Dell Products Inc.

Emc IP Holding Company LLC

Maxim Balin

Yevgeni Gehtman

Tomer Shachar

Stav Sapir

Roman Bober

Ofir Ezrielev

Igor Dubrovsky

Arieh Don

Boris Shpilyuck

Shree Ramakrishna Rathinasamy

Nisan Haimov

Doron Bokobza

Yehiel Zohar

Eliyahu Rosenes

Or Herman Saffar

Tomer Kushnir

Eyal Porges

Parminder Singh Sethi

Bradley K Goodman

Thomas L Watson

Joseph Caisse

Eric Joseph Bruno

Akanksha Goel

Natasha Gaurav

Efi Levi

Lior Benisty

Padmanabhan Narayanan

Boris Giterman

Yeh'iel Zohar

Emmanuel Andre

Nechami Maman

Methods and systems for managing edge devices are disclosed. The edge devices may be managed using playbooks. The playbooks may be used to manage operation and security of edge devices. The playbooks may be generated by the edge devices and include implementation mapping and vulnerabilities mapping of software on the edge devices. For an issue of an edge device of the edge devices, an administrator may include a change to a code base of the software in the playbook. The change to the code base of the software in the playbook may initiate generation of a new playbook that includes the change.

Managing operation of edge devices using playbooks

Methods and systems for managing data in a deployment comprising edge devices are disclosed. The data may include sensitive data. The sensitive data may be managed by embedding the sensitive data in digital content data in a steganographic manner. After embedding the sensitive data, the digital content data may be transmitted between edge devices through a data stream. In the transmission of the digital content data, the sensitive data may be imperceptible to monitoring by an unauthorized third-party. Because the sensitive data may be imperceptible in the transmission, the edge devices may securely share the sensitive data. Because the edge devices may securely share the sensitive data, computer implemented services may be improved.

Securing sensitive data in edge devices using steganography

Systems and methods support segmenting and encrypting a data object. For instance, a computing system may segmented data object into multiple chunks and then encrypt each of the chunks according to pseudo-randomly selected encryption algorithms. A result is that the data object has been split into multiple encrypted chunks, where the encrypted chunks have some amount of pseudo-randomness in their encryption.

Computing systems and methods providing segmented encryption

Techniques are provided for device protection using pre-execution command interception and user authentication. One method comprises obtaining, by a software entity associated with an operating system kernel of a device, a request from a user to execute a command; determining, by the software entity associated with the operating system kernel, prior to an execution of the command, whether the command is a command of a designated command type; initiating a multi-factor authentication of the user in response to determining that the command is a command of the designated command type; and initiating an execution of the at least one command based on a result of the multi-factor authentication of the user. The determination of whether the command comprises the command of the designated command type evaluates command properties and/or command criteria. The command may be compared to a protected list of commands of the designated command type.

Device protection using pre-execution command interception and user authentication

Methods and systems for securing blueprints are disclosed. A blueprint may be secured by requiring sufficient privilege to implement the blueprint. The sufficient privilege may be obtained through an analysis of permissions of a blueprint user and the blueprint authors. An analysis of the permissions of the blueprint user and the blueprint authors may include reviewing privileges of the blueprint user and the blueprint authors. When the sufficient privilege may be found for the blueprint user and the blueprint authors, use of the blueprint may be permitted on an edge device.

Securing blueprints for implementation in edge devices

Methods, systems, and devices for providing computer implemented services are disclosed. To provide the computer implemented services while using software objects that provide a surface area of attack that may compromise the services, the software objects may be analyzed and modified. To do so, a relative usefulness of computer code, on which the software objects depend, may be established. An action set may then be obtained based on the relative usefulness. The action set may include actions to be performed to modify the software objects. By doing so, the software objects may be modified in a manner that reduces the surface area of attack, thereby reducing a likelihood of compromise to the computer implemented services.

Utilization of the least code principle to structure workflows

Systems and methods support command content validation. During runtime of an application, a command content validator may intercept a first command directed to a first software component, wherein the application includes a plurality of software components; compare the first command to a stored set of policies, wherein the set of policies sets out either or both of allowed command content and disallowed command content; determine that the first command is allowed based on the set of policies; and allow or disallow a first requested action of the first command to be performed.

Computing systems and methods providing command content validation

Methods and systems for managing operation of endpoint devices are disclosed. The operation of the endpoint devices may be managed using a security framework. The security framework may be used to transparently encrypt and decrypt application data transmitted via a network without requiring the applications to participate in the encryption and decryption. Additionally, the security framework may facilitate screening of network traffic for malicious traffic. The traffic may be screened using information inserted into reserved fields of control information from network data units. The reserved fields may be used to store data based on network information for originating entities.

Seamless network confidentiality for a containerized application on edge infrastructure

Methods and systems for managing data in a system comprising edge devices and a data transfer bus is disclosed. The data may be managed by encrypting with homomorphic encryption and storing the data in edge devices. The edge devices may be stored in a physically insecure locations and maintain encryption of the data between edge devices. The data that is stored and in an encrypted state may include personally identifiable information. Maintaining encryption of the personally identifiable information between edge devices may prevent exposure to memory of the edge devices. Preventing exposure to memory of the personally identifiable identification may prevent a likelihood of a malicious attack and/or malware from finding the personally identifiable information if the malicious attack and/or malware may monitor memory of the edge devices.

Managing access to sensitive information

Methods and systems for securing data processing systems are disclosed. The data processing systems may be secured through analysis of recognition and simulation of commands that may be run on data processing systems. An analysis of recognition of the command may be used to query if the command has already been simulated for its effects on the data processing system. If the command may have already simulated the command, then the data processing system may know whether to execute the command. Conversely, if the command may not have been simulated, the command may be simulated to understand the effects on the data processing system. In understanding the effects of the command, the data processing system may formulate whether to execute the command.

System and method for securing data processing systems through recognition and analysis of commands

An information handling system includes a memory and a processor. The memory stores a compliance node environment. The processor creates the compliance node environment. In response to reception of a compliance update, the processor stores the compliance update. Based on the compliance update, the processors determine a first compliance coverage for a sub-domain of a compliance type in the compliance node environment. Based on the first compliance coverage for the sub-domain, the processors determine a second complete coverage for the compliance type associated with the sub-domain.

Dynamic cross-standard compliance coverage

Methods and systems for managing data processing systems that provide computer-implemented services are disclosed. A data processing system (e.g., device) may include and depend on the operation of its hardware and/or software components in order to provide the computer-implemented services. To manage the operation of a device, a device manager may obtain log data (e.g., sequences of log messages) for the components of the device that reflect the operational activity of the device and/or its components. The log data may be analyzed automatically (e.g., in real-time), using a repository of known log data sequences, to identify operational issues and/or corresponding responses to the operational issues. The responses may include compensatory and/or correctional actions for remediation of the operational issues. The automated methods may provide an efficient and cost-effective method for managing device operational issues that may reduce the likelihood of the device becoming impaired and/or interruptions in the computer-implemented services.

Managing operational functionality of far edge devices using log data

Techniques are provided for remote access control using validation of a physical location of a remote user. One method comprises obtaining a request from a user associated with a first entity to remotely access a network associated with a second entity; and, in response to the request, performing the following steps: determining if a location of the user is at least partially within at least one designated location associated with the first entity; and initiating a granting of the request to remotely access the network in response to a result of the determining. An evaluation of whether the user is connected to a network of the first entity may also be performed in response to the request from the user to remotely access the network. The request to remotely access the network may be in connection with the user remotely maintaining a product of the second entity.

Remote access control using validation of physical location of remote user

Methods and systems for managing operation of endpoint devices are disclosed. The operation of the endpoint devices may be managed by distributing updates to the endpoint devices. To facilitate distribution, some endpoint devices may be grouped and one of the group may be selected to serve as a coordinating endpoint device. The coordinating endpoint device may serve as a single source of contact for a coordinator tasked with distributing updates to endpoint devices of the group. The coordinating endpoint device may obtain and distribute copies of the updates to recipient endpoint devices.

Distributing endpoint devices configuration via coordinator device

One example method includes monitoring a file access request made by a process, searching, in a pointer array that corresponds to the process, for a pointer to the file that was requested by the process, when the pointer is found in the pointer array, incrementing a score associated with the process, performing an anomaly detection check, and when an anomaly is detected, blocking access to the file by the process, and when no anomaly is detected, updating the pointer array to include a pointer to the file to which access was requested by the process.

Growing community of inventors

Gan Yavne, Israel

Maxim Balin