Emc Corporation

Emc IP Holding Company LLC

Eric Young

Peter Robinson

Sean Francis Parkinson

Jaimee Brown

William Duane

Daniel Vernon Bailey

Ilya Liubovich

Trevor H Dawe

Sean R Gallacher

Boris Farizon

Samuil Shmuylovich

Serge Marokhovsky

Zulfikar A Ramzan

David Barta

David Paul Makepeace

Norris V Li

Ian D Bibby

Dongjun Sun

Jay S Stevens

Michael Foley

Aaron Matthew Marks

Katherine Watts

Joseph Berry

Douglas Leech

Koji Onishi

Christopher Ronald Scott

Jacob Evans

Methods, apparatus, and processor-readable storage media for automated alert augmentation for deployments of software-defined storage are provided herein. An example computer-implemented method includes obtaining an alert from at least one software-defined storage device; determining one or more items of additional information pertaining to one or more of the alert and the at least one software-defined storage device; augmenting the alert based at least in part on the one or more determined items of additional information; generating a modified version of the augmented alert by incorporating, into the augmented alert, dependency information pertaining to the at least one software-defined storage device and one or more additional software-defined storage devices; and performing one or more automated actions based at least in part on the modified version of the augmented alert.

Automated alert augmentation for deployments of software-defined storage

Methods, apparatus, and processor-readable storage media for policy-based automated generation of software-defined storage deployments are provided herein. An example computer-implemented method includes obtaining, from a user, a software-defined storage deployment request comprising request attributes; determining a software-defined storage deployment policy applicable to the request by processing the request attributes in connection with a set of software-defined storage deployment policies; executing, in a given order, multiple rules contained within the determined software-defined storage deployment policy, wherein executing each of the multiple rules comprises modifying at least a portion of a list of storage resources associated with the user by performing one or more actions as prescribed by the rule in conjunction the request attributes; generating a software-defined storage deployment plan based on the execution of the multiple rules; and performing at least one automated action based on the generated software-defined storage deployment plan.

Policy-based automated generation of software-defined storage deployments

A method includes monitoring an enterprise system to identify cryptographic techniques utilized by one or more components of the enterprise system, the one or more components comprising at least one of physical and virtual computing resources. The method also includes generating one or more profiles characterizing usage of at least a given one of the identified cryptographic techniques by at least a given one of the one or more components of the enterprise system and determining an effect of cryptographic obsolescence of the given identified cryptographic technique on the enterprise system utilizing the generated one or more profiles. The method further includes identifying one or more remedial actions for mitigating the effect of cryptographic obsolescence of the given identified cryptographic technique on the enterprise system and initiating one or more of the identified remedial actions to modify a configuration of one or more components of the enterprise system.

Identifying and mitigating risks of cryptographic obsolescence

Techniques are provided for protection of private keys in message signing based on elliptic curve cryptography. One method comprises obtaining a private key to generate a signature for a message; selecting a random integer as an internal private key in a predefined range based on an elliptic curve order; computing an internal public key as an elliptic curve point using a scalar multiply operation based on (i) the internal private key blinded using a random blinding value, (ii) an elliptic curve base point, and (iii) an inverse value for the random blinding value added to a result of the scalar multiply operation; generating a first signature portion based on the elliptic curve point; generating a second signature portion based on an inverse of the selected random integer generated from a message-dependent value and the first signature portion; and forming a signed message using the first and second signature portions.

Blinding techniques for protection of private keys in message signing based on elliptic curve cryptography

Blockchain encryption techniques are provided. An exemplary method includes sending a signed transaction with at least two users to a blockchain; obtaining, by a first user, a public key of a second user from the blockchain; generating, by the first user, a symmetric key by combining a private key of the first user and the public key of the second user; encrypting, by the first user, a data item using the symmetric key; and providing the encrypted data item to the blockchain. The second user obtains the encrypted data item and a public key of the first user from the blockchain, and decrypts the encrypted data item using the symmetric key generated, by the second user, by combining a private key of the second user and the public key of the first user.

Methods and apparatus for blockchain encryption

A computerized device and a process protect against denial-of-service (DoS) attacks by using a memory-time hard problem that a client (e.g., IoT device or mobile app) solves as part of a request such as an initial registration process. The process may use parameters obtained from a public source of randomness. The problem is designed such that all memory allocated for the algorithm is used in a random manner, making it difficult for attackers to use FPGA/ASIC approaches. The client provides a proof-of-work (PoW) value to a server, which performs a more directed version of the calculation done by the client to confirm that the PoW value is correct. When confirmation is not obtained, the server can refrain from further processing of the client request, thwarting DoS attacks.

Server using proof-of-work technique for hardening against denial of service attacks

A computer-implemented method of protecting digital data includes applying a key derivation function to a first value to generate a first derived key, the first value being equal to or derived from a first input password. The first derived key is combined with the digital data to generate a protected record stored in the computer. Subsequently, the key derivation function is applied to a second value to generate a second derived key, the second value being equal to or derived from a second input password. The protected record is processed using the second derived key to permit access to the digital data when the second derived key matches the first derived key. The key derivation function includes iterations of a two-stage hashing operation creating and using an array of memory blocks whose size is specified independently of the number of iterations to decouple processing and memory requirements.

Computer data protection using tunable key derivation function

A blinding function is generated. The blinding function is applied to a random value to generate a blinded random value. The blinded random value is utilized for one or more scalar multiplications in an elliptic curve cryptographic operation.

Blinding function in elliptic curve cryptography

Secret values used in a multi-server authentication scheme are updated. Information is authenticated in a system comprising a plurality of processing devices each adaptable for communication with one or more other devices. The information is authenticated by generating at least first and second shares of a first password associated with a first device (such as a client device); storing the first and second shares in respective second and third devices of the plurality of devices; updating the first and second shares using a personalized proactivization value; assigning a version number to the updated first and second shares; and upon submission of additional information associated with the first device to at least one of the second and third devices, the second and third devices utilizing the respective updated first and second shares for a given version number to collectively determine a correspondence of the additional information with the first password.

Multi-server authentication using personalized proactivization

Secret values used in a multi-server authentication scheme are updated. Information is authenticated in a system comprising a plurality of processing devices each adaptable for communication with one or more other devices. The information is authenticated by generating at least first and second shares of a first password associated with a first device (such as a client device); storing the first and second shares in respective second and third devices (such as authentication server devices); updating the first and second shares using a secret value T; assigning a version number to the updated first and second shares; and upon submission of additional information associated with the first device to at least one of the second and third devices, the second and third devices utilizing the respective updated first and second shares for a given version number to collectively determine a correspondence of the additional information with the first password.

Multi-server authentication using proactivization journaling

An improved technique involves storing current and one previous version of the secret shares in their respective databases. Along these lines, authentication servers split the proactivization process into several phases, during which they communicate a failure or success to complete that phase. During one of these phases, the authentication servers delete a previous version of their secret share and label the current version as the previous version. At another phase, the authentication servers generate a new version of each secret share (via one way deterministic transform) and store that new version alongside that previous version. Accordingly, when a user submits secret shares for authentication to the authentication servers, each authentication server determines the state of the corresponding authentication server and chooses the secret share according to that state.

Multi-server fault tolerant data store update

Methods, systems, apparatus and articles of manufacture for secure recoverable offline storage of a shared secret are provided herein. A method includes establishing a connection with a cryptographic device to access a first item of encrypted information maintained by the cryptographic device, wherein the first item of encrypted information comprises an item of cryptographic information encrypted with a first item of key information, decrypting the first item of encrypted information with a second item of key information to retrieve the item of cryptographic information, and encrypting the item of cryptographic information with a third item of key information to create a second item of encrypted information, wherein the third item of key information is associated with the cryptographic device.

Secure recoverable offline storage of a shared secret

A processing device comprises a processor coupled to a memory and is configured to obtain an intermediate value of a hash chain associated with a given access control interval, to utilize at least a portion of the intermediate value to access a protected resource during the given access control interval, and to repeat the obtaining and utilizing for one or more additional access control intervals using respective different intermediate values of the hash chain. The hash chain may comprise one of a plurality of hash chains derived from a common key, where the plurality of hash chains are associated with corresponding distinct resources and initial values of the plurality of hash chains are determined as respective functions of the common key and identifying information for corresponding ones of the protected resources.

Protected resource access control utilizing intermediate values of a hash chain

A processing device comprises a processor coupled to a memory and is configured to associate intermediate values of a hash chain with respective access control intervals, and to provide a given one of the intermediate values to user in order to allow the user to access a protected resource in the corresponding access control interval. A final value of the hash chain is provided to an access control module associated with the protected resource, and an initial value of the hash chain is stored in a secure manner. The hash chain may be generated by applying a one-way hash function to the initial value a designated number of times in order to obtain the intermediate values and the final value. The protected resource may comprise, for example, a storage array or other processing platform component, with the intermediate values controlling service technician access to that component.

In an encrypted storage system employing data deduplication, encrypted data units are stored with the respective keyed data digests. A secure equivalence process is performed to determine whether an encrypted data unit on one storage unit is a duplicate of an encrypted data unit on another storage unit. The process includes an exchange phase and a testing phase in which no sensitive information is exposed outside the storage units. If duplication is detected then the duplicate data unit is deleted from one of the storage units and replaced with a mapping to the encrypted data unit as stored on the other storage unit. The mapping is used at the one storage unit when the corresponding logical data unit is accessed there.

Growing community of inventors

Annerley, Australia

Eric Young