Dell Products Inc.

Joseph Kozlowski

Carlton A Andrews

Girish S Dhoble

Charles D Robison

Ricardo Luis Martinez

David Konetski

Nicholas Diciurcio Grobelny

Abeye Teshome

Yuan-Chang Lo

Michael S Gatson

Nikhil Manohar Vichare

Andrew T Fausak

Srikanth Kondapi

Daniel Lawrence Hamlin

Anantha K Boyapalle

Nathan Francis Martell

Deeder M Aurongzeb

Claude Lano Cox

Kenneth Wade Stufflebeam

Jorge Antonio Abullarade

Knut Graf

Abu S Sanuallah

Adolfo Sandor Montero

Liam B Quinn

Sumanth Vidyadhara

Jon Robert Hass

Ryan Nicholas Comer

Charles Delbert Robison, Jr

Mark W Welker

Mark L Welker

An Information Handling System (IHS), such as an IHS supporting workspaces employing subject workspace data, and/or an IHS of a workspace orchestration service may identify each modification to the subject data, identify each trusted entity performing each trusted operation on the data, and identify each unauthorized or undocumented modification to the data, each based, at least in part, on each gap in identification of each trusted entity performing each trusted operation on the data. Whereupon, a security score of the data may be decremented for each identified unauthorized or undocumented modification to the data. A data passport may be implemented, in which each modification to the data is identified. This data passport may be a ledger, such as a blockchain, a log file, such as an Extract, Transform, Load (ETL) server log file, rendered content from layered applications, such as a certificate chain (e.g., a final leaf certificate node).

Performant workspace data orchestration using information trust scores

Systems and methods support updates peripheral devices that may be coupled to an Information Handling System (IHS), such as provided at shared-use workstations. The IHS reports, to a remote orchestrator, an inventory of peripheral devices that are coupled to the IHS. In response, the remote orchestrator provides the IHS with files for updates to some or all of the coupled peripheral devices. As part of the updates, the remote orchestrator also designates a specific peripheral device as a proxy for making updates to other peripherals of the shared-use workstation. The IHS transmits the files to the proxy peripheral device, where the files are stored in a memory of the proxy peripheral device. The proxy peripheral device uses the files to update the other peripherals of the shared-use workstation, such as when the peripherals are not in use by the IHS, or after the IHS has been disconnected.

Systems and methods for updating peripheral devices

Systems and methods for modernizing workspace and hardware lifecycle management in an enterprise productivity ecosystem are described. In some embodiments, a client Information Handling System (IHS) may include a processor, and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the client IHS to: transmit, by a local management agent to a workspace orchestration service, an access request and context information; receive, at the local management agent from the workspace orchestration service, one or more files or policies configured to enable the local management agent to instantiate a workspace based upon a workspace definition, wherein the workspace orchestration service is configured to: (i) calculate a security target and a productivity target based upon the access request and the context information, and (ii) create the workspace definition based upon the security target and the productivity target; and instantiate the workspace.

Systems and methods for modernizing workspace and hardware lifecycle management in an enterprise productivity ecosystem

Systems and methods are provided that support configuration of settings of an Information Handling System (IHS), such as by external configuration tools that are delegated authority to configure any portion of the configurable settings of IHS. During factory provisioning of the IHS, an inventory of configurable settings of the IHS is generated and permissions are assigned for configuration of a portion of the configurable IHS settings by a configuration tool. During the factory provisioning, credentials are stored to the IHS for authenticating communications from the assigned configuration tool. Once the IHS has been delivered and deployed, configuration of the assigned portion of IHS is allowed when configuration requests from the assigned configuration tool are successfully validated against the credentials stored to the IHS during factory provisioning. The configurable settings of the IHS may include BIOS settings, operating system settings and settings supported by hardware components of the IHS.

Systems and methods for configuring settings of an IHS (information handling system)

Systems and methods for modernizing workspace and hardware lifecycle management in an enterprise productivity ecosystem are described. In some embodiments, a client Information Handling System (IHS) may include a processor and a memory, the memory having program instructions that, upon execution by the processor, cause the client IHS to: receive, from a workspace orchestration service, one or more files or policies configured to enable the client IHS to instantiate a first workspace based upon a first workspace definition; allow a user to execute a non-vetted application in the first workspace; determine that the first workspace is compromised; and receive, in response to the determination, from the workspace orchestration service, one or more other files or policies configured to enable the client IHS to instantiate a second workspace based upon a second workspace definition, where the second workspace definition allows execution of a vetted application corresponding to the non-vetted application.

Systems and methods for workspace continuity and remediation

Systems and methods for workspace deployment using a secondary trusted device are described. In some embodiments, a first Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the first IHS to: establish a first connection with a second IHS, where the second IHS is configured to establish a second connection with a workspace orchestration service, and where the workspace orchestration service is configured to: receive device identification information of the first IHS from the second IHS; and authenticate the device identification information against a database provided by a manufacturer of the first IHS; and in response to a successful authentication, establish a third connection with the workspace orchestration service.

Workspace deployment using a secondary trusted device

Embodiments provide access to enterprise data via a secured virtual environment hosted on an Information Handling System (IHS), with the integrity of the IHS validated prior to launching the virtual environment. The integrity of the IHS may also be continuously validated during operation of the launched virtual environment. Policies for accessing the enterprise data are stored in a secured memory that is isolated from the operating system of the IHS. A virtual environment is configured, according to the policies, with resources for a particular user to access the enterprise data. If the integrity of the IHS is validated by a trusted resource on the IHS, the virtual environment is launched. During operation of the virtual environment, the trusted resource periodically confirms the integrity of the IHS. If the integrity of the IHS is not verified or policy changes are identified, access to the secured workspace may be revoked.

Integrity assurance of a secured virtual environment

Systems and methods for endpoint context-driven, dynamic workspaces are described. In some embodiments, an Information Handling System (IHS) of a workspace orchestration service, the IHS comprising a processor and a memory coupled to the processor, the memory having program instructions stored thereon that cause the IHS to: receive initial context information from a local management agent; produce a first workspace definition based upon the initial context information, where the local management agent is configured to instantiate a first workspace based upon the first workspace definition; receive updated context information from the local management agent; and in response to the updated context information being noncompliant with attributes of the first workspace definition, select a second workspace definition, where the updated context information complies with the attributes of the second workspace definition, and the local management agent is configured to instantiate a second workspace based upon the second workspace definition.

Systems and methods for endpoint context-driven, dynamic workspaces

Systems and methods for bare-metal or pre-boot user-machine authentication, binding, and entitlement provisioning are described. In some embodiments, a method may include: receiving, at a first portal managed by a manufacturer of an Information Handling System (IHS): (i) user credentials associated with a user of the IHS, and (ii) device identification associated with the IHS before the IHS is shipped to the user; selecting a customer of the manufacturer associated with the device identification; forwarding an indication of the user credentials to a second portal managed by the customer; and, in response to the second portal having successfully authenticated the user, establishing an identity session with the second portal; receiving, from the IHS, a request to initiate an entitlement sequence.

Systems and methods for bare-metal or pre-boot user-machine authentication, binding, and entitlement provisioning

Systems and methods for securely deploying a collective workspace across multiple local management agents are described. In some embodiments, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: receive, at a workspace orchestration service from a first local management agent, first context information and a first split key; receive, at the workspace orchestration service from a second local management agent, second context information and a second split key; determining, by the workspace orchestration service, that the first and second context information match a collaborative workspace policy; in response to the determination, authenticate the first and second split keys; and in response to the authentication, transmit a collaborative workspace definition to the first and second local management agents.

Systems and methods for securely deploying a collective workspace across multiple local management agents

An information handling system of a Radio Access Network (RAN) system operating a secure network slice orchestration system may comprise a network interface device of the RAN system transceiving data within a 5G New Radio (NR) frequency band with an endpoint computing device, the network interface device receiving an instruction from a client solutions management (CSM) platform to assign a network slice within the 5G NR frequency band, based on a security profile associating the endpoint computing device with a security tier, to a network slice as established by a software defined network (SDN) controller within a sub-portion of the 5G NR frequency band, the secure network slice orchestration system determining the endpoint computing device is associated with the network slice within a communications profile received from the CSM platform, and the SDN controller establishing a virtual access point transceiving data within the network slice with the endpoint computing device.

System and method of orchestrating distribution of network slices based on endpoint computing device security profiles

Systems and methods for dynamic workspace targeting with crowdsourced user context are described. In some embodiments, an Information Handling System (IHS) of a workspace orchestration service may include a processor; and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: detect execution of an application in a workspace instantiated by a client IHS; validate the application based upon productivity context information and security context information received from the client IHS; and in response to the validation, distribute the validated application to another workspace instantiated by another client IHS.

Systems and methods for dynamic workspace targeting with crowdsourced user context

Systems and methods for performing self-contained posture assessment from within a protected portable-code workspace are described. In some embodiments, an Information Handling System (IHS) may include a processor and a memory having program instructions that, upon execution, cause the IHS to: transmit, from an orchestration service to a local agent, a workspace definition that references an application, where the application comprises a first portion of code provided by a developer and a second portion of code provided by the orchestration service; and receive, from a local agent at the orchestration service, a message in response to the execution of the second portion of code within a workspace instantiated based upon the workspace definition. The second portion of code may inspect the contents of the runtime memory of the workspace upon execution, for example, by performing a stack canary check, a hash analysis, a boundary check, and/or a memory scan.

Systems and methods for performing self-contained posture assessment from within a protected portable-code workspace

A disclosed method for provisioning a computing device includes receiving, by provisioning software that executes on the computing device to provision the computing device for access to an enterprise infrastructure from a device orchestration service through which computing devices are provisioned to access the enterprise infrastructure, a digital certificate representing a credential for accessing, by a user via the computing device, the enterprise infrastructure. The method also includes storing, by the provisioning software, the digital certificate in dedicated secure credential storage on the computing device, receiving, by the provisioning software, a one-time-usable nonce value generated by the device orchestration service and usable by the provisioning software to unlock the digital certificate stored in the dedicated secure credential storage, unlocking the digital certificate, and presenting the digital certificate to the enterprise infrastructure to authorize access to the enterprise infrastructure by the user via the computing device.

Growing community of inventors

Hutto, TX, United States of America

Joseph Kozlowski