International Business Machines Corporation

Xiaoyan Y Zhang

Bruce Arland Rich

Anthony Joseph Nadalin

Theodore Jack London Shrader

Davis Kent Soper

Randy Scott Humphrey

Krishna Kishore Yellepeddy

David Gerard Kuehr-McLaren

Jose I Ortiz

Chunlong Liang

Jose Angel Rodriguez

Edward Joseph Dobner

James T Mulvey

An approach for optimizing security token exchange. The approach receives a first request from a client. The approach extracts a first security token and an API reference. The approach validates the first security token. If the security token is valid, then the approach, calls the API and retrieves a second security token, embeds the second security token in the API and sends a second request with a third security token and the reference to the API to another application in a different domain.

Securely preserving prior security tokens for recall

A method, system, and computer usable program product for protocol based key management are provided in the illustrative embodiments. A key management protocol associated with a key request is identified, the key request being a request for data usable in cryptographic security. A first subset is selected from a set of policies using the key management protocol. A set of permissions is computed based on the first subset of policies, the set of permissions indicating whether the key request is permitted under the key management protocol. The set of permissions is cached in a cache in a data storage device.

Protocol based key management

A client generates a session key and a delegation ticket containing information for a requested delegation operation. The client generates a first copy of the session key and encrypts it using a public key of a proxy. The client generates a second copy of the session key and encrypts it using a public key of a server. The client then puts the encrypted session keys and delegation ticket into a first message that is sent to the proxy. The proxy extracts and decrypts its copy of the session key from the first message. The proxy then encrypts a proof-of-delegation data item with the session key and places it and the delegation ticket along with the encrypted copy of the session key for the server into a second message, which is sent to the server. The server extracts and decrypts its copy of the session key from the second message and uses the session key to obtain the proof-of-delegation data. Authority is successfully delegated to the proxy only if the server can verify the proof-of-delegation data.

Method and system for a PKI-based delegation process

A method, apparatus, and computer implemented instructions for synchronizing time in a network data processing system. A request for time synchronization is received at a target data processing system. A current target time at the target data processing system is placed in a reply. The reply is sent to the source data processing system. A current source time from when the reply is received at the source data processing system is compared to the current target time to generate a comparison. A synchronization factor is generated using the comparison.

Method and apparatus for time synchronization in a network data processing system

A method, an apparatus, a system, and a computer program product are presented for validating certificates. A certificate validation service receives a certificate validation request for a target certificate from a client, thereby allowing the client to offload certificate validation tasks into an online certificate validation service that is accessible and sharable by multiple components within a data processing system. In response to a determination that the target certificate is valid or invalid, the certificate validation service sends a certificate validation response with an indicating status value that the target certificate is valid or invalid. The certificate validation service is able to cache information about previously validated certificates and the associated certificate chains, thereby enhancing the efficiency of the service. Different certificate validation policies may be applied against target certificates based upon information associated with the target certificates.

Method and system for certification path processing

An analysis of at least one authentication token for an application is provided. At least one login module within the application is identified. Responsive to a failure to access the application, principal information is retrieved associated with the at least one login module. A recovery action is then generated. The recovery action corresponds to the failure and the principal information.

Architecture for the graphical management and analysis of authentication tokens

A method, program and system for mapping ASN.1 data to an object model are provided. The invention consists of identifying the start of a data stream and then generating a new object name for the data. Next, the data is parsed to get the identifier and the data length. Then the data's tag type is analyzed. If the tag type is simple, a class diagram is generated for the data and then the source code for the data is generated. If the tag type is not simple, a subroutine is called to further parse the data before generating the class diagram and source code.

Strategy for dynamically modeling ASN.1 data to an object model

A method and apparatus for establishing a secure communication connection between a Java application or applet and a secure server is provided. An HTTPS handler is provided that may be used by Java applications or applets to establish secure communication connections with secure Web servers.

Growing community of inventors

Austin, TX, United States of America

Xiaoyan Y Zhang