Dell Products Inc.

Srinivas Giri Raju Gowda

Syama Poluri

Anh Dinh Luong

Shyam T Iyer

Shyamkumar Thiyagarajan Iyer

Douglas L Farley

David Craig Lawson

Mukund Purshottam Khatri

Gaurav Chawla

Eugene David Cho

Trevor Cockrell

Shawn Mathew Swanson

An LCS trust system includes resource devices including respective resource device pTPMs, and an SCP device including an SCP device pTPM and providing a resource management system with a resource management system vTPM. The resource management system uses the resource management system vTPM to establish a first trust relationship with the SCP device via the SCP device pTPM, and respective second trust relationships with each of the resource devices via their respective resource device pTPMs. The resource management system the uses a subset of the resource devices to provide an LCS that includes an LCS vTPM and that uses the LCS vTPM to establish a respective third trust relationship with each of the subset of the resource devices via their respective resource device pTPMs. As such, a chain of trust is provided for the LCS that is based at least upon the first, respective second, and respective third trust relationships.

LCS trust system

An LCS SDXI resource ownership system includes a resource system having an orchestrator device coupled to resource devices and a resource management system. An SDXI controller subsystem is provided by the resource management system and/or the orchestrator device, and operates to use the first resource system to provide an LCS with an SDXI data plane provided by an SDXI node included in the resource devices, and create an SDXI configuration space for the LCS. The SDXI controller subsystem then receives a unique LCS identifier from the LCS via the SDXI configuration space, and links the SDXI node to the LCS in an SDXI resource database using the unique LCS identifier. The SDXI controller subsystem then migrates the LCS to a second resource system, and the LCS performs operations using the SDXI node following migration to the second resource system based on the linking of the LCS to the SDXI node.

LCS SDXI resource ownership system

A method for managing a microvisor includes: issuing an API call to a microvisor agent to obtain a configuration template (CT) required to provision an LCS on an IHS; upon obtaining the CT, sending the CT to a microvisor kernel via the microvisor API; provisioning the LCS based on the CT; upon provisioning of the LCS and based on the microvisor kernel's request, initiating a guest BIOS of the LCS; notifying, via a GUI, an administrator about the provisioned LCS; after notifying the administrator: monitoring communication traffic of the LCS; analyzing the communication traffic to generate an analysis output; making, based on the analysis output, a determination that the activity is a malicious activity; and implementing, based on the determination, a security policy to disrupt a malicious user of the LCS.

Method and system for microvisor hiding

An untrusted orchestrator function subsystem inventory and verification system includes an untrusted orchestrator device, an operating system, a BIOS, and a management device. In response to presentation by the untrusted orchestrator device of a function subsystem to the operating system during runtime, the operating system generates a function subsystem detection alert that identifies the function subsystem. In response to the function subsystem detection alert, the BIOS generates and transmits a BIOS inventory update. The management device receives the BIOS inventory update, and determines whether the operating system is authorized to use the function subsystem at least in part based on the BIOS inventory update. If so, the management device allows the operating system to utilize the function subsystem while, if not, the management device prevents the operating system from utilizing the function subsystem.

Untrusted orchestrator function subsystem inventory and verification system

A system can receive, in association with a user account, an operating system image that is encrypted with a private key, a manifest generated from a first instance of a manifest generator tool that is configured to identify system provisioning artifacts that is encrypted with the private key, and a public key. The system can install the operating system image on a computing device. The system can generate, with a second instance of the manifest generator tool, a first identification of system provisioning artifacts from the installing of the operating system image. The system can send the first identification of system provisioning artifacts to an attestation service, wherein the attestation service is configured to compare the first identification of system provisioning artifacts with a second identification of system provisioning artifacts received in association with the user account, and send, for access via the user account, an indication of whether the first identification of system provisioning artifacts matches the second identification of system provisioning artifacts.

Secure boot attestation in a cloud platform

A trusted orchestrator function subsystem inventory and verification system includes an OS, a BIOS, a management device, and a trusted orchestrator device. In response to presentation of a function subsystem to the OS during runtime, the OS generates a function subsystem detection alert that identifies the function subsystem. In response to the function subsystem detection alert, the BIOS generates and provides a BIOS inventory update that identifies the function subsystem. The management device receives the BIOS inventory update and, in response, forwards the BIOS inventory update. The trusted orchestrator device receives the BIOS inventory update and, in response, determine whether the function subsystem identified in the BIOS inventory update is included in a trusted function subsystem inventory. If so, the trusted orchestrator device allows the operating system to utilize the function subsystem while, if not, the trusted orchestrator device prevents the operating system from utilizing the function subsystem.

Trusted orchestrator function subsystem inventory and verification system

An information handling system may include a processor, an interface configured for hot-insertion of information handling resources, and a management controller configured to provide out-of-band management of the information handling system. The management controller may be configured to: receive a first notification that an information handling resource has been hot-removed from the interface; and in response to the first notification, disable power to the interface to prevent initialization of an information handling resource that is hot-inserted at the interface.

Hot-inserted devices

A data mover selection system includes a fabric manager system coupled to computing devices that are coupled to a memory system. The fabric manager system receives respective local data mover selection information from the computing devices that identifies data mover device(s) accessible to those computing device, and generates global data mover selection information that includes each data mover device accessible to the computing devices. When the fabric manager system receives a first data transfer request to transfer data between first and second memory locations in the memory system, it uses the global data mover selection information to identify a data mover device having the highest priority for performing data transfers between the first and second memory locations in the memory system, and transmits a first data transfer instruction to that data mover device to cause that data mover device to perform the first data transfer operation.

Data mover selection system

A data mover selection system includes a memory system coupled to first and second data mover devices, and an operating system coupled to the first and second data mover devices. The operating system determines that a first data transfer operation provides for the transfer of data between first and second memory locations in the memory system, and identifies the first data mover device for performing the first data transfer operation based on the first data mover device having a higher priority relative to the second data mover device for performing data transfers between the first and second memory locations in the memory system. In response, the operating system transmits a first data transfer instruction to the first data mover device that causes the first data mover device to perform the first data transfer operation to transfer data between the first and second memory locations in the memory system.

An I/O device selection system includes a memory system, I/O devices that are coupled to the memory system; and an I/O scheduler that is coupled to the I/O devices. The I/O scheduler receives an I/O request that that is directed to the memory system, and determines at least one I/O operation that is configured to satisfy the I/O request. The I/O scheduler then identifies an operating level of the I/O devices that are configured to perform the at least one I/O operation and, based on the operating level of the I/O devices, selects a subset of the I/O devices for performing the at least one I/O operation, and transmits at least one I/O operation instruction that is configured to cause the subset of the I/O devices to perform the at least one I/O operation in order to satisfy the I/O request.

Input/output device selection system

An information handling system may include a management controller configured to direct a basic input/output system to generate an advanced configuration power interface (ACPI) event that is triggered by an update of a host interface attribute. A processor provides at least one function to publish and configure a host interface, where the host interface is associated with a management service. The processor may also detect the ACPI event triggered by the update of the host interface attribute. Subsequent to the detection of the ACPI event, a structure of the host interface associated with the management service and a supported authentication type and security information associated with the supported authentication type may be determined. The processor may authenticate to the host interface via the supported authentication type using the security information and update an operating system variable associated with the update of the host interface attribute.

System and method for publishing and configuring a management service interface

In accordance with embodiments of the present disclosure, an information handling system may include: a plurality of processor sockets, each processor socket configured to receive a respective processor; a plurality of slots, each slot configured to receive a corresponding information handling resource; and a program of instructions embodied in non-transitory computer-readable media. The program of instructions may be configured to, when read and executed by one of the respective processors identify a processing node for handling a processing load of an information handling resource to be inserted into one of the slots, determine slots within a proximity domain of the processing node, and identify the slots within the proximity domain of the processing node as optimal slots for insertion of the information handling resource to be inserted.

Growing community of inventors

Santa Clara, CA, United States of America

Srinivas Giri Raju Gowda