International Business Machines Corporation

Yi-hsiu Wei

Ching-Yun Chao

David Yu Chang

Scott A Will

David L Leigh

Jason A Collier

Shaw-Ben Shi

Chao Zheng

Ye Qing Chen

Chang Lei

Ting Ting Wu

Wen Juan Nie

Zhen Hong Ding

Zhao Yang

Kathryn Heninger Britton

Dieter Buehler

John William Sweitzer

Chunhui Yang

Nataraj Nagaratnam

Ronald Patrick Doyle

Harigovind Venkatraj Ramasamy

Indrajit Poddar

Anthony Joseph Nadalin

Timothy James Hahn

Geoffrey Martin Hambrick

Rohit Ranchal

I-Lung Kao

William Patrick Higgins

David Werner Bachmann

Sandhya Kapoor

Kamorudeen Larry Yusuf

Uttam Thakore

Spencer James Ainsworth

Kumar S Varadan

Dah-Haur David Lin

Jinchao Hunag

Hui-Ming Lin

Jayakumar Nagarajarao

James Dean Wade

Described are techniques for an access management protocol including a method comprising associating a granted permission set and a constrained permission set to a user profile in an access management system. Respective granted permissions in the granted permission set authorize the user profile to perform the respective granted permissions, and respective constrained permissions in the constrained permission set preclude the user profile from performing the respective constrained permissions. The method further comprises receiving a permission-based request at the access management system and from the user profile and determining that the permission-based request is associated with a permission that is included in both the granted permission set and the constrained permission set. The method further comprises rejecting the permission-based request.

Constrained roles for access management

A method, system, and computer program product for detecting a network application security question is provided. The method includes receiving permission to access social media sources of a user. The social media sources and Internet based sources of the user are monitored in response to receiving the permission and associated data is generated and stored. A request for access to a secure account of the user is received and a list of security questions is presented to the user. The list of security questions is analyzed with respect to the data and each security question is ranked. An answer to a question of the list is received and analyzed and security attributes of the answer with respect to a potential malicious attempt to provide a predicted answer to for access to secure account are determined. A resulting security process with respect to enabling access to the secure account is executed.

Network application security question detection and modification

A method, apparatus, system, and computer program product for facilitating evidence collection. A set of evidence requirements is identified by computer system in which the set of evidence requirements is for a control that manages a set of resources in the computer system to enforce a policy in the computer system. Labels are associated by the computer system with historical evidence for the set of requirements. The historical evidence comprises prior evidence collected for compliance with the set of evidence requirements for the control and was accepted to meet the set of evidence requirements for the control. The historical evidence with the labels form labeled historical evidence. Rules for mining evidence for the set of evidence requirements for the control using the labeled historical evidence are learned by a machine learning model in the computer system.

Evidence mining for compliance management

An example operation may include one or more of connecting, by a feedback controller node, to a blockchain network configured to process transaction proposals through a plurality of endorser nodes connected to an orderer node, receiving, by the feedback controller node, reports from the orderer node that reflect performance of the plurality of the endorser nodes, assigning, by the feedback controller node, rankings to the plurality of the endorser nodes based on the reports, and ordering the transaction proposals to be executed by the plurality of the endorser nodes based on the assigned rankings.

Performance optimization

A system from updating a document to include revisions made by multiple parties that includes an indexing module for building relationships between atom repositories and source files, and a mapping module builds a relationship between multiple atom repositories produced by indexing module that are associated with a same source file family. The system also includes an atom controlling module for controlling atom adding and atom splitting in the multiple atom repository in response to update, insert and delete operations of information units in the source file. The system can also include a synchronizing engine for synchronizing updates from one version of the source file to all versions of the source file in accordance with the atom controlling module that have been made by all users when be viewed by a single user.

Atom-based sensible synchronization for information indexing

An example operation may include one or more of connecting, by a committer node, to a main blockchain comprised of a plurality of initiator nodes, receiving, by the committer node, a transaction from an initiator node of the plurality of the initiator nodes and placing blocks of the transaction on the main blockchain, executing, by the committer node, a request from the initiator node of the plurality of the initiator nodes to branch off a sub-blockchain from the main blockchain, processing, by the committer node, the transaction in the sub-blockchain, detecting, by the committer node, a completion or an ending of the transaction in the sub-blockchain, in response to the detection of the completion of the transaction, committing the transaction to the main blockchain, in response to the detection of the ending of the transaction, terminating the transaction in the sub-blockchain, and discarding, by the committer node, the sub-blockchain.

Atomic transactional processing

An example operation may include one or more of connecting, by a participating blockchain (BC) node, to a blockchain network configured to store a plurality of packages, selecting and downloading, by the participating BC node, a package containing a random code variant identified by a unique identifier (ID), executing, by the participating BC node, the package to calculate an outcome associated with the variant ID, receiving, by the participating BC node, votes on outcomes associated with the variant ID and votes on outcomes associated with different variant IDs from other nodes of the blockchain network, and analyzing, by the participating BC node, the votes to determine if the votes on the outcomes associated with the variant ID are different from the votes on the outcomes associated with the different variant IDs.

Prevention of majority attacks

Embodiments of the present invention provide methods, systems, and computer program products for building an environment. Embodiments of the present invention can be used to allocate resources and build an environment such that the environment is built when a user is prepared to test one or more portions of code in the environment. Embodiments of the present invention can be used to reduce the 'lag time' developers experience between waiting for the code to be built and for resources to be provisioned, and can also provide a less costly alternative to maintaining and operating dedicated environments.

Predictive approach to environment provisioning

A mechanism is provided in a data processing system for providing portable composite solutions. The mechanism deploys a set of virtual images for a plurality of components of a composite solution to a build environment to form a set of virtual machines. The mechanism deploys a network virtual image to the build environment to form a network virtual machine. The network virtual machine comprises a router. The mechanism configures the router to create a private subnet with a set of fixed addresses and set of host names for the composite solution. Optionally, the mechanism may discover the fixed addresses during the build phase. The mechanism optionally installs middleware components to the set of virtual machines for the composite solution to form a set of solution virtual machines. The mechanism captures the set of solution virtual machines as a set of solution virtual images as a portable composite solution.

Portable virtual systems for composite solutions

Embodiments of the present invention address deficiencies of the art in respect to access control and provide a method, system and computer program product for access control management for a composite application. In a first embodiment, a method for role-based access control management for a composite application can be provided. The method can include selecting a component for deployment in a composite application and parsing a security policy for the component to identify a mapping between a specific role for the component and a virtual role for the composite application. Binding logic can be generated from the security policy and the component can be deployed into the composite application. Finally, security access operations for the virtual role can be processed through method calls to operations defined in the binding logic.

Virtual roles

Growing community of inventors

Austin, TX, United States of America

Yi-hsiu Wei