Dell Products Inc.

Emc IP Holding Company LLC

Maxim Balin

Yevgeni Gehtman

Tomer Shachar

Stav Sapir

Ofir Ezrielev

Arieh Don

Boris Shpilyuck

Igor Dubrovsky

Nisan Haimov

Roman Bober

Shree Ramakrishna Rathinasamy

Yehiel Zohar

Or Herman Saffar

Tomer Kushnir

Eliyahu Rosenes

Parminder Singh Sethi

Bradley K Goodman

Thomas L Watson

Eric Joseph Bruno

Joseph Caisse

Akanksha Goel

Natasha Gaurav

Efi Levi

Lior Benisty

Padmanabhan Narayanan

Boris Giterman

Yeh'iel Zohar

Emmanuel Andre

Doron Bokobza

Nechami Maman

Methods and systems for managing data in a system comprising edge devices and a data transfer bus is disclosed. The data may be managed by encrypting with homomorphic encryption and storing the data in edge devices. The edge devices may be stored in a physically insecure locations and maintain encryption of the data between edge devices. The data that is stored and in an encrypted state may include personally identifiable information. Maintaining encryption of the personally identifiable information between edge devices may prevent exposure to memory of the edge devices. Preventing exposure to memory of the personally identifiable identification may prevent a likelihood of a malicious attack and/or malware from finding the personally identifiable information if the malicious attack and/or malware may monitor memory of the edge devices.

Managing access to sensitive information

Methods and systems for securing data processing systems are disclosed. The data processing systems may be secured through analysis of recognition and simulation of commands that may be run on data processing systems. An analysis of recognition of the command may be used to query if the command has already been simulated for its effects on the data processing system. If the command may have already simulated the command, then the data processing system may know whether to execute the command. Conversely, if the command may not have been simulated, the command may be simulated to understand the effects on the data processing system. In understanding the effects of the command, the data processing system may formulate whether to execute the command.

System and method for securing data processing systems through recognition and analysis of commands

An information handling system includes a memory and a processor. The memory stores a compliance node environment. The processor creates the compliance node environment. In response to reception of a compliance update, the processor stores the compliance update. Based on the compliance update, the processors determine a first compliance coverage for a sub-domain of a compliance type in the compliance node environment. Based on the first compliance coverage for the sub-domain, the processors determine a second complete coverage for the compliance type associated with the sub-domain.

Dynamic cross-standard compliance coverage

Methods and systems for managing data processing systems that provide computer-implemented services are disclosed. A data processing system (e.g., device) may include and depend on the operation of its hardware and/or software components in order to provide the computer-implemented services. To manage the operation of a device, a device manager may obtain log data (e.g., sequences of log messages) for the components of the device that reflect the operational activity of the device and/or its components. The log data may be analyzed automatically (e.g., in real-time), using a repository of known log data sequences, to identify operational issues and/or corresponding responses to the operational issues. The responses may include compensatory and/or correctional actions for remediation of the operational issues. The automated methods may provide an efficient and cost-effective method for managing device operational issues that may reduce the likelihood of the device becoming impaired and/or interruptions in the computer-implemented services.

Managing operational functionality of far edge devices using log data

Techniques are provided for remote access control using validation of a physical location of a remote user. One method comprises obtaining a request from a user associated with a first entity to remotely access a network associated with a second entity; and, in response to the request, performing the following steps: determining if a location of the user is at least partially within at least one designated location associated with the first entity; and initiating a granting of the request to remotely access the network in response to a result of the determining. An evaluation of whether the user is connected to a network of the first entity may also be performed in response to the request from the user to remotely access the network. The request to remotely access the network may be in connection with the user remotely maintaining a product of the second entity.

Remote access control using validation of physical location of remote user

Methods and systems for managing operation of endpoint devices are disclosed. The operation of the endpoint devices may be managed by distributing updates to the endpoint devices. To facilitate distribution, some endpoint devices may be grouped and one of the group may be selected to serve as a coordinating endpoint device. The coordinating endpoint device may serve as a single source of contact for a coordinator tasked with distributing updates to endpoint devices of the group. The coordinating endpoint device may obtain and distribute copies of the updates to recipient endpoint devices.

Distributing endpoint devices configuration via coordinator device

One example method includes monitoring a file access request made by a process, searching, in a pointer array that corresponds to the process, for a pointer to the file that was requested by the process, when the pointer is found in the pointer array, incrementing a score associated with the process, performing an anomaly detection check, and when an anomaly is detected, blocking access to the file by the process, and when no anomaly is detected, updating the pointer array to include a pointer to the file to which access was requested by the process.

Ransomware detection using inode traversal scoring

A bait file owned by a bait process is created and locked in a computing system. Attempts or access the bait file or kill the bait process are detected. The process attempting to access the bait file or kill the bait process is viewed as malicious and protective operations are performed in the computing system.

Ransomware detection via monitoring open file or process

One example method includes identifying a process that includes both a write operation and a transmit operation, wherein the write operation comprises performing a malicious process on data that renders the data unusable to an owner of the data, and the transmit operation comprises transmitting the data after the data has been acted upon by the malicious process, performing a snapshot operation to create a snapshot that comprises a copy of the data after the data has been acted upon by the malicious process and/or while the data is being acted upon by the malicious process, and intercepting the data before, or while, the transmit operation is performed.

Reversing symmetric encryptions using keys found in snapshots—per-file keys, random and transmitted outside

Methods and systems for managing operation of endpoint devices are disclosed. The operation of the endpoint devices may be managed by requiring that the endpoint devices obtain security data from other devices. If the security data is not obtained, the endpoint devices may seal at least some of their functions from use by users. By limiting the functions of the endpoint devices, malicious parties may be less likely to be able to compromise the endpoint devices. The endpoint devices and other devices may be operably connected via a channel that limits that distance between the endpoint devices and the other devices. If the distance is exceeded, then the endpoint devices may be deprived of access to the security data.

Time varying information encoding scheme for device security

A network connected storage device detects unusual file-sharing-command activity based on a baseline file-sharing-command signature and analyzes files stored on the storage with respect to a parameter, such as entropy, to determine whether ransomware may have infiltrated the storage device, or a storage associated therewith. Applying by the storage device a function to an entropy value corresponding to a second portion of a file may result in a determination that an analyzed entropy corresponding to the second portion may have been partially encrypted by ransomware. The analyzed entropy corresponding to the second file portion may be compared to an entropy of a first file portion. The first file portion may be a different portion of the same file as the second portion or may be the same portion of the same file that resulted from analysis before the triggering event.

Analyzing file entropy to identify adverse conditions

Methods and systems for managing operation of data processing systems with limited access to an uplink pathway are disclosed. To manage the operation, a system may include a data processing system manager, a data collector, and one or more data processing systems. The data processing system manager may identify future events that may impact operation of the data processing system using a digital twin and observational data. A cache hosted by the data processing system may store events and commands associated with the events. The commands may include action sets intended to mitigate impacts of the events. If the data processing system does not have commands associated with the simulated future events stored in the cache, the data processing system manager may provide instructions for replacing at least a portion of the commands stored in the cache with commands responsive to the simulated future events.

System and method for managing a cache hosted by a data processing system using a digital twin

Methods and systems for managing computing infrastructure compliance with standards are disclosed. The computing infrastructure may provide computer implemented services that may be at elevated risk if the computing infrastructure fails to comply with various standards such as security or redundancy standards. To manage compliance with standards, a cross-standard compliance coverage model may be used. The cross-standard compliance coverage model may use information regarding infrastructure components of the computing infrastructure to ascertain compliance with any number of standards. The information and risk tolerance may be used to identify a risk profile presented by computing infrastructure.

System and method for quantification of standard compliance and risk tolerance to select remediation

Methods and systems for managing operation of endpoint devices are disclosed. To manage the operation of endpoint devices, clusters of endpoint devices may be established. The members of the cluster may utilize synchronized data across the cluster to provide various computer implemented services. To synchronize the synchronized data, updates made to local copies of the synchronized data may be distributed to maintain synchronization of other copies of the synchronized data. By doing so, different members of the cluster may have access to synchronized data.

Distribution of data in clusters of devices

Methods and systems for managing the operation of data processing systems are disclosed. To manage the operation of the data processing systems, access control standards for software may be enforced during development and/or deployment of software. The access control standards may indicate the extent of access controls for data that are to be in place for various pieces of software. The access control standards may also indicate a level of consistency in the sources of truth for permissions enforced by the access controls.

Growing community of inventors

Gan Yavne, Israel

Maxim Balin