International Business Machines Corporation

Todd Weston Arnold

Richard Victor Kisley

Elizabeth A Dames

Carsten D Frehr

Eric B Smith

Michael James Kelly

Eric David Rossman

Kenneth B Kerr

Michael J Miele

Mark D Marik

Mark Anthony Check

Vincenzo Condorelli

James W Sweeny

Jimmie Ray Mayfield

Charles D Helfenberger

David Carroll Challener

John C Dayka

Thomas J Dewkett

Dennis G Abraham

Eysha S Powers

William S Rohland

Steven George Aden

Clifford L Hansen

Steven W Neckyfarow

Steven R Hart

Geoffrey George Jackson

Shelia M Sittinger

Kurt S Jacobsen

Jesper Wiese

Phillip H Griffin

Barry Michael Graham

Barry Douglas Atkins

Gerald K Boyter

Alexandra Urman

Shenbaga Shankar

Adrian Papacica

A microservices-management system intercepts a request for a cloud-based microservice sent by a microservices-architecture application. The system selects an optimal cloud-service provider from a group of candidate providers capable of delivering the microservice and then forwards the request to the optimal provider. The optimal provider is selected by drawing cognitive inferences from stored blockchain records that each describe a characteristic of a previous delivery of the requested service. Each record is generated by one of the candidate providers when delivering an instance of the microservice, regardless of whether the provider is in a trusted relationship with the application owner. The providers are barred by blockchain's intrinsic security features from altering or deleting previously stored blockchain records. Upon delivery of the service, the system compares the actual quality or cost of the delivery with predicted values in order to learn how to more effectively select optimal providers.

QoS-optimized selection of a cloud microservices provider

Embodiments are directed to a computer-implemented method and system for generating a transport key. A method can include generating, using a processor, a key agreement pair comprising a public agreement key and a private agreement key in a second element. Thereafter, generating, using the processor, a transport key based on the public agreement key in a first element. Then sending, using the processor, an information blob to the second element. Finally, independently generating, using the processor, the transport key in the second element using the information blob and the private agreement key. The transport key can thereafter be used to send information securely between the first and second elements.

Key exchange process

Customer content is securely loaded on a field programmable gate array (FPGA) located on a secure cryptography card. The customer content is loaded such that it may not be extracted. A customer obtains a secure cryptography card that includes a field programmable gate array and a master key generated by the secure cryptography card. The customer loads customer specific content on the field programmable gate array, wherein, based on the loading, the customer specific content is secure from extraction via the master key by at least entities other than the customer.

Customer load of field programmable gate arrays

In one embodiment, a computer-implemented method includes extracting first key derivation data from a first row of data to be stored in a database, where the database includes two or more rows of data. A first encryption subkey is generated, by a computer processor, by combining the first key derivation data with a static key. One or more sensitive fields in each row of the two or more rows of the database are encrypted using a unique corresponding encryption subkey for the row, and the first encryption subkey is unique to the first row among the two or more rows of the database. The one or more sensitive fields in the first row of data are encrypted with format-preserving encryption using the first encryption subkey. The first row of data, including the encrypted one or more sensitive fields, are stored in the database.

Secure format-preserving encryption of data fields

An aspect of cipher text translation includes a memory configured to store predetermined conditions for performing an encryption operation, and a processor communicatively coupled to the memory. The processor is configured to execute computer readable instructions. The computer readable instructions include determining through analysis of an inbound key and an outbound key of the encryption operation that the encryption operation includes a translation from a first class of encryption to a second class of encryption. The second class of encryption is determined to be weaker than the first class of encryption. The instructions also include applying the predetermined conditions to the input key and the output key and authorizing the translation via the processor, based on the applying, when aspects of the predetermined conditions are satisfied.

Cipher text translation

A session key is negotiated to secure a user session executed in a host computer. An electronic hardware security module (HSM) located in the host computer generates a first session key. A smart card generates a second session key that matches the first session key. An encrypted copy of the second session key is communicated to an electronic host application module installed in the host computer. The electronic host application module decrypts the encrypted session key to obtain a copy of the session key such that the first and second session keys possessed by the smart card, the host application module and the HSM match one another.

Dual-party session key derivation

A method, computer program product, and system for selecting and generating a key to perform a cryptographic operation are described. The method includes receiving one or more inputs representing criteria for the key, the one or more inputs excluding an explicit identification of the key and one of the one or more inputs specifying the cryptographic operation; retrieving, from a memory device, information corresponding with the one or more inputs; selecting and generating the key based on the one or more inputs and the information; and performing the cryptographic operation using the key.

Intelligent key selection and generation

Embodiments relate to negotiating a session key to secure a user session executed in a host computer. An electronic hardware security module (HSM) located in the host computer generates a first session key. A smart card generates a second session key that matches the first session key. An encrypted copy of the second session key is communicated to an electronic host application module installed in the host computer. The electronic host application module decrypts the encrypted session key to obtain a copy of the session key such that the first and second session keys possessed by the smart card, the host application module and the HSM match one another.

A computer system includes memory configured to store information regarding predetermined conditions of an encryption operation and a processor configured to analyze an inbound key and an outbound key of the encryption operation. The processor is also configured to determine that the encryption operation includes a translation from a first class of encryption to a second class of encryption based on the analyzing the inbound key and the outbound key, and to determine whether the translation is permitted based on the predetermined conditions.

Growing community of inventors

Charlotte, NC, United States of America

Todd Weston Arnold