Abstract:
In accordance embodiments of the present disclosure, a method may include, during execution of an operating system on an information handling system and responsive to a user input indicating a desire to invoke a basic input/output system (BIOS) setup program for configuring a BIOS, prompting for and receiving user-provided credentials via a user interface communicatively coupled to the processor. The method may also include, during execution of the operating system, passing BIOS credentials to the BIOS based on the user-provided credentials. The method may additionally include, during execution of the operating system determining, by the BIOS, if the BIOS credentials are valid. The method may further include, responsive to determining that the BIOS credentials are valid, setting a flag to a value indicating that the BIOS setup program is to be invoked on a subsequent boot of the information handling system.
Abstract:
Systems and methods for hardware-based protection of Application Programming Interface (API) keys are described. In some embodiments, an endpoint Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: send an encrypted API key to a trusted controller; and receive a decrypted API key from the trusted controller.
Abstract:
Systems and methods for providing fleet remediation of compromised workspaces are described. In some embodiments, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: receive, from a first local management agent configured to provide a first workspace in a fleet of workspaces, an indication that the first workspace has suffered a security compromise, where the first workspace is instantiated based upon a first workspace definition; and in response to the indication, transmit a second workspace definition to a second local management agent configured to provide a second workspace in the fleet of workspaces, where the second workspace is instantiated based upon the first workspace definition, and where the second local management agent is configured to instantiate a third workspace based upon the second workspace definition.
Abstract:
Systems and methods are provided for managing capabilities of workspaces operating on an Information Handling System (IHS). A request is received from a user of the IHS for access to a protected resource. A security context and a productivity context are determined for operation of a primary workspace on the IHS. Two or more applications are identified for operation within the primary workspace, where the applications provide access to the protected resource, and where the applications include overlapping capabilities. Based on the security context and the productivity context for the primary workspace deployment, two or more of the applications with overlapping capabilities are selected for operation within the primary workspace.
Abstract:
System and methods support workspaces operating on an Information Handling Systems (IHS). A primary workspace definition is received by the IHS from a remote orchestrator. A primary workspace is instantiated based upon the primary workspace definition, where the instantiated primary workspace provides access to a protected resource. One or more subordinate workspaces are identified that operate by peripheral devices that are coupled to the IHS, where each subordinate workspace supports one or more roles of authorized operations by a respective peripheral device. The roles may correspond to specific functions of the first of the reported peripheral device that are available for use by the primary workspace. One or more of the subordinate workspaces are selected for use by the primary workspace based on the roles supported by the subordinate workspaces.
Abstract:
Systems and methods support transferring control of a workspace that operates on an Information Handling System (IHS). An authorization policy is established on the IHS that is modifiable only by an arbiter of a remote orchestration service. The authorization policy specifies authorized administrators of the workspace. The authorization policy is modified to specify the arbiter and a first remote orchestrator as authorized administrators of the workspace. Administration of the workspace by the first orchestrator is allowed based on credentials that validate it as an authorized administrator specified by the policy. A notification is received of a transfer of orchestration of the workspace to a second remote orchestrator. The authorization policy is modified to specify the arbiter and the second orchestrator as authorized administrators of the workspace. Administration of the workspace by the second orchestrator is allowed based on credentials that validate it as an authorized administrator specified by the policy.
Abstract:
Systems and methods are provided that may be implemented in one example to physically transfer or relocate information handling systems between facilities of different system owners in a manner that is downstream of the original equipment manufacturer (OEM) of the transferred information handling system/s, and which in one example may be managed in part or in whole by the OEM’s customer base. In conjunction with facilitating physical transfer of each given information handling system directly between different enterprise owners, the disclosed systems and methods may also be implemented at the same time to utilize a unique identifier (that is assigned by the OEM manufacturer to each given information handling system) to manage transfer of the registration or other type of association of the given information handling system assets between the enterprise OEM user accounts of the different enterprise owners that are maintained by an OEM of the information handling system assets.
Abstract:
Systems and methods for self-protecting and self-refreshing workspaces are described. In some embodiments, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: receive, from a workspace orchestration service, one or more files or policies configured to enable the client IHS to instantiate a workspace based upon a workspace definition; determine that a context of the client IHS has been modified; in response to the determination, terminate the workspace; and receive, from the workspace orchestration service, one or more files or policies configured to enable the client IHS to re-instantiate the workspace based upon the workspace definition.
Abstract:
Systems and methods are provided that may be implemented to provide a hardware-rooted, protected, and operating system (OS)-agnostic environment in which designated logic (e.g., one or more software and/or firmware tools such as an OS agent) may be run to verify the ownership and/or registration of a given information handling system before the OS is booted and running, and therefore before system data (e.g., user data) is exposed. In one exemplary embodiment, the designated logic may include a unified extensible firmware interface (UEFI) driver that is protected (e.g., signed), and that runs during the system boot sequence before the OS is booted. The disclosed systems and methods may be advantageously implemented in one embodiment to allow a system user who purchases and acquires a given information handling system from a source and/or channel other than the original system manufacturer to register and/or associate the given information handling system with their manufacturer-assigned user account.
Abstract:
Systems and methods for modernizing workspace and hardware lifecycle management in an enterprise productivity ecosystem are described. In some embodiments, a client Information Handling System (IHS) may include a processor, and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the client IHS to: transmit, by a local management agent to a workspace orchestration service, an access request and context information; receive, at the local management agent from the workspace orchestration service, one or more files or policies configured to enable the local management agent to instantiate a workspace based upon a workspace definition, wherein the workspace orchestration service is configured to: (i) calculate a security target and a productivity target based upon the access request and the context information, and (ii) create the workspace definition based upon the security target and the productivity target; and instantiate the workspace.