Abstract: A system and method for hybrid virtual machine monitor system is provided. A first operating system uses a file system to manage data storage and retrieval within a data storage area. A second operating system, which is not compatible with the first operating system's file system, executes a management application backup utility. The first operating system includes a filter driver that sends logical block addresses, which correspond to data reads/writes, to the management application backup utility. In turn, the management application backup utility uses the logical block addresses to perform operations on the data storage locations. In one embodiment, the management application backup utility performs actions on the data storage area, such as a disk defragmentation, and subsequently sends data location changes to the filter driver. In this embodiment, the filter driver instructs the first operating system's file system to update its translation tables based upon the data location changes.

Abstract: An apparatus, system, and method are disclosed for securely authorizing changes to a transaction restriction. A security module securely stores encryption keys for a payment instrument. The payment instrument electronically transacts payments and includes a transaction restriction. An authentication module receives an authentication from a user of the payment instrument. The security module validates the authentication with a first encryption key. In addition, the security module authorizes a change to the transaction restriction using a second encryption key if the authentication is valid. The security module resides on a computer that the user designates as authorized to validate the authentication.

Abstract: An apparatus, system, and method are disclosed for protecting hard disk data in multiple operating system environments. The present invention restricts access of a hard file to a range of logical addresses using a controller module configured to access a hard file in response to a request for a logical address, a set zero module configured to add an offset value to each request for a logical address on a hard file, and a set max module configured to set a maximum logical address accessible on a hard file. The invention limits access to a lower protected area with logical addresses below the range of logical address and a host protected area with logical address above the range of logical addresses.

Abstract: A method for booting into computer memory a non-operating system (O.S.) program from a hard disk drive (HDD) prior to booting into memory an O.S. from the HDD. The method includes establishing a table of contents (TOC) on the HDD that contains entries for special O.S. programs. A pointer to the TOC is placed in non-volatile memory of the computer that is associated with the HDD, and when BIOS of the computer is prompted to load into memory one of the special O.S. programs, the pointer is accessed and used to locate the TOC, which in turn is accessed to load the special O.S. program.

Abstract: A client computer is connected via a network to an anti-virus server and polls the server for indication that an anti-virus needs to be immediately downloaded from the anti-virus server. The client computer disengages from the network, and re-establishes a link with only the trusted anti-virus server. The anti-virus fix is installed, the client computer re-booted, and the client computer is then allowed to reconnect to the full network. If the client's primary operating system (OS) is infected, a secondary OS in the client computer performs the anti-virus download and execution. The disengagement from the network is performed by applying a filter in a network interface card (NIC) driver by the primary OS, the secondary OS, a service processor (SP), or by a virtual machine manager (VMM), depending on which is available at the client computer.

Abstract: The present invention relates to a method for method or system which is able to control access to a new computer user password reset. The system is preloaded with a random password that does not needed to be known by anyone. There are two main situations in which this method will be used. The first situation involves a locally managed password and account where the user does not log in to a domain. The second situation involves remote management, where the user logs in to a domain.

Abstract: A method and apparatus for providing high-density storage is disclosed. A plurality of storage devices is aggregated in a package. A package-level controller is coupled to a carrier housing holding a plurality of storage devices, wherein the package-level controller provides a RAID logical configuration at a package-level for the storage devices held in the carrier housing. A controller may also be provided for virtualizing the logical addresses as at least one aggregate volume to provide a layer of abstraction to the storage devices. The package may be inserted into a storage system designed to manage multiple packages.

Abstract: A method and apparatus for aggregating storage devices is disclosed. A package for providing high density storage uses a carrier housing for holding multiple storage devices proximate to one another and aligned in a row, and an access device, coupled to the carrier housing, aggregates the physical addresses of the storage devices into logical addresses and making the logical addresses available over a connection.

Abstract: A computer determines whether it has been booted from a hard disk drive or from an alternate source (e.g., a floppy drive or portable memory) that entails a higher risk of importing a virus into the computer, and if it is determined that a non-HDD source was booted from, corrective action such as a virus scan can be preemptively taken.

Abstract: A method, system, and program product for enabling administrative recovery of a user's lost/forgotten boot-up passwords without compromising the administrative/master password(s). A restricted-use password is dynamically generated from a first hash of a random number generated on a client system and a secret retrieved from a secure device associated with the client system. The restricted-use password operates as a master password but is not the administrative password of the client system. Once the password is generated, it is provided to the user/client system to enable user access to said client system and hardfile and reset of the user passwords.

Abstract: A data processing system and method are disclosed for maintaining secure user private keys in a non-secure storage device. A master key pair is established for the system. The master key pair includes a master private key and a master public key. The master key pair is stored in a protected storage device. A unique user key pair is established for each user. The user key pair includes a user private key and a user public key. The user private key is encrypted utilizing the master public key. The encrypted user private key is stored in the non-secure storage device, wherein the encrypted user private key is secure while stored in the non-secure storage device.

Abstract: Methods, systems and computer program products are provided which provide cryptographic services to an application by incorporating in the application an indication of at least one authorized cryptographic function for the application. The indication of at least one authorized cryptographic function for the application is communicated to a cryptographic library that supports a plurality of cryptographic functions. The at least one authorized cryptographic function corresponding to the indication of at least one authorized cryptographic function is then identified as a valid cryptographic function for the application.

Abstract: A data processing system and method are disclosed for protecting data within a hard disk drive included within a data processing system. Data is generated. A signature value is provided which is stored in a signature device. The signature device is capable of being inserted into and removed from a computer system. A textual description of the data is created. The data is encrypted utilizing both the signature value stored on the device and the textual description. The encrypted data is then stored on the hard disk drive. The data processing system does not permanently store encryption keys.

Abstract: A method, system, and computer-readable code for delegating authority and authentication from a client to a server in order that the server can establish a secure connection (using SSL or an analogous security protocol) to a back-end application on behalf of the client. This enables the true client's identity to be known to the application on the end-tier server. The proposed solution provides several alternative techniques, whereby the client establishes a secure session with a middle-tier server (MTS), and then delegates authority and authentication to the MTS in order that the MTS can establish a second SSL session to the ETS on behalf of this client.

Abstract: Methods, systems and computer program products authenticate client requests to access server resources. A server receives a certificate containing multiple data fields associated with the client making a request. The server selects data from at least one of the certificate data fields and filters the selected data using at least one predefined filter rule associated with the requested server resources to authenticate the client request. Combinations of filter rules may be utilized and the server may select data from various combinations of data fields.

Abstract: Systems, methods and computer program products for two-party key authentication provide additional security against intruders that might gain access to the password database of a server. The client verifies his clear password over an encrypted channel, rather than merely verifying the encrypted password, prior to receiving secure traffic.