Dell Products Inc.

Emc IP Holding Company LLC

Yevgeni Gehtman

Tomer Shachar

Maxim Balin

Ophir Buchman

Arieh Don

Ofir Ezrielev

Or Herman Saffar

Yehiel Zohar

Maxim Futerman

Amihai Savir

Amos Zamir

Oron Golan

Raul Shnier

Aviram Fireberger

Thomas L Watson

Or Herman-Saffar

Boris Giterman

Yeh'iel Zohar

Devices, systems, and methods for managing data processing systems are disclosed. The data processing systems may include hardware components that generate heat. The heat may be managed using flows of gasses. Filters may be used to screen particulates entrained in the flows of gasses. The data processing systems may include a system for managing accumulations of particulates over time. The system may refresh the filters over time by reducing the particulate accumulations on the filters.

Management of hardware in environments that include particulates

A coherent signal is transmitted to cancel a baseband signal at a baseband frequency generated by a component of a wireless communication device while information corresponding to the baseband signal may be transmitted from the wireless communication device at an upconverted frequency. Generating and transmitting of the coherent signal may be responsive to detecting signal energy of a remotely generated baseband energy that may be generated by a remote sniffing device attempting to eavesdrop, or snoop, and remotely and wirelessly steal information from detecting of the baseband signal's electromagnetic energy. The coherent signal may be transmitted directionally to increase cancellation of the baseband signal at a likely location, or in a likely direction, of the eavesdropping device.

Prevention of electromagnetic wave detection in a wireless communication network

In one embodiment, a method for verifying a user of an information handling system that includes: identifying, by a verification manager of an information handling system of a computing environment, one or more components of the information handling system; generating, by the verification manager, a static indicator associated with the information handling system based on the one or more components; verifying, by the verification manager, the static indicator; identifying, by the verification manager, the user of the information handling system; identifying, by the verification manager, a plurality of behavioral characteristics associated with the user; generating, by the verification manager, a dynamic indicator associated with the user based on the plurality of behavioral characteristics; verifying, by the verification manager, the dynamic indicator; determining, by the verification manager, a user accessibility associated with the information handling system based on the static indicator and the dynamic indicator.

Verifying a user of an information handling system

Techniques are provided for basic input/output system (BIOS) protection using BIOS modification interception and approval. One method comprises, by an entity associated with an operating system of a device, obtaining a request to perform a reboot and/or a shutdown of the processing device; determining, prior to performing the reboot and/or the shutdown, whether an update of a BIOS of the device is pending; generating an approval request, responsive to determining that the update of the BIOS is pending and prior to performing the reboot and/or the shutdown; and initiating an automated action, responsive to a result of the approval request. In some embodiments, a BIOS update flag may be reset and/or a BIOS staging environment may be cleared following the updating of the image, responsive to a user not approving the update.

Bios protection using request interception and approval of bios modifications

Techniques are provided for device recovery using activation of a basic input/output system (BIOS) recovery image. One method comprises receiving an activation signal to initiate a recovery of a BIOS; obtaining, responsive to the activation signal, a BIOS recovery image from a recovery chip; updating a BIOS chip comprising the BIOS using the obtained BIOS recovery image; and initiating a boot process using the updated at least one BIOS chip. The activation signal may be received in response to a user physically activating a BIOS recovery activator (e.g., during an execution of a boot process). The activation signal may be received during an execution of a boot process for the at least one processing device and/or responsive to a failure occurring during the boot process for the at least one processing device.

Device recovery using activation of bios recovery image

Techniques are provided for device protection using pre-execution command interception and user authentication. One method comprises obtaining, by a software entity associated with an operating system kernel of a device, a request from a user to execute a command; determining, by the software entity associated with the operating system kernel, prior to an execution of the command, whether the command is a command of a designated command type; initiating a multi-factor authentication of the user in response to determining that the command is a command of the designated command type; and initiating an execution of the at least one command based on a result of the multi-factor authentication of the user. The determination of whether the command comprises the command of the designated command type evaluates command properties and/or command criteria. The command may be compared to a protected list of commands of the designated command type.

Device protection using pre-execution command interception and user authentication

Techniques are provided for remote access control using validation of a physical location of a remote user. One method comprises obtaining a request from a user associated with a first entity to remotely access a network associated with a second entity; and, in response to the request, performing the following steps: determining if a location of the user is at least partially within at least one designated location associated with the first entity; and initiating a granting of the request to remotely access the network in response to a result of the determining. An evaluation of whether the user is connected to a network of the first entity may also be performed in response to the request from the user to remotely access the network. The request to remotely access the network may be in connection with the user remotely maintaining a product of the second entity.

Remote access control using validation of physical location of remote user

One example method includes monitoring a file access request made by a process, searching, in a pointer array that corresponds to the process, for a pointer to the file that was requested by the process, when the pointer is found in the pointer array, incrementing a score associated with the process, performing an anomaly detection check, and when an anomaly is detected, blocking access to the file by the process, and when no anomaly is detected, updating the pointer array to include a pointer to the file to which access was requested by the process.

Ransomware detection using inode traversal scoring

A bait file owned by a bait process is created and locked in a computing system. Attempts or access the bait file or kill the bait process are detected. The process attempting to access the bait file or kill the bait process is viewed as malicious and protective operations are performed in the computing system.

Ransomware detection via monitoring open file or process

One example method includes identifying a process that includes both a write operation and a transmit operation, wherein the write operation comprises performing a malicious process on data that renders the data unusable to an owner of the data, and the transmit operation comprises transmitting the data after the data has been acted upon by the malicious process, performing a snapshot operation to create a snapshot that comprises a copy of the data after the data has been acted upon by the malicious process and/or while the data is being acted upon by the malicious process, and intercepting the data before, or while, the transmit operation is performed.

Reversing symmetric encryptions using keys found in snapshots—per-file keys, random and transmitted outside

A network connected storage device detects unusual file-sharing-command activity based on a baseline file-sharing-command signature and analyzes files stored on the storage with respect to a parameter, such as entropy, to determine whether ransomware may have infiltrated the storage device, or a storage associated therewith. Applying by the storage device a function to an entropy value corresponding to a second portion of a file may result in a determination that an analyzed entropy corresponding to the second portion may have been partially encrypted by ransomware. The analyzed entropy corresponding to the second file portion may be compared to an entropy of a first file portion. The first file portion may be a different portion of the same file as the second portion or may be the same portion of the same file that resulted from analysis before the triggering event.

Analyzing file entropy to identify adverse conditions

Techniques are provided for device protection using basic input/output system (BIOS)-based detection and mitigation of modifications to a protected storage region. One method comprises obtaining, by a BIOS of a processing device, during a first execution of a boot process, an indication of a protected storage region of a storage device; storing, by the BIOS, during the first execution of the boot process, content of the protected storage region in a backup storage region of a persistent storage device associated with the BIOS; evaluating, by the BIOS, during a subsequent boot process, content of the protected storage region to detect changes in the content of the protected storage region; and initiating an automated action responsive to the detected changes in the content of the protected storage region, wherein the automated action comprises notifying a user of the detected changes in the content of the protected storage region.

Bios-based device protection using detection and mitigation of modifications to a protected storage region

Methods and systems for offloading signature computations are disclosed. The signature computations may be offloaded from a storage array to a host. The host may use data processing units or graphical processing units to process the signature computations. In processing the signature computations by the host, the storage array may further process deduplication of the signatures, once they are received from the host. The host may require that the storage array support the distributed system and the deduplication procedure and meet a deduplication ratio specified by a criteria.

Data storage through offloading signature computations

One method includes monitoring a ransomware risk measure, when the ransomware risk measure indicates the presence of a suspected ransomware process, determining if it is time to overwrite a snapshot stored in backup data storage, and when it is time to overwrite the snapshot, moving the snapshot from the backup data storage to a vault to free space in the backup data storage for new snapshots that continue to be taken after the presence of suspected ransomware is indicated.

Vault overwriting after PLC (protection lifecycle) designation disallowance by transmission to public vault

Techniques are provided for mapping storage objects to storage controllers using digital twins. One method comprises obtaining a virtual representation of a storage system that comprises storage objects and storage controllers, wherein a given storage object is mapped to a particular storage controller according to a storage object to storage controller mapping configuration; configuring the virtual representation of the storage system, for multiple iterations, based on at least one storage metric for respective storage objects, wherein each iteration corresponds to a different storage object to storage controller mapping configuration and generates a load balance score for the respective storage object to storage controller mapping configuration; selecting a given storage object to storage controller mapping configuration based on the respective load balance scores; and initiating an implementation of the selected storage object to storage controller mapping configuration in the storage system.

Growing community of inventors

Modi'in, Israel

Yevgeni Gehtman