David R Rivera

US Patent:

7107460, Sep 12, 2006

Filed:

Feb 15, 2002

Appl. No.:

10/077135

Inventors:

Daryl Carvis Cromer - Apex NC, US
Scott Thomas Elliott - Raleigh NC, US
James Patrick Hoff - Wake Forest NC, US
Howard Jeffrey Locker - Cary NC, US
David Rivera - Durham NC, US
Randall Scott Springfield - Chapel Hill NC, US
James Peter Ward - Raleigh NC, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

H04L 29/02
H04L 29/18
H04L 9/34

US Classification:

713193, 713167

Abstract:

An embedded security subsystem, and method for implementing the same, which provide secure controllability of a data security device within a data processing system. The embedded security subsystem of the present invention includes a persistent enable flag for providing control access to the data security device, wherein the persistent enable flag is accessible only in response to a power-on reset cycle of the data processing system. The persistent enable flag is read-only accessible to runtime program instructions. A pending state change flag that is write accessible by runtime program instructions is utilized for setting an intended next state of the persistent enable flag such that control access to the data security device is enabled only during a subsequent power-on reset of said data processing system.

US Patent:

7167982, Jan 23, 2007

Filed:

Sep 14, 2001

Appl. No.:

09/952103

Inventors:

Scott Thomas Elliott - Raleigh NC, US
James Patrick Hoff - Raleigh NC, US
Christopher Scott Long - Chapel Hill NC, US
David Rivera - Durham NC, US
James Peter Ward - Raleigh NC, US

Assignee:

Lenovo (Singapore) Pte Ltd. - Singapore

International Classification:

H04L 9/00

US Classification:

713164, 713165, 713189, 707204

Abstract:

A method, system and computer program product for securing decrypted files in a shared environment. A filter driver in a kernel space may be configured to control service requests to encrypted files stored in a shared area, e. g. , a shared directory on a disk unit, accessible by multiple users. The filter driver may receive a service request to open an encrypted document in the shared area issued from an authorized user. Upon receiving the encrypted data, the filter driver may decrypt the encrypted data. The filter driver may subsequently store the decrypted data in a file in a non-shared area, e. g. , a non-shared directory. The non-shared area may be accessible only by the authorized user that requested access to the encrypted file. By storing the decrypted data in a file in the non-shared area, a file once decrypted may be protected in a file sharing environment.

US Patent:

7484241, Jan 27, 2009

Filed:

Nov 22, 2004

Appl. No.:

10/994620

Inventors:

David Carroll Challener - Raleigh NC, US
Steven Dale Goodman - Raleigh NC, US
James Patrick Hoff - Raleigh NC, US
David Rivera - Durham NC, US
Randall Scott Springfield - Chapell Hill NC, US

Assignee:

Lenovo (Singapore) Pte. Ltd. - Singapore

International Classification:

G06F 7/04
H04L 9/32

US Classification:

726 5, 713193

Abstract:

Methods and arrangements are disclosed for secure single sign on to an operating system using only a power-on password. In many embodiments modified BIOS code prompts for, receives and verifies the power-on password. The power-on password is hashed and stored in a Platform Configuration Register of the Trusted Platform Module. In a setup mode, the trusted platform module encrypts the operating system password using the hashed power-on password. In a logon mode, the trusted platform module decrypts the operating system password using the hashed power-on password.

US Patent:

7743240, Jun 22, 2010

Filed:

Apr 2, 2007

Appl. No.:

11/695095

Inventors:

Philip Lee Childs - Raleigh NC, US
Charles Burnham Oxrieder - Wake Forerst NC, US
David Rivera - Durham NC, US

Assignee:

Lenovo (Singapore) Pte. Ltd. - Singapore

International Classification:

G06F 15/177

US Classification:

713 1, 713100

Abstract:

Applications which function under a first operating system also function when it becomes necessary to call into action a second operating system due to provision having been made for configuration and other settings necessary to the execution of such applications (here generically called policy settings or policy source data) to be made available to the second operating system.

US Patent:

8290164, Oct 16, 2012

Filed:

Jul 31, 2006

Appl. No.:

11/461429

Inventors:

Matthew P. Lietzke - Cary NC, US
James P. Hoff - Wake Forest NC, US
David Rivera - Durham NC, US

Assignee:

Lenovo (Singapore) Pte. Ltd. - Singapore

International Classification:

H04L 9/00

US Classification:

380277, 380278, 380280, 380284, 380286, 380 44, 726 20, 726 5, 713184, 713165, 717121

Abstract:

A trusted platform module (TPM) is a silicon chip that constitutes a secure encryption key-pair generator and key management device. A TPM provides a hardware-based root-of-trust contingent on the generation of the first key-pair that the device creates: the SRK (storage root key). Each SRK is unique, making each TPM unique, and an SRK is never exported from a TPM. Broadly contemplated herein is an arrangement for determining automatically whether a TPM has been replaced or cleared via loading a TPM blob into the TPM prior to the first time it is to be used (e. g. when a security-related software application runs). If the TPM blob loads successfully, then it can be concluded that the TPM is the same TPM that was used previously. If the TPM blob cannot be loaded, then corrective action will preferably take place automatically to configure the new TPM.

US Patent:

20030053630, Mar 20, 2003

Filed:

Sep 20, 2001

Appl. No.:

09/957415

Inventors:

Scott Elliott - Raleigh NC, US
James Hoff - Raleigh NC, US
Christopher Long - Chapel Hill NC, US
David Rivera - Durham NC, US
Andy Trotter - Raleigh NC, US
James Ward - Raleigh NC, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

H04K001/00

US Classification:

380/277000

Abstract:

A method and system for control of key pair usage in a computer system is disclosed. The method and system comprise creating key pair material for utilization with an embedded security chip of the computer system. The key pair material includes tag data. The method and system further includes determining whether the key pair material is bound to the embedded security chip based on the tag data. Through the present invention, more flexibility for control over which keys are bound to an embedded security system is achieved. These and other advantages of the aspects of the present invention will be more fully understood in conjunction with the following detailed description and accompanying drawings.

US Patent:

20030212911, Nov 13, 2003

Filed:

May 13, 2002

Appl. No.:

10/144200

Inventors:

David Challener - Raleigh NC, US
James Hoff - Raleigh NC, US
Kevin Mccurley - San Jose CA, US
John Nicholson - Durham NC, US
David Rivera - Durham NC, US
James Ward - Raleigh NC, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

H04L009/32

US Classification:

713/202000, 713/181000, 713/001000

Abstract:

Enhanced security in controlling access to data files stored in a read/write storage device is achieved in that the storage device may be specifically linked to a specific computer system, and linked in such a way that access will be granted only when a series of exchanges exemplary of that linkage occurs. Access to data stored in a read/write storage device is to be granted only when the device is associated with a specific computer system and further only when appropriate password entry is verified by the storage device.

US Patent:

20060129824, Jun 15, 2006

Filed:

Dec 15, 2004

Appl. No.:

11/012836

Inventors:

James Hoff - Raleigh NC, US
David Rivera - Durham NC, US

International Classification:

H04L 9/00
G06F 12/14
H04L 9/32
G06F 11/30
H04K 1/00

US Classification:

713176000, 713181000, 713193000, 713183000

Abstract:

Systems, methods and media for accessing and protecting TPM keys for signing and for decryption are disclosed. More particularly, hardware and software are disclosed for enabling a user knowing a signing-only authentication to access a key for signing only, upon submission of the signing only-authentication, and for enabling the user or a system administrator knowing a decryption-only authentication to access a key for decryption only, upon submission of the decryption-only authentication.