Emc IP Holding Company LLC

Dell Products Inc.

Emc Corporation

Dell & Products L.p.

Daniel E Cummins

Vamsi K Vankamamidi

Philippe Armangau

Robert Foley

Steven A Morley

David W Harvey

Marc C Cassano

Peter Puhov

Bradley K Goodman

Linwood W Zoller, Iv

Thomas Earl Linnell

Sudhir Srinivasan

Anurag Sharma

William C Davenport

Dmitry Nikolayevich Tylik

Himabindu Tummala

Shuyu Lee

Joseph Caisse

Socheavy D Heng

Mukesh Gupta

Steve Morley

David Jensen

Devon Reed

Sorin Faibish

Jean-Pierre Bono

David Lionel Black

Michael Emery Brown

Muzhar S Khokhar

Nagasimha G Haravu

Jason Matthew Young

Matthew H Long

Girish Sheelvant

Ronald D Proulx

Kirk Hutchinson

Henry Austin Spang, Iv

Matthew P Jean

Jeroen Diederik Cornelis Antonius Mackenbach

Kenneth Hu

Walter O'Brien

Matthew Eaton

Kirk Alan Hutchinson

Pierluca Chiodelli

Ryan Gadsby

Susmitha Pillarisetty

Methods and systems for managing endpoint devices are disclosed. The endpoint devices may be managed by verifying blueprints and authors of blueprints prior to use. To verify the blueprints, the blueprints may be normalized to reduce variability in blueprint content. Once normalized, static content may be identified. Signatures from the blueprints may be used to attempt to verify the integrity of the static content. If successfully verified, then both the static and dynamic content from the blueprints may be trusted. The authority of authors of the blueprints may be verified by attempt to establish chains of delegation of authority to the authors. If successfully verified, then the blueprints may be used to update operation of the endpoint devices.

Self-attesting secure blueprints

A disclosed method for providing a non-credentialed user (NCU) with secure access to a remote endpoint of an edge computing platform, generates a support voucher for the NCU wherein the support voucher comprises a temporary ownership voucher including one or more digital signatures establishing a chain of trust from a root of trust to the NCU. The method provides a private key associated with the support voucher to the NCU. Responsive to detecting the NCU, using the private key to log into an edge platform resource and determining that the support voucher is recognized by the edge platform resource, the NCU is authenticated and the support voucher is validated to establish the NCU as a designated owner of the remote endpoint. Responsive to establishing the NCU as a designated owner, the NCU may access the edge platform resource and from there access the platform endpoint.

Secure remote support for edge computing platform

Methods and systems for managing endpoint devices are disclosed. The endpoint devices may be managed by verifying portions of customized blueprints prior to use. To verify the portions of the customized blueprints, the portions of the customized blueprints may be normalized to reduce variability in blueprint content. Once normalized, static content may be identified. Signatures from the portions of the customized blueprints may be used to attempt to verify the integrity of integrity data for the static content. If successfully verified, then the integrity may be used to attempt to verify the integrity of the static content. If the integrity of the static content is verified, then both the static and dynamic content from the portion of the blueprints may be used to update the operation of the endpoint devices.

Multi-component blueprint digital signatures

Methods and systems for managing data are disclosed. The data may be managed by creating and requiring use of both backups and verification data for the backups. The verification data may allow the authenticity of the backups to be verified. If verified, the backups may be used to restore the state and/or other characteristics of various entities. The verification data may include information usable to verify integrity of the backups and authority for generating the backups.

System and method for secure backup and restore

An apparatus comprises a processing device comprising a processor coupled to a memory. The processing device is configured to receive, over a first communication channel from an orchestrator entity, at least one command specifying one or more actions to take involving an endpoint device, the one or more actions comprising at least one of writing data to a tag of a tag bridge device and reading data from the tag of the tag bridge device. The processing device is further configured to relay the at least one command to the tag of the tag bridge device over a second communication channel, the second communication channel being established between a tag interface of the processing device and the tag bridge device, wherein the tag bridge device, when plugged in to a port of the endpoint device, relays the at least one command from the tag to the endpoint device.

Management of endpoint devices utilizing tag bridge devices

An edge processing system includes first and second information handling systems. The first information handling system orchestrates the edge processing system, and creates a first key pair including a first private key and a first public key. The second information handling system receives fabric agent code that includes the first public key, a second key pair including a second private key and a second public key, and an address of the first information handling system. The second information handling system executes the fabric agent code to provide an access request to the address. The access request is encoded with the first public key. The first information handling system authenticates the access request with the first private key, and provides external compute fabric code to the second information handling system in response to authenticating the access request. The second information handling system instantiates the external compute fabric code to manage end points of the edge processing system.

Secure onboarding of external compute fabric in an edge horizontal platform

Techniques are provided for deploying virtual machines to a virtualization management environment using an agent component to obtain remote virtual machine templates. One method comprises receiving, by an agent component executing in a virtualization management server, a request to deploy a virtual machine and a storage location of a template for the virtual machine; obtaining the template for the virtual machine from one or more of an orchestration engine and a remote data source identified by the storage location; and replicating the obtained template for the virtual machine to create the virtual machine. The request to deploy the virtual machine may also comprise deployment information used to configure the virtual machine. The agent component may monitor an execution of the created virtual machine and evaluate one or more policies provided by the orchestration engine with respect to security controls and/or network requirements associated with the created virtual machine.

Deploying virtual machines to a virtualization management environment using an agent to obtain remote virtual machine templates

A voucher management system receives, from a computing device manufacturer system, an ownership voucher that transfers ownership of a computing device from the computing device manufacturer system to the voucher management system, and a hardware attestation certificate for the computing device, and associates them with the computing device in a voucher management database. When the voucher management system determines that the ownership of the computing device should be transferred to an end user system, it automatically generates second ownership transfer data by signing an end user system public key with a voucher management system private key, provides the second ownership transfer data in the ownership voucher in order to transfer ownership of the computing device from the voucher management system to the end user system, and provides the ownership voucher and the hardware attestation certificate to the end user system.

Fast identity online (FIDO) device onboarding (FDO) protocol computing device hardware attestation system

A method, computer program product, and computer system for dividing a physical Ethernet port is provided. The method may include dividing, by a computing device, a first physical Ethernet port of a plurality of physical Ethernet ports into a plurality of partitions. A first partition of the plurality of partitions for the first Ethernet port may be assigned to a N-virtual distributed switch. A second partition of the plurality of partitions for the first Ethernet port may be assigned with a plurality of functions. Ethernet packets may be switched between the plurality of functions in the second partition.

System and method for dividing a physical ethernet port

A disclosed method provides a structured definition for a distributed application comprising two or more component applications. The definition may identify each component and a component type, e.g. VM or container, collocation information indicative of collocation requirements for one or more of the components, and external dependency information indicating constraints the alternative environment must comply with. The distributed application may be deployed to one or more endpoints. Responsive to detecting a triggering event for evaluation of component relocation alternatives, disclosed methods may invoke a resource balancing engine to identify a viable alternative endpoint for one or more component applications. Responsive to identifying a viable alternative endpoint for a particular component application, disclosed methods may relocate the particular component application to the alternative endpoint. The distributed application may be an HV application including one or more VM components and one or more container components.

Intelligent resource balancing for virtualized, distributed applications

Techniques for providing effective utilization of different drive capacities in storage appliances. The techniques include providing a storage drive array that has a first set of storage drives and a second set of storage drives. Each storage drive in the first set has a first drive capacity and each storage drive in the second set has a second drive capacity. The first drive capacity is higher than the second drive capacity. The techniques include allocating, within the first drive capacity, at least a first sub-capacity and a second sub-capacity. The first sub-capacity is equal to the second drive capacity. The techniques include placing blocks of hot data in the first sub-capacities of the storage drives in the first set and/or the second drive capacities of the storage drives in the second set, and placing blocks of cold data in the second sub-capacities of the storage drives in the first set.

Effective utilization of different drive capacities

Techniques are provided for deploying services to multiple public clouds using cloud-specific encapsulated communication logic. One method comprises performing, in response to a request associated with a given public cloud of multiple public clouds having corresponding encapsulated communication logic for communicating with the respective public cloud: obtaining an image for the encapsulated communication logic for the given public cloud; instantiating an orchestration service for the given public cloud using the image for the encapsulated communication logic for the given public cloud, wherein the instantiated orchestration service for the given public cloud makes a connection to an endpoint of the given public cloud using the encapsulated communication logic for the given public cloud; and processing a request to create a service in the given public cloud using the instantiated orchestration service for the given public cloud as a connection gateway to the given public cloud.

Deploying services to multiple public cloud environments using cloud-specific encapsulated communication logic

A data storage system in which data storage space for storing data storage metadata is selectively allocated from non-volatile data storage devices contained in a first storage enclosure. The first storage enclosure is directly connected to at least one storage processor of the data storage system, and the data storage system further includes at least one secondary storage enclosure that is indirectly connected to the storage processor. Data storage metadata is generated within the data storage system, and the data storage metadata generated within the data storage system is stored into the data storage space that was selectively allocated for storing data storage metadata from the non-volatile data storage devices contained in the first storage enclosure.

Placement of metadata on data storage drives in a first storage enclosure of a data storage system

Host data stored in one or more source physical extents of non-volatile data storage is identified as valid and determined to be infrequently written by host I/O requests, and is therefore compressed to generate a highly compressed version of the valid host data. The highly compressed version is then stored into at least one target physical extent. The valid host data may be initially compressed before it is stored in the source physical extent(s), and may be re-compressed to generate the highly compressed version. If the valid host data is also infrequently read, it may be recompressed using larger blocks of host data than were used to perform the initial compression. The performance tier of the target physical extent may be different from (e.g. lower than) the performance tier of the source physical extent. The technology may be embodied in a background process such as a garbage collector.

Deep data-compression

A data storage system (DSS) in a cluster provides virtual-volume data storage to virtual-computing (VC) hosts using NVMe-oF storage interconnect. A DSS creates protocol endpoints (PEs) and corresponding namespace groups, each being a grouping of namespaces corresponding to virtual volumes (vVols) to be bound for access by a respective VC host, and each namespace being mapped to corresponding underlying physical storage. Each namespace group is initially created with a corresponding in-band discoverable dummy namespace. In response to in-band storage discovery commands from the VC hosts, and based on the existence of the dummy namespaces, the DSS responds with responses identifying the namespace groups. Then in response to subsequent vVol creation commands from the VC hosts, the DSS creates new namespaces in respective namespace groups and provides namespace identifiers for the new namespaces to the VC hosts for use in accessing data of the vVols.

Data storage system employing dummy namespaces for discovery of NVMe namespace groups as protocol endpoints

Growing community of inventors

Hudson, NH, United States of America

Daniel E Cummins