Dell Products Inc.

Emc IP Holding Company LLC

Dell & Products L.p.

Yi Fang

Ching-Yun Chao

Gregory William Lazar

Qi Jin

Ranjit Kollu

Xuan Tang

Chooi Peng Low

Jingyan Zhao

Ping Zhang

Alan White

David Scott Thompson

Yidong Wang

Georgi Abelovich Yaralov

Charles W Kaufman

Vinay Sawal

Sumedh Wasudeo Sathaye

Muzhar S Khokhar

Viswanath Ponnuru

Dominique Prunier

Jennifer M Minarik

Mahadevan Vasudevan

Reut Kovetz

Rajini Ramachandran Karthik

Charlie Kaufman

Eric Randal Young

Xiongfei Chen

Gerald D Jones

Jonathon Cwik

Igor Pedan

Juhi Asthana

Murali Kadala Keloth

Shashank Holakkal

Puneeth Chowdary Kosaraju

Up front authorization of a workflow and a security context for workflow execution are disclosed. All possible authorizations that may be required by a workflow definition are identified up front. A requestor is allowed to execute the workflow only when the authorizations of the user include the authorizations that may be required by the workflow. An immutable security context is generated and associated with the workflow or an instance thereof. The immutable security context can prevent or reduce failures associated with changes to a requestor's authorizations and may also scope or limit the workflow to at least the type or capacity of work requested and/or work uniquely identified in the security context. The immutable security context is managed in a security context that is separate and independent of the workflow execution context.

Render high workflow execution reliability using immutable security context

A system can receive an untrusted onboard announcement message from a remote computer, wherein the untrusted onboard announcement message comprises first data that identifies the remote computer and second data that indicates a current configuration of the remote computer. The system can identify a stored indication of an authorized configuration of the remote computer based on the data that identifies the remote computer. The system can determine that there is a mismatch between the authorized configuration of the remote computer and the current configuration of the remote computer. The system can determine a trust metrics evaluation score for the remote computer based on a type of hardware component change between the authorized configuration of the remote computer and the current configuration of the remote computer. The system can, in response to determining that the trust metrics evaluation score is greater than a threshold value, onboard the remote computer.

Trusted cloud device lifecycle management

Methods and systems for managing operation of infrastructure are disclosed. The operation of the infrastructure may be managed by limiting activity that may be performed by the infrastructure. The activity may be limited by restricting tasks that may be added to queues of tasks that the infrastructure is authorized to perform. The content of the queues may be limited during workflow selection, task identified for workflows, and service registration for servicing the queues. The content may be limited using a combination of registration requirements, role based restrictions, and token requirements.

Methods and apparatus for enhancing security in the orchestration platform

Architectures and techniques are described that can provide decentralized, zero-trust authorization according to variable fine-grained policies For example, an authorization server can receive an authorization request from a requesting device. The authorization request can comprise a reference address to a resource, in which case resource data can be fetched, or comprise a signed entity indicative of the resource. In either case, resource data used to evaluate a policy can be obtained and, if an associated policy evaluation is authorized, the authorization request can be validated and an associated token can be provided to the requesting device, which can then be transmitted along with an API call to a service through which a resource is provided.

Decentralized authorization with Zero-Trust

A system can identify an attribute-based access control policy that comprises a pair comprising a permission policy and a condition policy that is associated with performing an operation on a computing resource. The system can identify that the attribute-based access control policy corresponds to a role policy that is associated with the account. The system can determine whether the account and the role policy satisfy the attribute-based access control policy with respect to the operation, wherein the determining comprises evaluating whether the computing resource and a required permission of the permission policy is declared in the role policy, and evaluating whether the account and the role policy satisfy the condition policy evaluates to true based on attributes of the account and attributes of the computing resource. The system can, in response to determining that the account satisfy the permission policy and the condition policy, perform the operation on the computing resource.

Attribute-based access control using scoped roles and conditioned permissions dynamic policies

A system, method, and computer-readable medium for performing a data center monitoring and management operation. The data center monitoring and management operation includes: generating a request for a client identifier or an access token for access to a target application programming interface (API); obtaining an access policy associated with the target API; determining a least privileged API access permission based upon the access policy associated with the target API; and, using the client identifier or access token to access the target API when the least privileged API access permission allows access to the target API.

System for enforcing least privileged API access with dynamically scoped identification and access tokens

A method, computer program product, and computer system for maintaining, by a computing device, a plurality of certificates in a credential store using a distributed data source. A certificate of the plurality of certificates may be loaded in an in-memory location from the distributed data source upon startup. A change in at least one certificate of the plurality of certificates may be detected in the distributed data source. The change in the at least one certificate may be loaded from the distributed data source to the in-memory location without requiring a restart of the computing device.

System and method for non-disruptive in-memory certificate management

Techniques for synchronizing configuration information in a clustered storage environment. The techniques allow a system administrator or other user to make additions and/or updates to configuration information in one or more configuration files, which are automatically propagated for storage in multiple data storage appliances within a storage domain. By allowing a user to make changes to configuration files associated with a primary appliance within the storage domain, and automatically propagating the configuration files in a background process from the primary appliance to multiple secondary appliances within the storage domain, the user can more readily assure consistency of the configuration information, not only among the primary and secondary appliances within the storage domain, but also among previously unavailable or unreachable data storage appliance(s) that may be recovered and brought back on line within the storage domain.

Systems and methods of synchronizing configuration information in a clustered storage environment

Digital certificates for a set of multiple network services are maintained in a certificate store and managed through a single access point that provides access to the certificate store. The certificates are managed, at least in part by i) assigning one or more tags to each digital certificate in the set of digital certificates, one of the tags indicating a service in the set of services that uses the digital certificate to perform secure communications over the communication network, and ii) performing a set of certificate management operations through the single access point to the certificate store. At least one of the certificate management operations performed through the single access point selects a subset of the digital certificates from the set of digital certificates based at least in part on the tags assigned to the digital certificates.

Extensible unified multi-service certificate and certificate revocation list management

In response to determining that an encryption operation request includes no indication of a cryptographic key, an encryption service module performs an encryption operation using a current cryptographic key retrieved by the encryption service module, and creates and stores an encrypted data object that includes the resulting ciphertext and a key identifier that uniquely identifies the cryptographic key and the associated cryptographic algorithm used to perform the encryption. A subsequent decryption operation request to the encryption service module that indicates the encrypted data object is processed by retrieving the cryptographic key and identifying the associated cryptographic using the key identifier contained in the encrypted data object. The encrypted data object may also include an initialization vector used to generate the ciphertext contained in the encrypted data object, as well as an integrity check value generated across the ciphertext and initialization vector.

Data encrypting system with encryption service module and supporting infrastructure for transparently providing encryption services to encryption service consumer processes across encryption service state changes

Growing community of inventors

Sharon, MA, United States of America

Yi Fang