Dell Products Inc.

John H Terpstra

Anantha K Boyapalle

Jeroen Mackenbach

Jeroen Diederik Cornelis Antonius Mackenbach

Joseph LaSalle White

Bradley K Goodman

Mark Steven Sanders

Ravishankar Kanakapura Nanjundaswamy

Naman Goel

Shivendra Katiyar

Arkady Kanevsky

An information handling system may determine a personality flag value during a boot process, and execute a system update handler configured for connecting to a control plane. The system may also provision a software application in a current operating system environment or erase the existing operating system and provisional new environment including receiving the software application responsive to a secure profile and validating the software application prior to loading.

Automated persistent context-aware device provisioning

An information handling system includes a virtual trusted platform module (TPM) consumer associated with a virtual machine. The virtual TPM (vTPM) consumer may consume TPM services from a clustered vTPM domain service and determine the connection information of the vTPM domain service. The vTPM consumer transmits a connection request for a TPM operation request to the vTPM domain service, wherein the connection request includes a payload in addition to the connection information. The consumer may also receive a response associated with the TPM operation request from the vTPM domain service.

Clustered virtual trusted platform module domain services system

An information handling system may validate a connection request received from a trusted platform module (TPM)-virtual (vTPM) module according to a policy, wherein the connection request originated from a virtual machine associated with the TPM-vTPM module which consumes services from a clustered vTPM domain service. In response to determining that the connection request is valid based on the policy, the system may determine the vTPM domain service associated to the TPM-vTPM module, and determine whether to route or redirect the connection request according to policy. In response to determining that the connection request is to be redirected, the system may transmit a response to the TPM-vTPM module, wherein the response includes redirect information to the vTPM domain service. In response to determining that the connection request is to be routed, the system may route the connection request to the vTPM domain service.

Clustered virtual trusted platform module domain services with a redirector/router service system

An apparatus comprises a processing device configured to receive, at a web browser from a web-based service running on a web server, a request for signature of one or more messages using at least one cryptographic key pair comprising a public key made accessible to the web-based service running on the web server and a private key maintained in secure storage accessible to the web browser. The processing device is also configured to generate, at the web browser, one or more interface features permitting a given user to accept or deny the request for signature and, responsive to the given user accepting the request for signature of a given message, digitally signing the given message utilizing the private key of the cryptographic key pair. The processing device is further configured to provide, from the web browser to the web-based service, a response comprising the digital signature of the given message.

Web browser-based secure cryptographic key management

An information handling system may determine a personality flag value during a boot process and execute, responsive to detecting that the information handling system entered a secure environment and based on the personality flag value, a system update handler configured for discovering and connecting to a control plane. The system may also provision a secure ephemeral operating system, including receiving an image of the secure ephemeral operating system from the control plane responsive to a secure profile and validating the image prior to loading the secure ephemeral operating system to a random access memory.

Automated ephemeral context-aware device provisioning

A computing device quarantine action system includes a computing device having a plurality of computing device components and a Basic Input/Output System (BIOS) subsystem. During an initialization process, the BIOS subsystem determines a current computing device component inventory of the plurality of computing device components included in the computing device, measures a current computing device functionality of each of the plurality of computing device components, and identifies at least one computing device change between at least one of 1) a reference computing device component inventory and the current computing device component inventory, and 2) reference computing device functionalities and the current computing device component functionalities determined for each of the plurality of computing device components. Based in the at least one computing device change, the BIOS subsystem generates a Quarantine Action Metric (QAM) and, based on the QAM, performs at least one quarantine action associated with the computing device.

Computing device quarantine action system

An apparatus comprises a processing device configured to determine, utilizing a firmware-based agent running in firmware, a boot flag status during a boot process of the processing device. The processing device is also configured to execute, responsive to the boot flag status being a first value, a system update handler of the firmware-based agent configured for provisioning of a secured runtime operating system on the processing device, wherein the provisioning comprises digitally signing an image of the secured runtime operating system utilizing a hardware-based root of trust key. The processing device is further configured to execute, responsive to the boot flag status being a second value, a secured operating system boot handler of the firmware-based agent configured for validating and loading secured runtime operating system, wherein the validation comprises performing attestation of a signature of the image of the secured runtime operating system utilizing the hardware-based root of trust key.

Multi-phase secure zero touch provisioning of computing devices

A secure infrastructure onboarding system includes an infrastructure device with an infrastructure device wireless subsystem that it may use to perform wireless key management system discovery operations in response to initialization. A key management system includes a key management system wireless subsystem it uses to perform the wireless key management system discovery operations with the infrastructure device. The key management subsystem may then wirelessly receive an infrastructure device certificate along with an infrastructure device validation key from the infrastructure device, and validate the first infrastructure device based on the first infrastructure device certificate and the first infrastructure device validation key. In response, the key management system may wirelessly transmit a first credential generation key that is configured for use by the first infrastructure device to generate first authentication credentials.

Secure infrastructure onboarding system

A cluster deployment and management system includes a networking device that is coupled to a network and to each of a plurality of node devices in a cluster system. The networking device discovers then validates using a cluster profile each of the plurality of node devices in the cluster system. The networking device may then configure itself and any other networking devices according to the cluster profile. The networking device may then configure each of the plurality of node devices according to the cluster profile and deploy one or more applications and data to the node devices. The networking device may negotiate which of at least two networking devices present on the network and may perform lifecycle management operations on the at least one of the node. The networking device performs lifecycle management on at least one of the node devices during operation of the cluster system.

Growing community of inventors

Austin, TX, United States of America

John H Terpstra