Abstract: A method, a computer program product, and a system for initializing components to monitor for unauthorized encryptions of filesystem objects stored on a computing system. The method includes configuring an encryption monitor register to establish monitoring preferences of filesystem objects and allocating a predetermined size of persistent memory as a backup memory area for storing pre-encrypted versions of the filesystem objects. The method also includes inserting a starting address of the backup memory area in data bits of the encryption monitor register, and setting encryption monitor bits of page table entries in a hardware page table that correspond to at least one filesystem object, thereby establishing encryption monitoring of the filesystem object.

Abstract: A method, a computer program product, and a system for mitigating unauthorized encryptions of filesystem objects stored on a computing system. The method includes allocating a backup memory area for storing pre-encrypted filesystem objects, setting data bits in an encryption register that allow for monitoring a filesystem object marked for ransomware protection. The method also includes calculating an encryption rate of an encryption occurring on the filesystem object and determining that the encryption rate of the filesystem object exceeds an encryption-rate threshold. The encryption-rate threshold can be set by an administrator when marking the filesystem object for ransomware protection. The method further includes generating an alert to an administrator that the encryption rate of the filesystem object exceeds the encryption rate threshold and storing a backup of the filesystem object for a predetermined amount of time in the backup memory area.

Abstract: A method, a computer program product, and a system for initializing components to monitor for unauthorized encryptions of filesystem objects stored on a computing system. The method includes configuring an encryption monitor register to establish monitoring preferences of filesystem objects and allocating a predetermined size of persistent memory as a backup memory area for storing pre-encrypted versions of the filesystem objects. The method also includes inserting a starting address of the backup memory area in data bits of the encryption monitor register, and setting encryption monitor bits of page table entries in a hardware page table that correspond to at least one filesystem object, thereby establishing encryption monitoring of the filesystem object.

Abstract: Provided is a method for certifying a communicative connection. The method includes, in response to receiving a first request from a first virtualized communication endpoint (VCE), allocating and assigning a first communication portal to the first VCE, generating an encryption key associated with the first communication portal, and returning the encryption key and an identification of the first communication portal to the first VCE. The method further includes, in response to receiving a second request from a second VCE to establish a communicative connection with the first communication portal, the second request being accompanied by an encrypted certificate, comparing, using the encryption key, the information included in the certificate with certificate input information. The method further includes, in response to determining that the information included in the certificate matches the certificate input information, establishing the communicative connection between the first VCE and the second VCE.

Abstract: A method and structure for OS event notification, including a central processing unit (CPU) and a memory including instructions for an event notification mechanism for monitoring operating system events in an operating system (OS) being executed by the CPU. The OS includes a kernel having a plurality of kernel subcomponents that provide services to one or more applications executing in the OS in a user mode, using system calls to the kernel. The OS event notification mechanism is capable of monitoring events within the kernel, at a level below the user mode level. The OS event notification mechanism includes Application Program Interfaces (APIs) that are standard for the OS.

Abstract: A method for monitoring access to a file within a file system includes steps or acts of: monitoring a plurality of requests for access to files; intercepting the requests; and analyzing metadata located in the file. If the metadata includes a directive entry, the method includes these additional steps: identifying information about any application requesting access to the file, including a sequence of function calls that preceded the file access request; and logging the information to generate an action trail of the application. A mechanism for monitoring file access includes the following: a file system configured for monitoring accesses to any file residing within it; an access control mechanism which can execute pre-defined actions when an unauthorized file access occurs; and a tool to specify the list of files to be monitored.

Abstract: System, method and computer program product for supporting a plurality of Access Control List types for a file system in an operating system in a data processing system. An Access Control List supporting system for managing access to a file system in a data processing system has at least one file system in an operating system of the data processing system, and an Access Control List management framework in the operating system and external to the at least one file system for managing access to the at least one file system. The Access Control List supporting system of the invention removes ACL management and access check-related functions from the at least one file system to an external Access Control List management framework, thus enabling an operating system to support a plurality of Access Control List types using the same Access Control List management framework and enabling new Access Control List types to be added to the operating system dynamically while the operating system is running.

Abstract: A method and structure for OS event notification, including a central processing unit (CPU) and a memory including instructions for an event notification mechanism for monitoring operating system events in an operating system (OS) being executed by the CPU. The OS includes a kernel having a plurality of kernel subcomponents that provide services to one or more applications executing in the OS in a user mode, using system calls to the kernel. The OS event notification mechanism is capable of monitoring events within the kernel, at a level below the user mode level. The OS event notification mechanism includes Application Program Interfaces (APIs) that are standard for the OS.

Abstract: A method and structure for notifying operating system events, includes standard filesystem interfaces provided for event consumers to use for one or more of registering for event notifications of a set of events, receiving an event notification when each event occurs, and getting details of events that have occurred.

Abstract: A method and infrastructure for a diagnosis and/or repair mechanism in a computer system, that includes an auxiliary service system running on the computer system.

Abstract: A method and structure for notifying operating system events, includes standard filesystem interfaces provided for event consumers to use for one or more of registering for event notifications of a set of events, receiving an event notification when each event occurs, and getting details of events that have occurred.

Abstract: A method for monitoring access to a file within a file system includes steps or acts of: monitoring a plurality of requests for access to files; intercepting the requests; and analyzing metadata located in the file. If the metadata includes a directive entry, the method includes these additional steps: identifying information about any application requesting access to the file, including a sequence of function calls that preceded the file access request; and logging the information to generate an action trail of the application. A mechanism for monitoring file access includes the following: a file system configured for monitoring accesses to any file residing within it; an access control mechanism which can execute pre-defined actions when an unauthorized file access occurs; and a tool to specify the list of files to be monitored.

Abstract: A method (and structure) for relocating low memory for an operating system instance in a computer system includes establishing a low memory table (LMT), the LMT comprising information allocated for each of a predefined increment of the low memory to be relocated, setting the information to a first predetermined value, and copying a contents of each of the increments to a new location in a first copy operation.

Abstract: A method and system for efficiently migrating in-use small pages to enable promotion of contiguous small pages into large pages in a memory environment that includes small pages pinned to real memory and/or and small pages mapped to direct memory access (DMA) within real memory. The operating system is designed with a two-phase page promotion engine/utility that enables coalescing contiguous small virtual memory pages to create large virtual memory pages by migrating in-use small memory pages including those that are pinned and/or mapped to DMA.

Abstract: A method and infrastructure for a diagnosis and/or repair mechanism in a computer system, that includes an auxiliary service system running on the computer system.

Abstract: A method, apparatus, and computer instructions for broadcasting information. A change in data used by a number of processors in the data processing system is identified. A message is sent to the number of processors in the data processing system in which the message is sent with a priority level equal to a set of routines that use the data in response to identifying the change. This message is responded to only when the recipient is at an interrupt priority less favored than the priority of the message. A flag is set for each of the number of processors to form a plurality of set flags for the message in which the plurality of set flags are located in memory locations used by the number of processors in which the plurality of set flags remains set until a response is made to the message.

Abstract: A method, apparatus, and computer instructions for broadcasting information. A change in data used by a number of processors in the data processing system is identified. A message is sent to the number of processors in the data processing system in which the message is sent with a priority level equal to a set of routines that use the data in response to identifying the change. This message is responded to only when the recipient is at an interrupt priority less favored than the priority of the message. A flag is set for each of the number of processors to form a plurality of set flags for the message in which the plurality of set flags are located in memory locations used by the number of processors in which the plurality of set flags remains set until a response is made to the message.

Abstract: A method (and structure) for relocating low memory for an operating system instance in a computer system includes establishing a low memory table (LMT), the LMT comprising information allocated for each of a predefined increment of the low memory to be relocated, setting the information to a first predetermined value, and copying a contents of each of the increments to a new location in a first copy operation.