Dell Products Inc.

Lee Serfaty

Yehiel Zohar

Ofir Ezrielev

Reinstating access to a system of an admin whose certificate is invalid or expired is disclosed. A requestor may send a request for reinstatement to tenant admins. The initiating tenant admin may initiate a voting operation to reinstate the requestor as an admin of a computing system. During the voting operation, multiple control points are implemented. At each control point, a key of the requestor is verified. The voting operation only proceeds when the key verification is successful. The voting operation is a gradual access recovery process where required keys are revealed over time and in a specific sequence.

Gradual access recovery in time and authorization

Reinstating access to a system of an admin whose certificate is invalid or expired is disclosed using a secret that is remapped. When the admin's certificate is expired, the admin may send a request for reinstatement to tenant admins. The voting operation is based on shares of a secret that have been distributed to validators. When the shares are successfully reconstructed to obtain the secret, the voting operation is affirmed or allowed to proceed. The secret is remapped after a period of time. Remapping the secret includes creating a new secret and distributing new shares of the new secret to a different set of validators.

Improving decentralization of last resort recovery using secrets

Methods and systems for securing distributed systems are disclosed. The distributed systems may include data processing systems subject to compromise by malicious entities. If compromised, the data processing systems may impair the services provided by the distributed system. To secure the distributed systems, the data processing systems may implement a security framework. The security framework may utilize a hierarchy that defines authority for validating trusted entities. The hierarchy may vest authority across the distributed system, and may be based on a reputation (e.g., weighted reputation) of each of the data processing systems within the distributed system. The hierarchy may be dynamically updated over time as new information regarding data processing systems is discovered. Consequently, the impact of compromise of a data processing system may be limited by the distributed authority.

System and method for dynamic security frameworks in distributed systems

Methods and systems for securing distributed systems are disclosed. The distributed systems may include data processing systems subject to compromise by malicious entities. If compromised, the data processing systems may impair the services provided by the distributed system. To secure the distributed systems, the data processing systems may implement a security framework. The security framework may utilize a hierarchy that defines authority for validating trusted entities. The hierarchy may vest authority across the distributed system, and may be based on a reputation (e.g., weighted reputation) of each of the data processing systems within the distributed system. The hierarchy may be dynamically updated over time as new information regarding data processing systems is discovered. If the reputation of a data processing system meets criteria, that data processing system may be treated as being compromised. Consequently, the impact of compromise of the data processing system may be limited by the distributed authority.

System and method for resecuring distributed system responsive to compromise event

Methods and systems for securing distributed systems are disclosed. The distributed systems may include data processing systems subject to compromise by malicious entities. If compromised, the data processing systems may impair the services provided by the distributed system. To secure the distributed systems, the data processing systems may implement a security framework. The security framework may utilize a hierarchy that defines authority for validating trusted entities. The hierarchy may vest authority across the distributed system, and may be based on a reputation (e.g., weighted reputation) of each of the data processing systems within the distributed system. If the reputation of a data processing system meets criteria, the data processing system may be treated as being compromised and a local refresh of security data may be performed. Consequently, the impact of compromise of the data processing system may be limited by the distributed authority.

System and method for selective refresh of security data responsive to compromise event

Methods and systems for securing distributed systems are disclosed. The distributed systems may include data processing systems subject to compromise by malicious entities. If compromised, the data processing systems may impair the services provided by the distributed system. To secure the distributed systems, the data processing systems may implement a security framework. The security framework may utilize a hierarchy that defines authority for validating trusted entities. The hierarchy may vest authority across the distributed system. Consequently, the impact of compromise of a data processing system may be limited by the distributed authority.

System and method for security management in distributed systems

Methods and systems for securing distributed systems are disclosed. The distributed systems may include data processing systems subject to compromise by malicious entities. If compromised, the data processing systems may impair the services provided by the distributed system. To secure the distributed systems, the data processing systems may implement a security framework. The security framework may utilize a hierarchy that defines authority for validating trusted entities. The hierarchy may vest authority across the distributed system, and may be based on a reputation (e.g., weighted reputation) of each of the data processing systems within the distributed system. If the reputation indicates that a data processing system is compromised, the data processing system may be ejected and a communication topology of the distributed system may be remodeled.

System and method for managing communication paths responsive to compromise events

Methods and systems for securing distributed systems are disclosed. The distributed systems may include data processing systems subject to compromise by malicious entities. If compromised, the data processing systems may impair the services provided by the distributed system. To secure the distributed systems, the data processing systems may implement a security framework. The security framework may utilize a hierarchy that defines authority for validating trusted entities. The hierarchy may vest authority across the distributed system, and may be based on a reputation (e.g., weighted reputation) of each of the data processing systems within the distributed system. Consequently, the impact of compromise of a data processing system may be limited by the distributed authority.

Last resort access to backups is disclosed. An encrypted backup associated with a first system or vault is stored in the backup associated with another system. If a key needed to decrypt a backup in the first vault is unavailable, an encrypted copy of a backup in the second vault may be used for the recovery operation. Incremental backups from the first and/or second vault, which may be difference incremental backups and may be unencrypted, may be used in the recovery operation.

Last resort access to backups stored in vaults

Reinstating access to a system of an admin whose certificate is invalid or expired is disclosed. When the admin's certificate is expired, the admin may send a request for reinstatement to tenant admins. The voting operation is based on shares of a secret that have been distributed to validators. When the shares are successfully reconstructed to obtain the secret, the voting operation is affirmed or allowed to proceed. If the vote is successful, access for the admin is restored or reinstated.

Growing community of inventors

Be'er Sheba, Israel

Lee Serfaty