Dell Products Inc.

Emc IP Holding Company LLC

Tomer Shachar

Yevgeni Gehtman

Maxim Balin

Arieh Don

Ophir Buchman

Ofir Ezrielev

Yehiel Zohar

Or Herman Saffar

Yeh'iel Zohar

Philippe Armangau

Sunil Kumar

Thomas L Watson

Krishna Deepak Nuthakki

Boris Giterman

A bait file owned by a bait process is created and locked in a computing system. Attempts or access the bait file or kill the bait process are detected. The process attempting to access the bait file or kill the bait process is viewed as malicious and protective operations are performed in the computing system. At times, ownership of the bait file is switched to a different process, which may encourage the malicious process to attempt access and thereby be detected.

Ransomware detection via monitoring open file or process

One example method includes taking snapshots of a ransomware process, obtaining, from the snapshots, a key sequence that comprises a subset of keys used by the ransomware process to encrypt data, hashing one of the keys of the subset of keys to generate a hash, and when the hash matches one of the keys in the subset of keys, using the hash to deduce other keys used by the ransomware process and not already included in the subset of keys.

Reversing symmetric encryptions using keys found in snapshots—per-file keys, hashes of hashes

The technologies described herein are generally directed toward maintaining data coherence after an updating node fails during an update. According to an embodiment, a system can comprise a processor and a memory that can enable performance of operations including respectively mapping a logical storage resource to first and second storage resources in first and second security zones associated with first provider and second providers. The operations can further include receiving a request to store a data resource at the logical storage resource. Further, the operations can include, based on a distribution policy associated with the data resource, dividing, by the storage controller equipment, the data resource into a first storage segment stored on the first storage resource and a second storage segment stored on the second storage resource.

Dividing data between storage equipment in different security zones

Techniques are provided for device protection using pre-execution multi-factor authentication of a process. One method comprises obtaining, by a software entity associated with an operating system kernel of a processing device, a request to execute a process on the processing device; performing, by the software entity, a first authentication of the process that evaluates a first set of information of the process; performing, by the software entity, a second authentication of the process to obtain a verification result, wherein the second authentication of the process evaluates a second set of different information of the process; and allowing the process to execute on the processing device based at least in part on the verification result. The second set of different information may comprise a name of the process, an identifier of the process and/or an identifier of a given processing device that will execute the process.

Device protection using pre-execution multi-factor process authentication

Techniques are provided for basic input/output system (BIOS) protection using BIOS update suppression. One method comprises receiving, by an operating system of a processing device comprising a BIOS chip having a first BIOS version, a request to suppress a pending BIOS update; and suppressing an application of the pending BIOS update, in response to the request, wherein a boot process of the processing device uses the first BIOS version. The suppressing may comprise clearing a BIOS staging environment of the at least one BIOS chip and/or resetting a BIOS update flag. A user of the processing device may be notified of the pending BIOS update, in response to detecting that an update of the first BIOS version is pending. The request may be received responsive to the notification.

Bios protection using bios update suppression

Devices, systems, and methods for managing data processing systems are disclosed. The data processing systems may include hardware components that generate heat. The heat may be managed using flows of gasses. Filters may be used to screen particulates entrained in the flows of gasses. The data processing systems may include a system for managing accumulations of particulates over time. The system may refresh the filters over time by reducing the particulate accumulations on the filters.

Management of hardware in environments that include particulates

A coherent signal is transmitted to cancel a baseband signal at a baseband frequency generated by a component of a wireless communication device while information corresponding to the baseband signal may be transmitted from the wireless communication device at an upconverted frequency. Generating and transmitting of the coherent signal may be responsive to detecting signal energy of a remotely generated baseband energy that may be generated by a remote sniffing device attempting to eavesdrop, or snoop, and remotely and wirelessly steal information from detecting of the baseband signal's electromagnetic energy. The coherent signal may be transmitted directionally to increase cancellation of the baseband signal at a likely location, or in a likely direction, of the eavesdropping device.

Prevention of electromagnetic wave detection in a wireless communication network

Techniques are provided for basic input/output system (BIOS) protection using BIOS modification interception and approval. One method comprises, by an entity associated with an operating system of a device, obtaining a request to perform a reboot and/or a shutdown of the processing device; determining, prior to performing the reboot and/or the shutdown, whether an update of a BIOS of the device is pending; generating an approval request, responsive to determining that the update of the BIOS is pending and prior to performing the reboot and/or the shutdown; and initiating an automated action, responsive to a result of the approval request. In some embodiments, a BIOS update flag may be reset and/or a BIOS staging environment may be cleared following the updating of the image, responsive to a user not approving the update.

Bios protection using request interception and approval of bios modifications

Techniques are provided for device recovery using activation of a basic input/output system (BIOS) recovery image. One method comprises receiving an activation signal to initiate a recovery of a BIOS; obtaining, responsive to the activation signal, a BIOS recovery image from a recovery chip; updating a BIOS chip comprising the BIOS using the obtained BIOS recovery image; and initiating a boot process using the updated at least one BIOS chip. The activation signal may be received in response to a user physically activating a BIOS recovery activator (e.g., during an execution of a boot process). The activation signal may be received during an execution of a boot process for the at least one processing device and/or responsive to a failure occurring during the boot process for the at least one processing device.

Device recovery using activation of bios recovery image

Techniques are provided for device protection using pre-execution command interception and user authentication. One method comprises obtaining, by a software entity associated with an operating system kernel of a device, a request from a user to execute a command; determining, by the software entity associated with the operating system kernel, prior to an execution of the command, whether the command is a command of a designated command type; initiating a multi-factor authentication of the user in response to determining that the command is a command of the designated command type; and initiating an execution of the at least one command based on a result of the multi-factor authentication of the user. The determination of whether the command comprises the command of the designated command type evaluates command properties and/or command criteria. The command may be compared to a protected list of commands of the designated command type.

Device protection using pre-execution command interception and user authentication

Techniques are provided for remote access control using validation of a physical location of a remote user. One method comprises obtaining a request from a user associated with a first entity to remotely access a network associated with a second entity; and, in response to the request, performing the following steps: determining if a location of the user is at least partially within at least one designated location associated with the first entity; and initiating a granting of the request to remotely access the network in response to a result of the determining. An evaluation of whether the user is connected to a network of the first entity may also be performed in response to the request from the user to remotely access the network. The request to remotely access the network may be in connection with the user remotely maintaining a product of the second entity.

Remote access control using validation of physical location of remote user

One example method includes monitoring a file access request made by a process, searching, in a pointer array that corresponds to the process, for a pointer to the file that was requested by the process, when the pointer is found in the pointer array, incrementing a score associated with the process, performing an anomaly detection check, and when an anomaly is detected, blocking access to the file by the process, and when no anomaly is detected, updating the pointer array to include a pointer to the file to which access was requested by the process.

Ransomware detection using inode traversal scoring

A bait file owned by a bait process is created and locked in a computing system. Attempts or access the bait file or kill the bait process are detected. The process attempting to access the bait file or kill the bait process is viewed as malicious and protective operations are performed in the computing system.

One example method includes identifying a process that includes both a write operation and a transmit operation, wherein the write operation comprises performing a malicious process on data that renders the data unusable to an owner of the data, and the transmit operation comprises transmitting the data after the data has been acted upon by the malicious process, performing a snapshot operation to create a snapshot that comprises a copy of the data after the data has been acted upon by the malicious process and/or while the data is being acted upon by the malicious process, and intercepting the data before, or while, the transmit operation is performed.

Reversing symmetric encryptions using keys found in snapshots—per-file keys, random and transmitted outside

A network connected storage device detects unusual file-sharing-command activity based on a baseline file-sharing-command signature and analyzes files stored on the storage with respect to a parameter, such as entropy, to determine whether ransomware may have infiltrated the storage device, or a storage associated therewith. Applying by the storage device a function to an entropy value corresponding to a second portion of a file may result in a determination that an analyzed entropy corresponding to the second portion may have been partially encrypted by ransomware. The analyzed entropy corresponding to the second file portion may be compared to an entropy of a first file portion. The first file portion may be a different portion of the same file as the second portion or may be the same portion of the same file that resulted from analysis before the triggering event.

Growing community of inventors

Omer, Israel

Tomer Shachar