James E Godwin

US Patent:

6505192, Jan 7, 2003

Filed:

Aug 12, 1999

Appl. No.:

09/373416

Inventors:

James Russell Godwin - Raleigh NC
David Andrew Jones - Raleigh NC
Richard Allen Wenklar - Rougemont NC

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

G06F 1730

US Classification:

707 3, 713201

Abstract:

IPSec rules are searched in an improved manner to reduce processing overhead. For selected connectionless protocols, packets are treated as if they were part of a simulated connection. A pseudo-connection memory block is allocated with the creation of each socket and IPSec security binding information is stored in the pseudo-connection memory block on a first packet. Thereafter, as long as the source address and port in incoming packets on the same socket or destination address and port in outgoing packets on the same socket remain the same, the packets are treated as part of a simulated connection. The security rules are not searched again until the simulated connection terminates or the static rule table is modified. In the preferred embodiment, security binding is made only to the static rule or placeholder.

US Patent:

6754832, Jun 22, 2004

Filed:

Aug 12, 1999

Appl. No.:

09/373360

Inventors:

James Russell Godwin - Raleigh NC
Richard Allen Wenklar - Rougemont NC

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

G06F 1130

US Classification:

713201, 194200

Abstract:

Ipsec rules are searched in order from rules containing the most specificity to those containing the least specificity of attributes. The static rules include placeholders for sets of dynamic rules. Dynamic rules are searched only if a placeholder is the first matching rule in the static table. For connection oriented protocols, security rule binding information is stored in association with the connection. This allows the searching of the rules to be performed only when a connection is first established. If a static or dynamic rule is changed during a connection, a search is repeated. For selected connectionless protocols, packets are treated as if they were part of a simulated connection. A pseudo-connection memory block is allocated with the creation of each socket and Ipsec security binding information is stored in the pseudo-connection memory block on a first packet.

US Patent:

7107350, Sep 12, 2006

Filed:

Jan 17, 2001

Appl. No.:

09/764616

Inventors:

James Russell Godwin - Raleigh NC, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

G06F 13/00

US Classification:

709230, 709245, 713201

Abstract:

Methods, systems and computer program products provide Internet Protocol Security (IPSec) to a plurality of target hosts in a cluster of data processing systems which communicate with a network through a routing communication protocol stack utilizing a dynamically routable Virtual Internet Protocol Address (DVIPA) for communications from the plurality of target hosts by negotiating security associations (SAs) associated with the DVIPA utilizing an Internet Key Exchange (IKE) component associated with the routing communication protocol stack and distributing information about the negotiated SAs to the target hosts so as to allow the target hosts to perform IPSec processing of communications to the network utilizing the negotiated SAs. Communications to the network are IPSec processed utilizing the distributed information at communication protocol stacks at respective ones of the plurality of target hosts.

US Patent:

7340530, Mar 4, 2008

Filed:

Jan 17, 2001

Appl. No.:

09/764252

Inventors:

James Russell Godwin - Raleigh NC, US
David Anthony Herr - Apex NC, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

G06F 15/16
G06F 11/00

US Classification:

709232, 709238, 709245, 370218

Abstract:

Secure communications are provided over a network in a distributed workload environment having target hosts which are accessed through a distribution processor by a common network address. Secure communications are provided by routing both inbound and outbound communications with target hosts which are associated with a secure network communication through the distribution processor. Both inbound and outbound secure network communications are processed at the distribution processor so as to provide network security processing of communications from the target host and network security processing of communications to the target host.

US Patent:

7426566, Sep 16, 2008

Filed:

Jan 17, 2001

Appl. No.:

09/764613

Inventors:

James Russell Godwin - Raleigh NC, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

G06F 13/00

US Classification:

709230, 709245, 713201

Abstract:

Methods, systems and computer program products provide Internet Protocol Security (IPSec) to a plurality of target hosts in a cluster of data processing systems which communicate with a network through a routing communication protocol stack utilizing a dynamically routable Virtual Internet Protocol Address (DVIPA) by negotiating security associations (SAs) associated with the DVIPA utilizing an Internet Key Exchange (IKE) component associated with the routing communication protocol stack and distributing information about the negotiated SAs to the target hosts so as to allow the target hosts to perform IPSec processing of communications from the network utilizing the negotiated SAs.

US Patent:

7519721, Apr 14, 2009

Filed:

Apr 4, 2008

Appl. No.:

12/062571

Inventors:

James Russell Godwin - Raleigh NC, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

G06F 13/00

US Classification:

709230, 709238, 709242, 709245, 726 15

Abstract:

Methods, systems and computer program products provide Internet Protocol Security (IPSec) to a plurality of target hosts in a cluster of data processing systems which communicate with a network through a routing communication protocol stack utilizing a dynamically routable Virtual Internet Protocol Address (DVIPA) by negotiating security associations (SAs) associated with the DVIPA utilizing an Internet Key Exchange (IKE) component associated with the routing communication protocol stack and distributing information about the negotiated SAs to the target hosts so as to allow the target hosts to perform IPSec processing of communications from the network utilizing the negotiated SAs.

US Patent:

20040230901, Nov 18, 2004

Filed:

May 15, 2003

Appl. No.:

10/439867

Inventors:

James Godwin - Raleigh NC, US
Michael Wanderski - Durham NC, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

G06F015/00

US Classification:

715/513000

Abstract:

A portal server system and method is provided. The portal server system can include a portal coupled to one or more portlets, each portlet having associated portlet rendering logic. The system also can include a portlet aggregator communicatively linked to the portlet rendering logic. Finally, a visual service extension to the portlet aggregator can be provided. The visual service extension can be programmed to process the portlet rendering logic to transform visual stye attributes in the portlet rendering logic into markup language tags which can be rendered for display in a specified type of pervasive agent. In any event, preferably, the portlet rendering logic can be a Java server page (JSP).

US Patent:

20080098126, Apr 24, 2008

Filed:

Dec 21, 2007

Appl. No.:

11/962551

Inventors:

James Godwin - Raleigh NC, US
David Herr - Apex NC, US
Linwood Overby - Raleigh NC, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

G06F 15/16

US Classification:

709232000

Abstract:

Secure communications are provided over a network in a distributed workload environment having target hosts which are accessed through a distribution processor by a common network address. Secure communications are provided by routing both inbound and outbound communications with target hosts which are associated with a secure network communication through the distribution processor. Both inbound and outbound secure network communications are processed at the distribution processor so as to provide network security processing of communications from the target host and network security processing of communications to the target host.