Dell Products Inc.

Emc IP Holding Company LLC

Dell & Products L.p.

Maxim Balin

Yevgeni Gehtman

Tomer Shachar

Stav Sapir

Roman Bober

Igor Dubrovsky

Boris Shpilyuck

Arieh Don

Ofir Ezrielev

Shree Ramakrishna Rathinasamy

Nisan Haimov

Doron Bokobza

Yehiel Zohar

Eliyahu Rosenes

Or Herman Saffar

Tomer Kushnir

Eyal Porges

Nechami Maman

Parminder Singh Sethi

Bradley K Goodman

Thomas L Watson

Joseph Caisse

Eric Joseph Bruno

Akanksha Goel

Efi Levi

Lior Benisty

Natasha Gaurav

Padmanabhan Narayanan

Boris Giterman

Yeh'iel Zohar

Emmanuel Andre

Techniques are provided for access control using policy-based dynamic context evaluation. One method comprises obtaining an access request comprising a first attestation identifier that is based on an evaluation of a first set of context attributes, associated with the request and identified by evaluating a context policy. In response to obtaining the request: a second set of context attributes for evaluating the first attestation identifier may be dynamically determined by evaluating the context policy. Values for the second set of context attributes may be obtained to generate a second attestation identifier. The first attestation identifier and the second attestation identifier may be compared and access to the resource may be controlled based on a result of the comparison. The first attestation identifier may be generated by a context attestor and the comparison may be performed by a context enforcer.

Access control using policy-based dynamic context evaluation

The technologies described herein are generally directed toward maintaining data coherence after an updating node fails during an update. According to an embodiment, a system can comprise a processor and a memory that can enable performance of operations including respectively mapping a logical storage resource to first and second storage resources in first and second security zones associated with first provider and second providers. The operations can further include receiving a request to store a data resource at the logical storage resource. Further, the operations can include, based on a distribution policy associated with the data resource, dividing, by the storage controller equipment, the data resource into a first storage segment stored on the first storage resource and a second storage segment stored on the second storage resource.

Dividing data between storage equipment in different security zones

Methods and systems for managing communication with endpoint devices in a deployment are disclosed. The method may include establishing a limited communication channel between an endpoint device of the endpoint devices and an orchestrator to prevent the endpoint device from directly communicating and event consumer. The method may also include providing, by the orchestrator and to the endpoint device, an event schema that defines formatting for event data generated by the endpoint device. When event data is obtained by the orchestrator from the endpoint device, the orchestrator may identify whether the event data is reliable based on a digital signature provided with the event data from the endpoint device. If the event data is identified to be reliable, the event data may be provided to any number of event consumers.

Managing communication with endpoint devices in an edge environment

Methods and systems for managing the operation of data processing systems are disclosed. To manage the operation of the data processing systems, containerized services may be deployed. Once deployed, desired services may be provided. Prior to deployment, images and metadata used in the deployment may be analyzed. The analysis may reduce threats presented by the deployment of the containerized services. During the analysis, the integrity of the images and metadata may be verified, and the privilege of containerized services based on the metadata and images may be reviewed.

Managing deployment of services to data processing systems

Methods and systems for managing systems are disclosed. To manage the systems, backups of data used by the systems may be generated and stored for future use. To limit overhead for generation and storage of the backups, portions of data may be evaluated for relative importance using an automated evaluation process. The automated evaluation process may take into account entities involved in data access chains, access frequency, data location, and/or other factors. The resulting evaluations may be used to selectively deploy limited computing resources for backing up of different portions of data.

Edge computing-enhanced system for business priority-based resource allocation

Methods and systems for managing operation of endpoint devices are disclosed. The operation of the endpoint devices may be managed by requiring that the endpoint devices obtain security data from other devices. If the security data is not obtained, the endpoint devices may seal at least some of their functions from use by users. By limiting the functions of the endpoint devices, malicious parties may be less likely to be able to compromise the endpoint devices. The endpoint devices and other devices may be operably connected via a channel that limits that distance between the endpoint devices and the other devices. If the distance is exceeded, then the endpoint devices may be deprived of access to the security data.

Extended root of trust validation for remote edge devices

Devices, systems, and methods for managing data processing systems are disclosed. The data processing systems may include hardware components that generate heat. The heat may be managed using flows of gasses. Filters may be used to screen particulates entrained in the flows of gasses. The data processing systems may include a system for managing accumulations of particulates over time. The system may refresh the filters over time by reducing the particulate accumulations on the filters.

Management of hardware in environments that include particulates

A coherent signal is transmitted to cancel a baseband signal at a baseband frequency generated by a component of a wireless communication device while information corresponding to the baseband signal may be transmitted from the wireless communication device at an upconverted frequency. Generating and transmitting of the coherent signal may be responsive to detecting signal energy of a remotely generated baseband energy that may be generated by a remote sniffing device attempting to eavesdrop, or snoop, and remotely and wirelessly steal information from detecting of the baseband signal's electromagnetic energy. The coherent signal may be transmitted directionally to increase cancellation of the baseband signal at a likely location, or in a likely direction, of the eavesdropping device.

Prevention of electromagnetic wave detection in a wireless communication network

Methods and systems for managing computing infrastructure compliance with standards are disclosed. The computing infrastructure may provide computer implemented services that may be at elevated risk if the computing infrastructure fails to comply with various standards such as security or redundancy standards. To manage compliance with standards, a cross-standard compliance coverage model may be used. The cross-standard compliance coverage model may use information regarding infrastructure components of the computing infrastructure to ascertain compliance with any number of standards. The compliance and conditions of the infrastructure may be used to identify security threats to which the infrastructure components are likely to be exposed.

System and method for identifying security threats based on standard compliance failures and infrastructure conditions

Methods and systems for managing edge devices are disclosed. The edge devices may be managed using playbooks. The playbooks may be used to manage operation and security of edge devices. The playbooks may be generated by the edge devices and include implementation mapping and vulnerabilities mapping of software on the edge devices. For an issue of an edge device of the edge devices, an administrator may include a change to a code base of the software in the playbook. The change to the code base of the software in the playbook may initiate generation of a new playbook that includes the change.

Managing operation of edge devices using playbooks

Methods and systems for managing data in a deployment comprising edge devices are disclosed. The data may include sensitive data. The sensitive data may be managed by embedding the sensitive data in digital content data in a steganographic manner. After embedding the sensitive data, the digital content data may be transmitted between edge devices through a data stream. In the transmission of the digital content data, the sensitive data may be imperceptible to monitoring by an unauthorized third-party. Because the sensitive data may be imperceptible in the transmission, the edge devices may securely share the sensitive data. Because the edge devices may securely share the sensitive data, computer implemented services may be improved.

Securing sensitive data in edge devices using steganography

Systems and methods support segmenting and encrypting a data object. For instance, a computing system may segmented data object into multiple chunks and then encrypt each of the chunks according to pseudo-randomly selected encryption algorithms. A result is that the data object has been split into multiple encrypted chunks, where the encrypted chunks have some amount of pseudo-randomness in their encryption.

Computing systems and methods providing segmented encryption

Techniques are provided for device protection using pre-execution command interception and user authentication. One method comprises obtaining, by a software entity associated with an operating system kernel of a device, a request from a user to execute a command; determining, by the software entity associated with the operating system kernel, prior to an execution of the command, whether the command is a command of a designated command type; initiating a multi-factor authentication of the user in response to determining that the command is a command of the designated command type; and initiating an execution of the at least one command based on a result of the multi-factor authentication of the user. The determination of whether the command comprises the command of the designated command type evaluates command properties and/or command criteria. The command may be compared to a protected list of commands of the designated command type.

Device protection using pre-execution command interception and user authentication

Methods and systems for securing blueprints are disclosed. A blueprint may be secured by requiring sufficient privilege to implement the blueprint. The sufficient privilege may be obtained through an analysis of permissions of a blueprint user and the blueprint authors. An analysis of the permissions of the blueprint user and the blueprint authors may include reviewing privileges of the blueprint user and the blueprint authors. When the sufficient privilege may be found for the blueprint user and the blueprint authors, use of the blueprint may be permitted on an edge device.

Securing blueprints for implementation in edge devices

Methods, systems, and devices for providing computer implemented services are disclosed. To provide the computer implemented services while using software objects that provide a surface area of attack that may compromise the services, the software objects may be analyzed and modified. To do so, a relative usefulness of computer code, on which the software objects depend, may be established. An action set may then be obtained based on the relative usefulness. The action set may include actions to be performed to modify the software objects. By doing so, the software objects may be modified in a manner that reduces the surface area of attack, thereby reducing a likelihood of compromise to the computer implemented services.

Growing community of inventors

Gan Yavne, Israel

Maxim Balin