler

Hendrick Haddorp

Andreas Fried

Alexander Eckert

A computer-implemented method for building and using a multi-party Attestation Model for controlling operation of a multi-tenant cloud infrastructure which includes providing a trusted execution environment (TEE) within the multi-tenant cloud infrastructure, receiving a set of requirements from each of a plurality of tenants of the multi-tenant cloud infrastructure, building an Attestation Model according to the sets of requirements, and deploying the Attestation Model within the TEE. In response to a determination that a change does not satisfy the Attestation Model for each of the plurality of tenants, a function is performed to separate components shared between tenants for which the change satisfies the Attestation Model from components shared between tenants for which the change does not satisfy the Attestation Model, and the change is deployed on the multi-tenant cloud infrastructure for the tenants for which the change satisfies the Attestation Model.

Building and using attestation model in confidential computing

The present disclosure relates to a method for enabling a securing of cryptographic operations executed by a stateless hardware security module for a client workload, the method comprises a key generation request from the client workload and an attestation document, verifying the key generation request and attestation document, determining workload requirements for the client workload, generating a cryptographic key and encoding the determined workload requirements as attributes of the generated cryptographic key. The generated cryptographic key and the attributes, which are cryptographically secured using a hardware security module key, are returned to the client workload.

Enabling a securing of cryptographic operations

In an approach, a processor indexes system documents of a computer system using a text search engine, resulting in a search index, where the computer system is described by a set of system parameters with values stored in the system documents. A processor provides a set of scheduling rules for allocating computing resources of the computer system, each scheduling rule comprising a search query referencing one or more of the system parameters. A processor executes search queries by the text search engine against the search index, resulting in scored system documents and associated search queries. A processor ranks at least part of the set of scheduling rules using scores of the associated search queries. A processor selects scheduling rules in accordance with the ranking. A processor executes the selected scheduling rules for scheduling a workload on the computer system.

Scheduling a workload in a computer system

In an approach to improve service routing, embodiments route a service request to an execution environment. Embodiments provide a plurality of execution environments, wherein in each execution environment executable services are deployable, provide a service registry maintaining a plurality of execution environments, and receive, by the service registry, a service routing request. Further, embodiments determine a required trust level for a service relating to the service routing request by using a trained machine-learning system for outputting a trust level class when receiving service context data of the service relating to the service routing request as input, determine, using the service registry, a set of execution environments matching the output trust level class, and select, by the service registry, one execution environment of the determined set of execution environments. Further, embodiments route, by the service registry, the service request to the selected one of the execution environments for execution.

Data privacy workload distribution in a multi-tenant hybrid cloud computing environment

Building and using a smart contract in order to resolve the isolation between database users and service operators for hyper-protect database as a service (DBaaS). The use of the smart contract in the hyper-protect DBaaS environment allows the service operator to perform operations on sensitive and secure data in the database owned by a user without necessarily revealing the content of the sensitive and secure data.

Using smart contracts to manage hyper protect database as a service

A computer implemented method and related system control access to data based on query intent and result semantics in a cognitive search system, the method including receiving a query from a user at a location, wherein the query is configured to identify a set of results. The method also includes, identifying the location and validating the user is authorized to access one or more indexes. The method includes, determining an intent of the query, wherein the intent predicts how the user will use the set of results. The method includes, establishing a first intent geofence, wherein the intent geofence defines a first geographic area. The method includes obtaining a plurality of results from a first index, determining the location of the user is within the first intent geofence, and returning the plurality of results to the user.

Geofencing queries based on query intent and result semantics

A computer-implemented method for monitoring and auditing secure software builds is disclosed. The computer-implemented includes receiving a build file containing a sequence of build instructions. The computer-implemented method further includes, for each build instruction being executed: determining an indicator value corresponding to a monitoring level associated with a build instruction; and modifying logging of trace information associated with a computing system executing the build instruction based, at least in part, on the indicator value corresponding to the monitoring level.

Monitoring and auditing secure software builds

Aspects of the present invention disclose a method, computer program product, and system for query execution in a multi-tenant cloud service. The method includes one or more processors determining category classes for service queries. The method further includes sending for execution, a selected number of service queries from one of the determined category classes to a shadow query engine. Respective service queries of the categorically classified service queries comprise a different set of configuration parameter values for the shadow query engine. The method further includes recording metadata for the selected number of service queries of the one category class executed on said shadow query engine. The method further includes determining correlations between the recorded metadata. The method further includes determining, from the determined correlations, optimal configuration parameter values comprising optimal configuration parameters for executing the selected number of service queries of the one category classes.

Shadow experiments for serverless multi-tenant cloud services

Provided are techniques for mode-specific search query processing. A current search query is received from a user, where the user has a user profile, and where the user profile has a public portion and a private portion. A query mode and a query context for the current search query are determined. In response to determining that the query mode is a guided mode, the current search query is rewritten based on the query context, the private portion of the user profile of the user, and the public portion of each corresponding user profile of each of one or more search influencers to generate a first rewritten search query; the first rewritten search query is executed to generate first search results; and the first search results are returned. In response to determining that the query mode is one of a public mode and a private mode, the current search query is rewritten based on the query context and the private portion of the user profile of the user to generate a second rewritten search query; the second rewritten search query is executed to generate second search results; and the second search results are returned.

Mode-specific search query processing

A computer-implemented method for securely transferring a secret from a source computing component to a target computing component, wherein the source computing component and the target computing component are part of a secure computing environment is disclosed. The method comprises upon the source computing component receiving from the target computing component a signed attestation document, verifying, by the source computing component, an authenticity and content of the attestation document, and upon a successful verification of the authenticity and the content, transferring, by the source computing component the secret to the target computing system. Thereby, the attestation document is attesting that the target computing component is compliant to an update governance rule.

Trusted system upgrade and secrets transfer in a secure computing environment

A computer-implemented method for building trusted executable software using trusted building units, wherein a path between the building units is untrusted, is disclosed. The method comprises generating, by each of the trusted building units, an identifier for identifying an output of the respective trusted building unit, wherein the respective trusted building unit also generates a signed confirmative certificate comprising the identifier. The method comprise as well utilizing, by each of the distributed trusted building units, output results of at least one of a predecessor build unit of the trusted building unit as input, validating that each of the signed confirmative certificates conforms to a predefined set of policy rules, and upon a failed validating of the signed confirmative certificate of one of the trusted building units, terminating the building of the trusted executable software.

Trust validation for software artifacts

A computer-implemented method for execution of a service in a distributed environment, the method comprising performing a speculative execution of a service and storing a related result, wherein a decision whether the speculative execution of the service is performed is dependent on a dynamically changing score value and receiving a request for an execution of the service at a request proxy. Additionally, the method comprises upon determining that a valid result of the execution of the service is available from an earlier speculative execution of a comparable service, returning the valid result by the request proxy, and upon determining that a valid result of the execution of the service is not available from an earlier speculative execution of a comparable service, executing the service in a non-speculative manner, and returning a received non-speculative result by the request proxy.

Speculative service execution

The present invention provides a method and system for storing and retrieving tags. Each tag is associated with a resource, upon a user's request. A tagging GUI is displayed which presents the available tags for one particular resource and/or a tag cloud GUI is displayed which presents tags for more than one resource. The tagging GUI allows to assign new tags to single resources. The tag cloud GUI enables users to search for resources which have been assigned certain tags. In the tag cloud GUI the relevancy of each single tag is visually reflected by its weighting factor which is determined by the frequency of occurrence. The method is characterized by the further steps:

Tag weighting engine using past context and active context

A server system and methodology include the following operations. A request for tags associated with a resource is received from a tag widget associated with the resource. Responsive to the request, a tag weighting engine is executed that identifies the tags and determines, respectively, individual overall weighting factors for each of the tags. The tags and associated overall weighting factors are forwarded to the tag widget within the client. The individual overall weighting factors for a particular tag is based upon a combination of weighting factors including a context weight factor for the particular tag. The context weighting factor for the particular tag is based upon a past context for the particular tag specified by a past user and an active context in which a user of the tag widget is operating.

The present disclosure relates to a method comprising receiving an electronic message. Message intents of the received electronic message and one or more related intents may be determined. An electronic message may be generated according to a selected subset of the message intents or according to the related intents. The generated electronic message may be provided.

Method for electronic messaging

Growing community of inventors

Boeblingen, Germany

Timo Kussmaul