Automated ephemeral context-aware device provisioning

Patent metadata

Field	Value
Publication number	US-12174961-B2
Application number	US-202217839711-A
Country	US
Kind code	B2
Filing date	Jun 14, 2022
Priority date	Jan 18, 2022
Publication date	Dec 24, 2024
Grant date	Dec 24, 2024

Abstract

An information handling system may determine a personality flag value during a boot process and execute, responsive to detecting that the information handling system entered a secure environment and based on the personality flag value, a system update handler configured for discovering and connecting to a control plane. The system may also provision a secure ephemeral operating system, including receiving an image of the secure ephemeral operating system from the control plane responsive to a secure profile and validating the image prior to loading the secure ephemeral operating system to a random access memory.

First claim

What is claimed is:

1. An information handling system, comprising:
a processor; and
a memory device storing code that when executed causes the processor to perform operations, the operations including:
determining a personality flag value during a boot process of the information handling system;
executing, responsive to detecting that the information handling system entered a secure environment and based on the personality flag value indicates a managed ephemeral context-aware device, a system update handler configured for discovering and connecting to a control plane; and
provisioning by the system update handler a secure ephemeral operating system, wherein the provisioning of the secure ephemeral operating system includes receiving an image of the secure ephemeral operating system from the control plane responsive to a secure profile and validating the image prior to loading the secure ephemeral operating system to a random access memory of the information handling system and overriding an installed operating system while the information handling system is in the secure environment.

2. The information handling system of claim 1 , wherein the operations further include providing the control plane with identifying and configuration information of the information handling system.

3. The information handling system of claim 1 , wherein the provisioning of the secure ephemeral operating system includes logically isolating an internal storage of the information handling system while the information handling system is in the secure environment.

4. The information handling system of claim 1 , wherein the operations further include applying a policy-driven secure profile to the information handling system, responsive to the information handling system being registered with the control plane.

5. The information handling system of claim 1 , wherein provisioning of the secure ephemeral operating system is responsive to the information handling system being unregistered with the control plane.

6. The information handling system of claim 1 , wherein the operations further include downloading a software application to be used by the information handling system in the secure environment.

7. The information handling system of claim 1 , wherein the operations further include rebooting the information handling system to operating system in an internal storage of the information handling system when the information handling system is deregistered from the secure environment.

8. The information handling system of claim 1 , wherein the information handling system is enabled as a context-aware device.

9. The information handling system of claim 1 , wherein the information handling system does not have an internal storage.

10. A method comprising:
determining, by a firmware-based agent of a processor, a personality flag value during a boot process of an information handling system;
executing, responsive to detecting that the information handling system entered a secure environment and based on the personality flag value indicates a managed ephemeral context-aware device, a system update handler of the firmware-based agent configured for discovering and connecting to a control plane; and
provisioning by the system update handler a secure ephemeral operating system, wherein the provisioning of the secure ephemeral operating system includes receiving an image of the secure ephemeral operating system from the control plane responsive to a secure profile and validating the image prior to loading the secure ephemeral operating system to a random access memory of the information handling system and overriding an installed operating system while the information handling system is in the secure environment.

11. The method of claim 10 , wherein the provisioning of the secure ephemeral operating system includes logically isolating an internal storage of the information handling system while the information handling system is in the secure environment.

12. The method of claim 10 , further comprising applying a policy-driven secure profile to the information handling system, responsive to the information handling system being registered with the control plane.

13. The method of claim 10 , wherein provisioning of the secure ephemeral operating system is responsive to the information handling system being deregistered with the control plane.

14. The method of claim 10 , further comprising rebooting the information handling system to an operating system in an internal storage of the information handling system when the information handling system is deregistered from the secure environment.

15. The method of claim 10 , further comprising downloading a software application to be used by the information handling system in the secure environment.

16. A non-transitory computer-readable media to store instructions that are executable to perform operations comprising:
determining a personality flag value during a boot process of an information handling system;
executing, responsive to detecting that the information handling system entered a secure environment and based on the personality flag value that indicates a managed ephmeral context-aware device, a system update handler of a firmware-based agent configured for connecting to a control plane; and
provisioning a secure ephemeral operating system on the information handling system, wherein the provisioning of the secure ephemeral operating system includes receiving an image of the secure ephemeral operating system from the control plane responsive to a secure profile and validating the image prior to loading the secure ephemeral operating system to a random access memory of the information handling system and overriding an installed operating system while the information handling system is in the secure environment.

17. The non-transitory computer-readable media of claim 16 , wherein the provisioning of the secure ephemeral operating system includes logically isolating an internal storage of the information handling system while the information handling system is in the secure environment.

18. The non-transitory computer-readable media of claim 16 , the operations further comprising applying a policy-driven secure profile to the information handling system, responsive to the information handling system being registered with the control plane.

19. The non-transitory computer-readable media of claim 16 , the operations further comprising rebooting the information handling system to operating system in an internal storage of the information handling system when the information handling system is deregistered from the secure environment.

20. The non-transitory computer-readable media of claim 16 , the operations further comprising downloading and executing a software application to be used by the information handling system in the secure environment.

Assignees

• Dell Products Lp

Inventors

• Terpstra John Henry
• Mackenbach Jeroen
• Boyapalle Anantha K

Classifications

• G06F9/4406

  Loading of operating system · CPC title

• G06F21/572 Primary

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F8/63

  Image based installation; Cloning; Build to order · CPC title

• G06F9/4401

  Bootstrapping (security arrangements therefor G06F21/57) · CPC title