Yi I Fang, 5519 Reeve Rd, Sharon, MA 02067

6240512, May 29, 2001

Apr 30, 1998

9/070462

Yi Fang - Austin TX
I-Lung Kao - Round Rock TX
George Conerly Wilson - Austin TX

International Business Machines Corporation - Armonk NY

G06F 0124

713150

A method of sharing a master key across a set of servers operating a single sign-on (SSO) mechanism in a distributed computer network. The master key is useful for encrypting user passwords for storage in a globally-accessible registry. The method begins by establishing in the registry a group identifying which of the servers in the set, if any, have a copy of the master key. At a given server, the method continues by determining whether a copy of the master key is stored at the given server and whether the group has at least one member. The master key is then generated at the given server if a copy of the key is not stored at the given server and the group does not have at least one member. Other servers in the set pull the master key as needed.

6243816, Jun 5, 2001

Apr 30, 1998

9/070512

Yi Fang - Austin TX
I-Lung Kao - Round Rock TX
Ivan Matthew Milman - Austin TX
George Conerly Wilson - Austin TX

International Business Machines Corporation - Armonk NY

H04L 900

713202

A method of managing passwords of users desiring access to multiple target resources in a computer enterprise environment. For each given user, each of a set of id/password pairs is associated to each of a set of one or more respective targets. Each id/password pair is normally required to access a respective target resource. The targets of each given user are stored in a globally-accessible database. In response to entry by a given user at a client machine of a single-sign on (SSO) id/password, the globally-accessible database is accessed from a personal key manager (PKM) server to retrieve the targets of the given user. The targets are returned to the PKM server, which then uses data therein to access the respective target resources on behalf of the given user at the client machine.

2021009, Apr 1, 2021

Sep 30, 2019

16/587750

- Hopkinton MA, US
Yi Fang - Sharon MA, US
Jingyan Zhao - Harvard MA, US

G06F 16/23
G06F 21/64

A method, computer program product, and computer system for maintaining, by a computing device, a plurality of certificates in a credential store using a distributed data source. A certificate of the plurality of certificates may be loaded in an in-memory location from the distributed data source upon startup. A change in at least one certificate of the plurality of certificates may be detected in the distributed data source. The change in the at least one certificate may be loaded from the distributed data source to the in-memory location without requiring a restart of the computing device.

2019033, Oct 31, 2019

Apr 27, 2018

15/965156

- Hopkinton MA, US
Charles W. Kaufman - Redmond WA, US
Gregory W. Lazar - Upton MA, US
Xuan Tang - Hopkinton MA, US
Yi Fang - Sharon MA, US
Xiongfei Chen - Lexington MA, US

G06F 3/06
H04L 29/06
G06F 21/60

Techniques for synchronizing configuration information in a clustered storage environment. The techniques allow a system administrator or other user to make additions and/or updates to configuration information in one or more configuration files, which are automatically propagated for storage in multiple data storage appliances within a storage domain. By allowing a user to make changes to configuration files associated with a primary appliance within the storage domain, and automatically propagating the configuration files in a background process from the primary appliance to multiple secondary appliances within the storage domain, the user can more readily assure consistency of the configuration information, not only among the primary and secondary appliances within the storage domain, but also among previously unavailable or unreachable data storage appliance(s) that may be recovered and brought back on line within the storage domain.

2019013, May 2, 2019

Oct 27, 2017

15/795482

- Hopkinton MA, US
Charlie Kaufman - Redmond WA, US
Gregory W. Lazar - Upton MA, US
Yi Fang - Sharon MA, US
Xuan Tang - Hopkinton MA, US

H04L 9/08
H04L 9/06
H04L 29/06

In response to determining that an encryption operation request includes no indication of a cryptographic key, an encryption service module performs an encryption operation using a current cryptographic key retrieved by the encryption service module, and creates and stores an encrypted data object that includes the resulting ciphertext and a key identifier that uniquely identifies the cryptographic key and the associated cryptographic algorithm used to perform the encryption. A subsequent decryption operation request to the encryption service module that indicates the encrypted data object is processed by retrieving the cryptographic key and identifying the associated cryptographic using the key identifier contained in the encrypted data object. The encrypted data object may also include an initialization vector used to generate the ciphertext contained in the encrypted data object, as well as an integrity check value generated across the ciphertext and initialization vector.