Christopher F Meyer

US Patent:

8141126, Mar 20, 2012

Filed:

Jan 24, 2007

Appl. No.:

11/626602

Inventors:

Curtis M. Gearhart - Raleigh NC, US
Christopher Meyer - Cary NC, US
David J. Wierbowski - Owego NY, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

H04L 29/14
G06F 17/30
G06F 11/07
G06F 7/04

US Classification:

726 1, 714 61, 714 15, 714 30

Abstract:

Embodiments of the present invention address deficiencies of the art in respect to IPsec SA recovery and provide a novel and non-obvious method, system and computer program product for selective IPsec SA recovery from security enforcement point outages. In one embodiment of the invention, a security enforcement point outage recovery method can be provided. The method can include compiling a listing of SAs for a security enforcement point and monitoring the security enforcement point for an outage. Responsive to detecting an outage in the security enforcement point, the listing can be pruned to include SAs that remain contextually valid or are utilized by the peer of the security enforcement point. Thereafter, only SAs in the pruned list can be re-established.

US Patent:

8199916, Jun 12, 2012

Filed:

Dec 26, 2007

Appl. No.:

11/964503

Inventors:

Christopher Meyer - Cary NC, US
Wuchieh J. Jong - Raleigh NC, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

H04L 9/08

US Classification:

380279

Abstract:

A method, network element, and computer storage program product, are provided for selectively loading a communication network security enforcement point (“SEP”) with security association (“SA”) information for inspection of encrypted data in a secure, end-to-end communications path. At least one encrypted data packet is received. It is determined that SA information for decrypting the at least one encrypted data packet fails to exist locally at the SEP. A request is sent to a communication network key server for SA information associated with the at least one encrypted data packet. The SA information associated with the at least one encrypted data packet is received from the communication network key server.

US Patent:

20050137938, Jun 23, 2005

Filed:

Dec 19, 2003

Appl. No.:

10/741371

Inventors:

Christopher Meyer - Cary NC, US
Meenakshisundaram Venkatasubramaniam - Bridgewater NJ, US
Filip Yeskel - Raleigh NC, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

G06F017/60

US Classification:

705026000

Abstract:

A method, system, and computer program product for allowing retailers to sell TLog data to third party purchasers using a standard eCommerce engine. The system collects TLog data, creates a user profile for a plurality of purchasers, offers customized TLog data for sale to the purchasers based upon criteria contained within their respective user profile, determines the appropriate price for the offered TLog data, packages and delivers the appropriate data in response to a purchase from a purchaser, and creates and stores a record of the transaction.

US Patent:

20080175382, Jul 24, 2008

Filed:

Jan 24, 2007

Appl. No.:

11/626513

Inventors:

Curtis M. Gearhart - Raleigh NC, US
Christopher Meyer - Cary NC, US
Linwood H. Overby - Raleigh NC, US
David J. Wierbowski - Owego NY, US

International Classification:

H04K 1/00
H04L 9/00

US Classification:

380255, 380278

Abstract:

Embodiments of the present invention address deficiencies of the art in respect to network security and provide a method, system and computer program product for centralized secure offload of key exchange services for distributed security enforcement points. In one embodiment, a data processing system for centralized secure offload of key exchange services for distributed security enforcement points can be provided. The system can include a security enforcement point controlling communication flows between devices in different less trusted zones of protection, and a security server communicatively coupled to the security enforcement point and hosting key exchange services disposed in a more trusted zone of protection. The security enforcement point can include an interface to the key exchange services and program code enabled to offload at least one portion of a key exchange through the interface to the key exchange services disposed in the more trusted zone of protection.

US Patent:

20080178254, Jul 24, 2008

Filed:

Jan 24, 2007

Appl. No.:

11/626458

Inventors:

Curtis M. Gearhart - Raleigh NC, US
Christopher Meyer - Cary NC, US
Linwood H. Overby - Raleigh NC, US
David J. Wierbowski - Owego NY, US

International Classification:

G06F 21/00
G06F 17/00
H04L 9/00

US Classification:

726 1, 726 11, 726 23

Abstract:

Embodiments of the present invention provide methods, systems and computer program products for the centralized, secure offloading of security services for distributed security enforcement points. In an embodiment, a network data processing system can be configured for centralized secure offload of security services for distributed security enforcement points and can include a set of security enforcement points controlling communication flows between devices in different less trusted zones of protection. The system also can include a security server communicatively coupled to the security enforcement points and hosting security services logic disposed in a more trusted zone of protection. Each of the security enforcement points can include an interface to the security services logic and program code enabled to offload security related services processing through the interface to the security services logic disposed in the more trusted zone of protection.

US Patent:

20130219167, Aug 22, 2013

Filed:

Feb 21, 2012

Appl. No.:

13/400575

Inventors:

Curtis Matthew Gearhart - Raleigh NC, US
Christopher Meyer - Raleigh NC, US
Scott Christopher Moonen - Durham NC, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

H04L 9/00

US Classification:

713153

Abstract:

A network node for communicating data packets secured with a security protocol over a communications network includes a host information handling system (IHS) and one or more external security offload devices coupled by a secure data link. The host IHS communicates state information about data packets, and the external offload security device provides stateless secure data encapsulation and decapsulation of packets using a security protocol. An external network interface controller or internal network interface controller communicates encapsulated data packets over the communications network to a final destination. Encapsulation and decapsulation of packets by the external security offload device reduces network latency and reduces the computational load on the processor in the host IHS. Maintaining state information in the host IHS allows hot-swapping of external security offload devices without information loss. The external security offload device may be included in a firewall, or intrusion detection device, and may implement IPsec protocol.

US Patent:

20130219168, Aug 22, 2013

Filed:

Feb 21, 2012

Appl. No.:

13/400577

Inventors:

Curtis Matthew Gearhart - Raleigh NC, US
Christopher Meyer - Raleigh NC, US
Scott Christopher Moonen - Durham NC, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

H04L 29/06

US Classification:

713153

Abstract:

A network node for communicating data packets secured with a security protocol over a communications network includes a host information handling system (IHS) and one or more external security offload devices coupled by a secure data link. The host IHS communicates state information about data packets, and the external offload security device provides stateless secure data encapsulation and decapsulation of packets using a security protocol. An external network interface controller or internal network interface controller communicates encapsulated data packets over the communications network to a final destination. Encapsulation and decapsulation of packets by the external security offload device reduces network latency and reduces the computational load on the processor in the host IHS. Maintaining state information in the host IHS allows hot-swapping of external security offload devices without information loss. The external security offload device may be included in a firewall, or intrusion detection device, and may implement IPsec protocol.

US Patent:

20130219171, Aug 22, 2013

Filed:

Feb 26, 2013

Appl. No.:

13/777931

Inventors:

INTERNATIONAL BUSINESS MACHINES CORPORATION - , US
Christopher Meyer - Raleigh NC, US
Scott Christopher Moonen - Durham NC, US
Linwood Hugh Overby - Raleigh NC, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

H04L 9/00

US Classification:

713153

Abstract:

A network node for communicating data packets secured with a security protocol over a communications network includes a host information handling system (IHS) and one or more external security offload devices coupled by a secure data link. The host IHS communicates state information about data packets, and the external offload security device provides stateless secure data encapsulation and decapsulation of packets using a security protocol. An external network interface controller or internal network interface controller communicates encapsulated data packets over the communications network to a final destination. Encapsulation and decapsulation of packets by the external security offload device reduces network latency and reduces the computational load on the processor in the host IHS. Maintaining state information in the host IHS allows hot-swapping of external security offload devices without information loss. The external security offload device may be included in a firewall, or intrusion detection device, and may implement IPsec protocol.