Dell Products Inc.

Emc IP Holding Company LLC

Maxim Balin

Yevgeni Gehtman

Tomer Shachar

Stav Sapir

Arieh Don

Boris Shpilyuck

Igor Dubrovsky

Nisan Haimov

Ofir Ezrielev

Shree Ramakrishna Rathinasamy

Or Herman Saffar

Yehiel Zohar

Roman Bober

Parminder Singh Sethi

Thomas L Watson

Bradley K Goodman

Eric Joseph Bruno

Joseph Caisse

Akanksha Goel

Natasha Gaurav

Efi Levi

Tomer Kushnir

Lior Benisty

Boris Giterman

Padmanabhan Narayanan

Eliyahu Rosenes

Emmanuel Andre

Doron Bokobza

Nechami Maman

One example method includes identifying a process that includes both a write operation and a transmit operation, wherein the write operation comprises performing a malicious process on data that renders the data unusable to an owner of the data, and the transmit operation comprises transmitting the data after the data has been acted upon by the malicious process, performing a snapshot operation to create a snapshot that comprises a copy of the data after the data has been acted upon by the malicious process and/or while the data is being acted upon by the malicious process, and intercepting the data before, or while, the transmit operation is performed.

Reversing symmetric encryptions using keys found in snapshots—per-file keys, random and transmitted outside

Methods and systems for managing operation of endpoint devices are disclosed. The operation of the endpoint devices may be managed by requiring that the endpoint devices obtain security data from other devices. If the security data is not obtained, the endpoint devices may seal at least some of their functions from use by users. By limiting the functions of the endpoint devices, malicious parties may be less likely to be able to compromise the endpoint devices. The endpoint devices and other devices may be operably connected via a channel that limits that distance between the endpoint devices and the other devices. If the distance is exceeded, then the endpoint devices may be deprived of access to the security data.

Time varying information encoding scheme for device security

A network connected storage device detects unusual file-sharing-command activity based on a baseline file-sharing-command signature and analyzes files stored on the storage with respect to a parameter, such as entropy, to determine whether ransomware may have infiltrated the storage device, or a storage associated therewith. Applying by the storage device a function to an entropy value corresponding to a second portion of a file may result in a determination that an analyzed entropy corresponding to the second portion may have been partially encrypted by ransomware. The analyzed entropy corresponding to the second file portion may be compared to an entropy of a first file portion. The first file portion may be a different portion of the same file as the second portion or may be the same portion of the same file that resulted from analysis before the triggering event.

Analyzing file entropy to identify adverse conditions

Methods and systems for managing operation of data processing systems with limited access to an uplink pathway are disclosed. To manage the operation, a system may include a data processing system manager, a data collector, and one or more data processing systems. The data processing system manager may identify future events that may impact operation of the data processing system using a digital twin and observational data. A cache hosted by the data processing system may store events and commands associated with the events. The commands may include action sets intended to mitigate impacts of the events. If the data processing system does not have commands associated with the simulated future events stored in the cache, the data processing system manager may provide instructions for replacing at least a portion of the commands stored in the cache with commands responsive to the simulated future events.

System and method for managing a cache hosted by a data processing system using a digital twin

Methods and systems for managing computing infrastructure compliance with standards are disclosed. The computing infrastructure may provide computer implemented services that may be at elevated risk if the computing infrastructure fails to comply with various standards such as security or redundancy standards. To manage compliance with standards, a cross-standard compliance coverage model may be used. The cross-standard compliance coverage model may use information regarding infrastructure components of the computing infrastructure to ascertain compliance with any number of standards. The information and risk tolerance may be used to identify a risk profile presented by computing infrastructure.

System and method for quantification of standard compliance and risk tolerance to select remediation

Methods and systems for managing operation of endpoint devices are disclosed. To manage the operation of endpoint devices, clusters of endpoint devices may be established. The members of the cluster may utilize synchronized data across the cluster to provide various computer implemented services. To synchronize the synchronized data, updates made to local copies of the synchronized data may be distributed to maintain synchronization of other copies of the synchronized data. By doing so, different members of the cluster may have access to synchronized data.

Distribution of data in clusters of devices

Methods and systems for managing the operation of data processing systems are disclosed. To manage the operation of the data processing systems, access control standards for software may be enforced during development and/or deployment of software. The access control standards may indicate the extent of access controls for data that are to be in place for various pieces of software. The access control standards may also indicate a level of consistency in the sources of truth for permissions enforced by the access controls.

Access control management for systems

One method includes monitoring a ransomware risk measure, when the ransomware risk measure indicates the presence of a suspected ransomware process, determining if it is time to overwrite a snapshot stored in backup data storage, and when it is time to overwrite the snapshot, moving the snapshot from the backup data storage to a vault to free space in the backup data storage for new snapshots that continue to be taken after the presence of suspected ransomware is indicated.

Vault overwriting after PLC (protection lifecycle) designation disallowance by transmission to public vault

Methods and systems for managing secrets are disclosed. To manage secrets, backups of the secrets may be obtained to facilitate future recoveries of the secrets. While backed up, the secrets may be protected with a security model. The security model may prescribe how decryption keys are maintained, and how various copies of the backed up secrets are to be separated from the decryption keys for encrypted copies of the secrets. When access to a secret is lost, a recovery may be performed using a corresponding encrypted backup of the secret.

Secret management in distributed systems using passphrases

An unreversible command is verified and validated pre-execution in an IHS, and execution of the unreversible command is authenticated in the IHS with (a) physical component(s). The physical component(s) may be a pair of pre-registered disks-on-keys (DOKs), wherein the DOKs are simultaneously connected to pre-registered slots of the IHS, and a determination is made whether a serial number of each respective pre-registered DOK is correlated with a respective pre-registered slot number (and IHS motherboard serial number) in a Trusted Platform Module (TPM) of the IHS. Alternatively, or additionally, (the) (a) physical component(s) may be (a) physical token(s) (DOK(s)) produced when a pre-approval for execution of the unreversible command on the IHS is granted, wherein (a) security attribute(s) for execution of the unreversible command on the IHS is/are set and the physical token is signed with a public key which matches a private key stored in a TPM of the IHS.

Verification and/or validation of unreversible information handling system commands

Methods and systems for securing network access for edge gateway devices are disclosed. The network access may be secured for edge gateway devices through establishment of a communication channel. The communication channel may be established between an edge gateway device and an edge orchestrator. The edge orchestrator may manage operations of the edge gateway device after authenticating the edge gateway device. If the edge gateway device cannot be authenticated, then the edge orchestrator may limit activity with respect to the edge gateway device.

Managing network access for edge gateway devices

Methods and systems for managing operation of a distributed system comprising a data center and edge devices. The operation of the distributed system may be managed by monitoring the edge devices. The edge devices may be monitored by identifying the health state of an edge device. The health state of the edge device may be identified by collecting data from operation of similar edge devices and the edge device and comparing the differences in between the data. If the differences between the data from the operation of the similar edge devices and operation of the edge device may exceed criteria for deviation, then the edge device may be determined to be in an unhealthy health state.

Identifying the health state of edge devices

Methods and systems for managing a backup system are disclosed. Edge infrastructures may be made up of large numbers of edge devices that produce and store a wide variety of data. A data backup system is implemented to locate and monitor locations of data stored in these edge infrastructures such that users wanting to backup data from these edge infrastructures are not required to know an exact location and/or an exact name of the data to be backed up. In particular, the data backup system could backup data using only natural language descriptions of the data that is provided by the user.

System and method for backing up data from edge infrastructures

Methods and systems for managing vulnerabilities presented by data processing systems are disclosed. The vulnerabilities may be managed by identifying components of the data processing systems using different processes depending on the computing resource availabilities of the data processing systems. Once identified, corresponding vulnerabilities for the components may be identified. The identified vulnerabilities may then be managed by performing various actions.

System and method for management of system vulnerabilities

Methods and systems for storing data are disclosed. To store data, transactions may be generated and sent to a storage system. Hashes of the transaction may also be generated and distributed to ledger agents of a distributed ledger system. The hashes of the transaction may be used by the storage system to verify integrity of the transaction. To establish trust in the ledger agents, the storage system may require that the hashes of the transaction be signed with a private key. The private key may be protected with multiple protection mechanisms.

Growing community of inventors

Gan Yavne, Israel

Maxim Balin