Dell Products Inc.

Jason Kolodziej

Nicholas Diciurcio Grobelny

Girish S Dhoble

Charles D Robison

Carlton A Andrews

Anantha K Boyapalle

Jacob Vincent Mink

An Information Technology Decision Maker (ITDM) defines a user workspace to be received and orchestrated by a workspace orchestration Information Handling System (IHS) on a host IHS. The orchestration IHS also receives specifications of the host, scans the user workspace definition for vulnerabilities, analyzes the vulnerabilities, and generates (an) attack parameter(s) and/or (a) pattern(s) of threat(s) to the user workspace. The orchestration IHS defines a model workspace definition that includes baseline protection for workload deployment against the attack parameter(s) and/or pattern(s) of threat(s), for orchestration, with the host, on the host. The same or another orchestration IHS (local to the host IHS) traces drift in the workload on the host, generates further attack parameter(s) and/or further pattern(s) of threat(s) from the drift. The same or other orchestration IHS adjusts the model workspace definition to include protection against the further attack parameter(s) and/or further pattern(s) of threat(s), for orchestration.

Workspace instantiation using continuous vulnerability intelligence feedback loops

Systems and methods for distributed orchestration using delegate workspaces are described. In an illustrative, non-limiting embodiment, a remote orchestrator with respect to a workspace executed by a client Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the remote orchestrator to: communicate with a database of delegate workspaces, each delegate workspace instantiated by a respective one of a plurality of edge IHSs; and assign a management task with respect to a client IHS's workspace to a delegate workspace executed by a selected edge IHS, where the delegate workspace is selected, at least in part, based upon information stored in the database.

Distributed orchestration using delegate workspaces

Systems and methods support updates to an Information Handling System (IHS). A workspace is instantiated on the IHS based upon a received workspace definition, where the workspace identifies an available update to a system operating on the IHS. A request is made for a first credential used for validation of the IHS by a first remote workspace orchestrator. The workspace provides the first credential to a second remote workspace orchestrator that controls access to updates to the system operating on the IHS. The second remote workspace orchestrator uses the first credential to validate the IHS with the first remote workspace orchestrator. The workspace performs the available update to the system operating on the IHS using a second credential provided by the second remote workspace orchestrator upon validation of the IHS by the first remote workspace orchestrator. The IHS maintains separate confidentiality with each remote orchestrator providing credentials for the update.

Systems and methods for orchestrating IHS updates

Systems and methods are provided for managing capabilities of workspaces operating on an Information Handling System (IHS). A request is received from a user of the IHS for access to a protected resource. A security context and a productivity context are determined for operation of a primary workspace on the IHS. Two or more applications are identified for operation within the primary workspace, where the applications provide access to the protected resource, and where the applications include overlapping capabilities. Based on the security context and the productivity context for the primary workspace deployment, two or more of the applications with overlapping capabilities are selected for operation within the primary workspace.

Systems and methods for managing workspace capabilities

Systems and methods support operation of primary on an Information Handling System (IHS) and the operation of subordinate workspaces on peripheral devices coupled to the IHS. The IHS receives a primary workspace definition from a remote orchestrator and instantiates a primary workspace based upon the primary workspace definition, where the instantiated primary workspace operates using core resources of the IHS and provides access to a protected resource. The IHS reports, to the remote orchestrator, an inventory of peripheral devices that are detected as coupled to the IHS. In response, one or more subordinate workspace definitions are received from the remote orchestrator, where each of the subordinate workspace definitions are for operation of a subordinate workspace by one of the peripheral devices coupled to the IHS. Based on the received subordinate workspace definitions, operation of subordinate workspaces is initiated on peripheral devices coupled to the IHS.

Systems and methods for subordinate workspaces

A method may include, within a security container executing on an information handling system, in response to a request from a process container to store data to a trusted partition of a memory, wherein the process container is configured to execute user processes of the information handling system: validating whether the data is safe and trusted, responsive to determining that the data is safe and trusted, causing a storage container associated with the trusted partition and configured to manage data stored to the trusted partition to store a read-only file of the data to the trusted partition, and persisting the read-only file through a wipe of the information handling system, such that the read-only file is accessible following a restore of the information handling system following the wipe.

Systems and methods for isolated and protected file system and data restoration

Methods and systems provide layered validation of workspaces providing isolated computing environments on an Information Handling System (IHS). A remote workspace orchestrator generates a workspace definition for deployment and operation of a workspace on the IHS using software containers that are specified in the workspace definition. The workspace definition is transmitted to the IHS and used to assemble software on the IHS for operation of the software containers specified in the workspace definition. The software containers assembled on the IHS are validated based on endorsement certificates identified in the workspace definition, wherein the endorsement certificates are provided by creators of the respective containers. The software containers may include upper-layer containers that each depend on one or more lower-layer containers. The containers in each layer may be separately validated, thus allowing containers from different creators to be separately validated for use by a workspace.

Layered workspace endorsement and verification

Run-time attestation of a workspace including deploying, at a client information handling system, an application broker, the application broker including a model that defines characteristics of a computer-implemented application accessible through a server information handling system; establishing a trust relationship between a control vault system of the client information handling system and the server information handling system; provisioning entitlements, by the application broker, that are associated with the computer-implemented application at the client information handling system; identifying an execution of the entitlements at the client computing device, and comparing the execution of the entitlements with the model; determining, based on the comparing, a violation of the model, and in response, procuring a trust challenge from the server information handling system; generating, by the application broker and in response to the trust challenge, an attestation of the trust relationship between the control vault system and the server information handling system.

Run-time attestation of a user workspace

Various embodiments of network access control (NAC) systems and methods are provided herein to control access to a network comprising a plurality of network endpoint nodes, where each network endpoint node includes a policy information point and a policy decision point. The policy information point within each network endpoint node stores a distributed ledger including one or more client policies that must be satisfied to access the network, and a smart contract including a set of predefined rules defining network access behaviors and actions. Upon receiving a network access request from a client device outside of the network, the policy decision point within each network endpoint node executes the smart contract to determine whether the client device should be granted access, denied access or have restricted access to the network, and executes consensus algorithm to select one of the network endpoint nodes to be a policy decision point leader.

Growing community of inventors

Rowlett, TX, United States of America

Jason Kolodziej