Dell Products Inc.

Secureworks, Inc.

Theodore Stratton Webb

Mukund Purshottam Khatri

Johan Rahardjo

Jon R Ramsey

Syama Poluri

Muhammed K Jaber

Weijia Zhang

Jacqueline Hegedus Wilson

Wayne Robert Weilnau, Jr

Kevin D Noreen

Wei G Liu

Jon Robert Hass

Charles Terrence Perusse, Jr

Gobind Vijayakumar

Manoj Sharad Gujarathi

Kevin W Deike

In accordance with embodiments of the present disclosure, a management controller configured to provide management-domain management of an information handling system may include a processor and a key management utility embodied in non-transitory computer-readable media. The key management utility may be configured to issue one or more commands to a cryptoprocessor for storing and sealing a key encryption key on the cryptoprocessor, wherein the key encryption key is for decrypting a media encryption key for encrypting and decrypting data stored to a storage resource of a host domain of the information handling system. The key management utility may also be configured to issue one or more commands to the cryptoprocessor for unsealing and retrieving the key encryption key from the cryptoprocessor.

Systems and methods for management controller management of key encryption key

A method may include storing a first set of secrets associated with an information handling system in a credential vault of a management controller configured to be coupled to a processor of a host system of the information handling system in order to provide management of the information handling system via management traffic communicated between the management controller and an external management network such that the first set of secrets are accessible responsive to a verified boot of the management controller and storing a second set of secrets associated with the information handling system in a storage of a cryptoprocessor owned by the management controller such that access to the second set of secrets may be granted in response to an administrator's provision of authorization to the cryptoprocessor, and such that access to the second set of secrets is prevented during runtime of the host system in absence of authorization.

Systems and methods for storing administrator secrets in management controller-owned cryptoprocessor

A method includes a service processor of an information handling system downloading code, including device drivers, and transferring the code to an operating system of the information handling system without rebooting the operating system. In some embodiments, a daemon of the operating system may request device drivers for newly-inserted devices and the service processor may make the device drivers available to the operating system in response to the requests. In some embodiments, the service processor may download updated device drivers and may inform the daemon. The updated device drivers may be automatically provided to the operating system or made available upon a request of a user. The service processor may make code available to the operating system by exposing a portion of its non-volatile memory to the operating system as a virtual device.

Obtaining device drivers from an out-of-band management network

A network interface device includes a memory and a processor operable to receive a malicious packet marker, store the malicious packet marker to the memory, monitor network data packets flowing in the network interface device, determine that a packet matches the malicious packet marker, and store log information from the packet to the memory.

System and method for tamper resistant reliable logging of network traffic

An information handling system includes a processor and a management controller separate from the processor. The management controller is operable to store an anti-virus program and a malicious marker detection program in a memory of the management controller, and to execute the malicious marker detection program. The malicious marker detection program operates to detect a state of a device of the information handling system, determine that the information handling system is under attack from a malicious program in response to detecting the state of the device, and send an alert to a management system coupled to the information handling system, the alert indicating that the information handling system is under attack from the malicious program.

System and method for operating malicious marker detection software on management controller of protected system

A computer-implemented method comprises a service processor: establishing a kill switch encryption key (KSEK) to provide data security for data within storage devices of configurable components within a system; automatically encrypting, with the KSEK, data that is written to one of the storage devices; configuring the configurable components to prevent access to the stored data unless a valid copy of the KSEK is received from the service processor along with the request for the data; automatically decrypting, with the KSEK, the KSEK-encrypted data that is read from storage device; and in response to receiving a verified request to decommission the system, performing the decommissioning by deleting/erasing the KSEK from a secure storage at which the only instance of the KSEK is maintained. Deletion of the KSEK results in a permanent loss of access to the stored encrypted data within the system because the stored encrypted data cannot be decrypted without the KSEK.

Single command functionality for providing data security and preventing data access within a decommissioned information handling system

A system to manage a key license includes an information handling system having non-volatile memory accessible to a processor. The non-volatile memory stores feature enablement information related to a feature that the information handling system is adapted to provide. The non-volatile memory stores instructions that are accessible to the processor and executable by the processor to send the feature enablement information to an external system after the information handling system is deployed, and to request the feature enablement information, or other feature enablement information, from the external system in response to receiving a request for the information handling system to provide the feature.

System and method for managing feature enablement in an information handling system

A method for recovery from uncorrectable errors in an information handling system including an operating system (OS) and one or more network interface cards (NICs) is provided. The method may include detecting an uncorrectable error; determining whether the uncorrectable error is isolated to a particular NIC; determining whether the particular NIC is teamed with one or more other NICs; and notifying the OS of a successful recovery from the uncorrectable error if it is determined that (a) the uncorrectable error is isolated to a particular NIC, and (b) the particular NIC is teamed with one or more other NICs.

System and method for recovery from uncorrectable bus errors in a teamed NIC configuration

A method for recovery from uncorrectable errors in an information handling system including an operating system (OS) and one or more network interface cards (NICS) is provided. The method may include detecting an uncorrectable error; determining whether the uncorrectable error is isolated to a particular NIC; determining whether the particular NIC is teamed with one or more other NICs; and notifying the OS of a successful recovery from the uncorrectable error if it is determined that (a) the uncorrectable error is isolated to a particular NIC, and (b) the particular NIC is teamed with one or more other NICs.

Installable device drivers may be stored on a partition, e.g., Utility Partition (UP) or other OEM partition, of an original equipment manufacturer (OEM) storage device, e.g., hard disk drive, by associating an INT13h Basic Input-Output System (BIOS) interrupt call, e.g., reading from floppy disk drive a: or drive b: a desired storage device driver during the normal course of installing an operating system (OS), e.g., Microsoft Windows, Linux, BSD, Unix, etc., on the information handling system, e.g., personal computer, server, blade server, storage array, workstation, etc. The run-time loading of a raw floppy image having OS installable drivers residing in the Utility Partition or other hidden partition on the hard disk may be presented as a virtual floppy disk drive to the OS installer, e.g., person (manual) or scripted (automated) process.

Growing community of inventors

Austin, TX, United States of America

Theodore Stratton Webb