Dell Products Inc.

Sumanth Vidyadhara

Shekar Babu Suryanarayana

Ankit Kumar Singh

Ibrahim Sayyed

Chandrasekhar Puthillathe

Vivek Viswanathan Iyer

Anand Prakash Joshi

Raveendra Babu Madala

Yogesh Prabhakar Kulkarni

Vijay Bharat Nijhawan

Sundar Dasar

Karunakar Poosapalli

Parmeshwr Prasad

Shubham Kumar

Srikanth Kondapi

Lip Vui Kan

Raghavendra Venkataramudu

Adolfo Sandor Montero

Nicholas Diciurcio Grobelny

Balasingh Ponraj Samuel

Vinay Sawal

Wade Andrew Butcher

Viswanath Ponnuru

Vivekanandh Narayanasamy Rajagopalan

Prasoon Kumar Sinha

Terry Wayne Liles

Shekar Babu S

Neeraj Kumar Pant

Daniel Lawrence Hamlin

Elie Antoun Jreij

Ricardo Luis Martinez

Wei G Liu

Anantha K Boyapalle

Joseph Kozlowski

Santosh Hanamant Gore

Jon Robert Hass

Alok Pant

Mark W Shutt

Lucky Pratap Khemani

Aniruddha Suresh Herekar

Charles E Rose

Judith A Furlong

Vigneswaran Ponnusamy

Satyajit Dipakbhai Desai

Srikanth Krishnamurthy

Ragendra K Mishra

Shrikant U Hallur

Shun-Tang Hsu

Venkata Rama Krishna Rao Atta

Yasaswi Saisriram Bhimaraju

Bibby Yeh

Swamy Kadaba

Bill C Munger

Manjunath Gr

Young Hwan Jang

Venkata Atta

Sudharshana Madhava Rao

Dileesh Onniyil

Srinivas G Gowda

Ritvik Sharma

Guru Prasad N Yadav

Shekar Babu Suryanarayand

S Shekar Babu

One example method includes receiving, by a distributed attestation proxy server (DAPS) from a client, an attestation request, establishing, by the DAPS, a secure communication channel with the client, performing, by the DAPS, a resource discovery process to identify a resource that meets a requirement of the client, facilitating, by the DAPS, an attestation exchange between the client and the resource, performing, by the DAPS, a verification and attestation process that comprises generation of an attestation result, transmitting, by the DAPS, the attestation result to the client, and when the attestation result is positive, establishing, by the DAPS, a secure communication channel between the client and the resource.

Proxy attestation service for multi-cloud tee hardware

A system can receive, from a remote computer of remote computers, inventory data representative of an inventory, wherein the inventory data indicates that the remote computer is configured to implement a shared memory pool with the remote computers according to a compute express link protocol. The system can receive, from the remote computer, a request to onboard the remote computer, wherein the request adheres to a defined security protocol and data model architecture, and wherein the system is configured to remotely manage the remote computers as part of a hybrid cloud platform that comprises the remote computers. The system can authenticate the remote computer based on the request and according to the defined security protocol and data model architecture. The system can implement the shared memory pool for the remote computers.

Memory pool management using a cloud platform

In response to reception of a hypercall addition request, a virtual machine receives a public key. Based on the public key, the virtual machine determines whether the hypercall addition request is valid. In response to the hypercall being valid, the virtual machine adds a hypercall associated with the hypercall addition request within a hypervisor of an information handling system.

Para-virtualized drivers to prevent non-internet protocol hypervisor hypercall denial of service attacks

Methods, systems, and devices for providing for trust in a distributed environment are disclosed. In a distributed environment, various devices may be remote to one another and may interact with one another via one or more operable connections. Through the operable connections, various communications may be exchanged. However, the operable connections may not natively support authentication of any particular device in the distributed system. Consequently, entities in the distributed system may not intrinsically trust that the communications received through the distributed environment are authentic. The entities of the system may mutually authenticate one another prior to trusting communications from the other entities. For example, in a scenario where a client wishes to access data hosted by a data source, the client and data source may go through a process of mutually authenticating one another. By doing so, a trusted environment may be established.

System and method for authenticating devices in distributed environment

A system, method, and computer-readable medium are disclosed for servicing and managing a bare metal information handling system. An embedded lightweight operating system on the bare metal information handling system is booted up. The embedded lightweight operating system initiates a platform inference engine which is provided rules and policies as to applications to be run on the bare metal information handling system. The platform inference engine initiates a secure workspace launcher to launch a user workspace user experience environment. The user workspace user experience environment is provided on the bare metal information handling system.

System and method for secure application domain on bare metal information handling system

An information handling system includes a memory device, a memory, a chipset, and a basic input/output system (BIOS). The chipset includes a main processor and a hybrid processor. During a first pre-boot phase, the BIOS memory maps the hybrid processor to a first portion of the memory device, and stores an embedded operating system in the memory. During a second pre-boot phase, the BIOS memory maps the main processor to a second portion of the memory device, stores a host operating system in the memory, and loads the embedded operating system on the hybrid processor. The second portion is a larger portion of the memory device than the first portion.

Heterogeneous compute domains with an embedded operating system in an information handling system

Methods and systems for managing the operation of host devices is disclosed. A host device may include a computing device that operates in accordance with operation data. The operation data may include, for example, startup data such as code for a management entity (e.g., a basic input output system), settings (e.g., hardware and/or software) for the startup management entity, setting for general operation after booting to an operating system, copies of code (e.g., computer instructions executable with a processor) for applications to be executed by the host device, etc. If the operation data is modified, operation of the host device may be similarly modified.

System and method for securing host devices

Disclosed methods may push a capsule update including a best known configuration-compute express link (BKC-CXL) firmware update to a boot time memory area. Following a platform reboot, BKC-CXL firmware update operations are performed. The update operations include mapping a BKC-CXL runtime memory area to a non-volatile BKC store, identifying current CXL attributes from the runtime memory area, extracting the firmware update, creating one or more BKC-CXL objects from the firmware update to enable dynamic configuration of CXL parameters, comparing current CXL attributes with stored CXL attributes to identify CXL attribute changes, and saving information indicative of the CXL attribute changes back to the non-volatile BKC store. Following a subsequent reboot, regular boot path operations are performed, including identifying existing CXL attributes indicated in the non-volatile BKC store and responsive to detecting a flag set to apply vendor pushed dynamic CXL attributes, obtaining BKC-CXL recommendations from an ML inference engine.

Configuring compute express link (CXL) attributes for best known configuration

An information handling system may include a processor and a basic input/output system configured to be the first code executed by the processor when the information handling system is booted and configured to initialize components of the information handling system into a known state, the basic input/output system further configured to implement a virtual machine monitor, the virtual machine monitor configured to isolate resources of the information handling system allocated to a network boot process of the information handling system from other resources of the information handling system allocated to other components of the basic input/output system.

Systems and methods for resource isolation for network boot using virtual machine monitor

A vulnerability management method acquires, during an OS runtime of an information handling system, vulnerability information indicating potentially vulnerable resources of the system. Disclosed methods calculate a vulnerability determination code (VDC) based on the vulnerability information. The VDC may indicate a scan zone that includes one or more scan zone components. Each component may correspond to a region of a potentially vulnerable resource. After a system reset, disclosed methods may perform a vulnerability aware (VA) boot sequence. The VA boot sequence may include, prior to booting a runtime operating system, determining, in accordance with the vulnerability information, whether to perform a comprehensive vulnerability detection (CVD) boot. A CVD boot refers to a boot sequence configured to boot a distinct operating system dedicated to performing a targeted vulnerability assessment that includes scanning the scan zone components indicated by the VDC. This dedicated OS may be implemented as an embedded OS (EOS).

Vulnerability mitigation resource running embedded operating system on hybrid core

A disclosed method installs an I/O trap protocol to provide an authentication callback function for handling I/O trap events. I/O trap events may include write operations accessing any of one or more identified I/O addresses. An I/O trap event may be registered with the authentication callback function for each of one or more identified I/O addresses. Original values of data may be stored in a memory resource. Any occurrences of an I/O trap event triggers the authentication callback function to perform I/O trap operations. The I/O trap operations may include determining whether the I/O trap event is associated with an approved driver and, if not, restoring data stored at the identified I/O address to an original value. Installing the I/O trap protocol may include installing the I/O trap protocol during a system management mode (SMM) phase of a UEFI boot sequence.

Secured communication protocol layer for authenticated hardware data access

An information handling system determines a difference between a first set of initialization information and a second set of initialization information during a pre-extensible firmware interface initialization phase of a boot process that is based on a first basic input/output system (BIOS), wherein the first set of initialization information is associated with the first BIOS and the second set of initialization information is associated with a second BIOS. The system also creates and publishes a hand-off block that includes an entry which describes the difference between the first set of initialization information and the second set of initialization information. The system parses the hand-off block during a driver execution environment phase to determine the difference between the first set of initialization information and the second set of initialization information, wherein the hand-off block is passed from the pre-extensible firmware interface initialization phase of the boot process. The system then updates the first set of initialization information based on the difference during the driver execution environment phase before continuing the boot process with the second BIOS using updated initialization information.

Dynamic operation code based agnostic analysis of initialization information

Temporary firmware is provided as cloud services. Different temporary firmware containers are downloaded via a communications network. A light-weight operating system launches and executes the temporary firmware containers during a boot operation, POST operation, or other scheme. The temporary firmware containers thus detect and perhaps resolve POST errors. The light-weight operating system may also download a full-service/resource operating system. A second or subsequent boot operation may be performed, but control is ceded to the full-service/resource operating system. Multiple firmware tenants may thus be temporarily downloaded to a bare metal machine to support POST error detection activities. Advanced OS serviceability, diagnostics, and other containerized firmware may thus be quickly and simply launched without requiring the excessive time and difficulties of using the full-service/resource operating system.

Containerized firmware services

A basic input output system (BIOS) of an information handling system may access a first list indicating one or more activation statuses of one or more BIOS firmware modules. The BIOS may determine a BIOS firmware module of the one or more BIOS firmware modules to load based, at least in part, on the first list. The BIOS may load the determined BIOS firmware module during booting of the information handling system.

Modularized basic input output system (BIOS) firmware activation

Systems and methods are provided for remotely supporting managed hardware components of an IHS (Information Handling System). Prior to booting an operating system of the IHS, the managed hardware components are enumerated as supporting remote management and a network stack is created in a secured IHS memory, where the network stack is for transfer of remote device management communications directed at the managed hardware components. Still prior to booting the operating system, the IHS chipset is configured to route device management messages received from remote management tools to the network stack. After booting the operating system, a secure remote management session is established between a remote management tool and an IHS device management agent. During operation of the device management agent in the booted operating system, device management messages are retrieved from the network stack and decoded device management messages are delivered to a managed hardware component.

Systems and methods for secure management of components of information handling systems

Growing community of inventors

Bengaluru, India

Sumanth Vidyadhara