Dell Products Inc.

Minhaj Ahmed

Daniel Lawrence Hamlin

Amy Christine Nelson

Vivek Viswanathan Iyer

Charles D Robison

Brijesh Kumar Mishra

Systems and methods are provided that may be implemented during a pre-boot environment to authenticate a user in the basic input/output system (BIOS) of an information handling system, and to securely provision a resulting authentication token to post-boot operating system (OS) login components of the system. In addition, single sign-on user authentication may be performed during a pre-boot BIOS environment and then extended to the post-boot OS environment without requiring exchange of pins or other intermediary authentication factors between the OS and pre-boot authentication (PBA) for the user to gain access to the information handling system or other network resources.

Systems and methods for leveraging authentication for cross operating system single sign on (SSO) capabilities

A system for a time-based one-time password security system operating at a provisioning server may comprise transmitting one or more first locally generated random-string numbers for generation of a first time-based one-time password to a remotely connected internet of things sensor and a remotely connected internet of things sensor hub. The system may also comprise executing code instructions to associate the internet of things sensor with a first client key in a table stored in a memory operatively connected to the processor, associate the internet of things sensor hub with a second client key in the table, and associate the internet of things sensor and internet of things sensor hub with the one or more first locally generated random-string numbers in the table. Further the first remotely generated random-string numbers may identify a first preset function for generation of a first session key used in encrypting and decrypting sensor data records.

Method and apparatus for generation of a time-based one-time password for session encryption of sensor data gathered in low-performance and IoT environments

In scenarios where I/O ports of an IHS are not secured, malicious actors may exploit such I/O ports when a user of the IHS is unaware. Embodiments provide techniques for securing access to I/O ports of an IHS based on the context of the IHS, which includes the user context and the system context of the IHS. Upon initialization of the IHS, access to the I/O ports is configured based on a boot context policy. The operating system is booted and use of the IHS proceeds. Modifications to an IHS context are detected. Based on a policy applicable to the modified IHS context, modified access to the I/O ports is configured. In embodiments where the IHS is a convertible laptop, a system context may include the posture in which the system is physically configured. A user context may include whether a user is detected in proximity to the IHS.

Controlling access to I/O ports based on user and system context

Data is frequently protected by securing the data within containers that are only accessible using a specific security application. Once such data is transferred, all protections provided by the security application are lost. Methods and systems provide secured access to data by intercepting requests for access to a data files accessed via an IHS (Information Handling System) by applications operating within the operating system of the IHS. Based on condition settings stored in the data files, access privileges are determined for applications. The conditions settings include environmental conditions required for providing access to the data. If the IHS satisfies the environmental conditions specified by a data file, access to the data file may be granted. The data requests may be intercepted by a kernel process of the operating system of the IHS. The environmental conditions may specify requirements on the networks, display devices and/or software utilized by the IHS.

System-level data security based on environmental properties

An information handling system for securely storing a file includes a storage device and a processor that instantiates an operating system, a file system filter driver, and a storage device driver. The file system filter driver receives the file and access information from the operating system, combines the file and the access information to provide a secure file, and stores the secure file via the storage device driver on the storage device. The file system filter driver further receives a request for the secure file from the operating system, directs the storage device driver to retrieve the access information from the secure file on the storage device, and determines if the request is authorized based upon the access information. In response to the request being authorized, the file system filter driver directs the storage device driver to retrieve the secure file from the storage device, and provides the secure file to the operating system.

System and method to manage file access rights in an information handling system

In an example of a system and method for time-based local authentication, an Information Handling System (IHS) may include a processor and a memory coupled to the processor. The memory may have program instructions stored thereon that, upon execution, cause the IHS to generate a first time token and to transmit the first time token to a secondary IHS via a local network, where the secondary IHS is configured to generate a second time token and to transmit the second time token to the IHS via the local network. The IHS may receive the second time token from the secondary IHS and it may determine whether the first time token matches the second time token. In response to the first time token matching the second time token, the IHS may receive access to a protected resource.

Time based local authentication in an information handling system utilizing asymmetric cryptography

Method and apparatus for generation of a time-based one-time password for session encryption of sensor data gathered in low-performance and IOT environments

A pre-boot authentication (PBA) credential sharing system includes a secure subsystem including an off-host processing system and a secure storage. A credential management application is coupled to the off-host processing system. A data protection engine is coupled to the off-host processing system and a PBA database. The data protection engine receives a notification from the off-host processor of the enrollment of an authentication credential in the secure storage by the credential management application, and provides PBA object information for association with the authentication credential to create a PBA object that is stored in the secure storage. Subsequently, while in a pre-boot environment, the data protection engine requests the PBA object from the secure storage, retrieves storage authentication information from the PBA database using the PBA object, and performs a pre-boot authentication process using the storage authentication information.

Growing community of inventors

Allen, TX, United States of America

Minhaj Ahmed