International Business Machines Corporation

Trent Ray Jaeger

Ronald Perez

Reiner Sailer

Pankaj Rohatgi

Shai Halevi

Grant W Wagner

Paul Ashley Karger

Pau-Chen Cheng

Stefan Berger

Michael Steiner

Enriquillo Valdez

Angela Marie Schuett

Nayeem Islam

Jochen Liedtke

Liangzhao Zeng

Kenneth Alan Goldman

Lawrence H Koved

Xiaolan Zhang

Vsevolod V Panteleenko

Zhen Liu

Anton Viktorovich Riabov

Genady Grabarnik

Nagui Halim

Mark David Feblowitz

Kay Schwendimann Anderson

Rangachari Anand

Leendert Peter Van Doorn

Jonathon Earnshaw Tidswell

Kevin John Elphinstone

Frederique-Anne Giraud

A method, system, and program product for remotely attesting to a state of computing system is provided. Specifically, the present invention allows a remote system to establish trust in the properties of the computer system. The properties to be trusted are expanded from the usual system software layers and related configuration files to novel types of data such as static data specific to the computer system, dynamic data determined at system startup, or dynamic data created as the computer system runs applications.

Method, system, and program product for remotely attesting to a state of a computer system

A unified program analysis framework that facilitates the analysis of complex multi-language software systems, analysis reuse, and analysis comparison, by employing techniques such as program translation and automatic results mapping, is presented. The feasibility and effectiveness of such a framework are demonstrated using a sample application of the framework. The comparison yields new insights into the effectiveness of the techniques employed in both analysis tools. These encouraging results yield the observation that such a unified program analysis framework will prove to be valuable both as a testbed for examining different language analysis techniques, and as a unified toolset for broad program analysis.

Methods and arrangements for unified program analysis

The present invention provides a computer-implemented method system and program product for remotely verifying (e.g., analytic) integrity of a system. Specifically, at startup of the system an access control policy that sets forth information flows within the system is read and a set of trusted subjects that interact with a target application in the system is determined. Based on the access information flows and the set of trusted subjects, an information flow graph of the system is constructed. At runtime of the target application, runtime information and program code loaded into the set of trusted subjects are measured. Measuring the program code that is loaded allows the remote party to verify that the program code is 'expected' program code for the set of trusted subjects.

Method, system and program product for remotely verifying integrity of a system

An exemplary method is provided for managing and mitigating security risks through planning. A first security-related information of a requested product is received. A second security-related information of resources that are available for producing the requested product is received. A multi-stage process with security risks managed by the first security-related information and the second security-related information is performed to produce the requested product.

Method of managing and mitigating security risks through planning

An access control system and method includes a risk index module which computes a risk index for a dimension contributing to risk. A boundary range defined for a parameter representing each risk index such that the parameter above the range is unacceptable, below the range is acceptable and in the range is acceptable with mitigation measures. A mitigation module determines the mitigation measures which reduce the parameter within the range by mapping the effectiveness of performing the mitigation measures to determine a residual risk after a mitigation measure has been implemented.

Fuzzy multi-level security

A scheme for protecting policy state information during the lifetime of a virtual machine is presented. In order to protect and preserve the policy state information of the virtual machine, a process creates a source policy, a mapping policy, and a binary policy. These policies are all different representations of a security policy. The different policy representations are chained together via cryptographic hashes.

Method and apparatus to protect policy state information during the life-time of virtual machines

An access control system and method includes a risk index module which computes a risk index for a dimension contributing to risk. A boundary range defined for a parameter representing each risk index such that the parameter above the range is unacceptable, below the range is acceptable and in the range is acceptable with mitigation measures. A mitigation module determines the mitigation measures which reduce the parameter within the range.

System and method for fuzzy multi-level security

A method and system for performing interprocess communications (IPCs). The method comprises the steps of receiving IPC requests, where each of the IPC requests identifies a source and a destination; building IPCs in response to the request: transmitting the IPCs from the sources to the destinations; and intercepting and examining selected ones of the IPCs. The method comprises the further step of controlling the synchrony of the IPCs so that each IPC appears to its source and destination to be implemented according to the same semantics regardless of whether the IPC is intercepted and examined. With the preferred embodiment of this invention, the system monitors are considered as an extension of the system kernel (although they may be linked into the kernel and run in kernel mode as well), so the source and destination are treated as if the kernel is still processing the IPC. Thus, the desired. semantics of communication can be implemented in the monitors.

Mechanism for synchronous interprocess communication over transparent external monitors

A mechanism for inter-process communication (IPC) redirection is defined that enables flexible and dynamic management of IPC paths. In some cases, it is desirable to interpose a process on a communication channel. There are a number of uses of such interposition, ranging from auditing communication to capturing requests for a debugger to authorizing operations expressed in the communication. Prior IPC mechanisms typically do not enable dynamic and flexible interposition. Either interposition is ingrained in the process identity or is done in an ad hoc manner (e.g., by inserting code into the kernel). An IPC mechanism is defined that enables a communication from a source to a destination to be arbitrarily redirected. Services, called redirection controllers, are defined that are able to specify the redirections for IPC paths. Redirections may be set up dynamically because the redirection data is not dependent on permanent information like the process identifier, but rather, they are left to the discretion of the redirection controllers.

Flexible interprocess communication via redirection

A server complex including at least one hit server with item cache, used to process read and write operations relating to cached items from clients, and at least one miss server, serving as a link to other servers (e.g., web servers, file system servers, and databases) for receiving requests relayed from the hit server(s) which relate to non-cached items and for responding to same. The hit server is a general-purpose, generic, component, which is independent of concrete applications and is basically responsible for the performance; while a miss server is a highly-customizable component, which is responsible for flexibility, and is application specific. The inventive architecture provides improved performance whereby a server complex achieves exceptionally high throughput rates for local services (i.e., services using items in the local item cache); flexibility, whereby a server complex can support the enforcement of a variety of application-specific policies for item management, authentication, and item consistency; security, whereby a server complex can enable the verification of the source, integrity, and freshness of communications over untrusted links; and, scalability, whereby a server complex is expandable by adding server components and implementing customized item consistency policies.

Powerful and flexible server architecture

Growing community of inventors

Port Matilda, PA, United States of America

Trent Ray Jaeger