Emc IP Holding Company LLC

Emc Corporation

Robert M Polansky

Stephen Glen Graham

Magnus Nyström

Alex Vaystikh

Samir Dilipkumar Saklikar

John P Field

Liron Liptz

Vijay Ganti

Parasuraman Narasimhan

Ajay Venkateshan Krishnaprasad

A distributed security information and event management system comprises a centralized portion and a plurality of remote portions, with the remote portions being implemented in respective applications within information technology infrastructure. Each of the remote portions comprises one or more remote components inserted into the corresponding application. At least a subset of the remote components of the remote portion are configured for interaction with one or more corresponding centralized components of the centralized portion of the system. The remote components may each be configured to process one or more specified eXtensible Access Control Markup Language (XACML) Obligations or other constructs.

Distributed security information and event management system with application-injected remote components

Methods, apparatus and articles of manufacture for protecting virtual machines processing sensitive information are provided herein. A method includes processing a request for uninterrupted virtual machine execution of a designated section of code by a first virtual machine; enabling uninterrupted virtual machine execution of the designated section of code by the first virtual machine on a selected core of a central processing unit based on said request; and disabling said uninterrupted virtual machine execution of the designated section of code by the first virtual machine based on an indication that the first virtual machine completed execution of the designated section of code.

Protecting virtual machines processing sensitive information

A virtual machine on a physical host computer provides controlled access to protected data by creating and storing a 'stored system fingerprint' from stable system values (SSVs) as existing when creating the stored system fingerprint. The SSVs include virtual-machine-specific values that change upon cloning the virtual machine (VM) but do not change upon migration of the VM. Upon a request for access to the protected data, a current system fingerprint is calculated from the SSVs as existing when processing the request, the current system fingerprint is compared to the stored system fingerprint to determine whether there is a predetermined degree of matching, and the requested access to the protected data is permitted only if there is the predetermined degree of matching.

Data protection using virtual-machine-specific stable system values

A virtual machine computing platform uses a security virtual machine (SVM) in operational communications with a risk engine which has access to a database including stored patterns corresponding to patterns of filtered operational data that are expected to be generated during operation of the monitored virtual machine when malware is executing. The stored patterns may have been generated during preceding design and training phases. The SVM is operated to (1) receive raw operational data from a virtual machine monitor, the raw operational data obtained from file system operations and network operations of the monitored virtual machine; (2) apply rule-based filtering to the raw operational data to generate filtered operational data; and (3) in conjunction with the risk engine, perform a mathematical (e.g., Bayesian) analysis based on the filtered operational data and the stored patterns in the database to calculate a likelihood that the malware is executing in the monitored virtual machine. A control action is taken if the likelihood is sufficiently high.

Malware detection using risk analysis based on file system and network activity

Growing community of inventors

Westwood, MA, United States of America

Robert M Polansky