Control-plane protocol for isolated or disconnected environments of an information handling system

Patent metadata

Field	Value
Publication number	US-12506725-B2
Application number	US-202217724880-A
Country	US
Kind code	B2
Filing date	Apr 20, 2022
Priority date	Apr 20, 2022
Publication date	Dec 23, 2025
Grant date	Dec 23, 2025

Abstract

An information handling system of a multiple node environment includes a memory and a processor. The memory stores one or more variables associated with a state of the information handling system. The processor receives a cryptographically signed message. A source of the cryptographically signed message is considered as an untrusted source within the multiple node environment. The processor verifies the cryptographically signed message as an authoritative message. In response to the cryptographically signed message being verified as an authoritative message, the processor determines the state described in the cryptographically signed message matches the state of the information handling system stored in the memory. In response to the state described within the cryptographically signed message matches a current system state, the processor executes a request associated with the cryptographically signed message.

First claim

What is claimed is:

1 . An information handling system of a multiple node environment, the information handling system comprising:
a memory to store one or more variables associated with a state of the information handling system; and a processor in communication with the memory, the processor to:
receive a first cryptographically signed message;
receive a second cryptographically signed message after the first cryptographically signed message, wherein the second cryptographically signed message was transmitted prior to the first cryptographically signed message, wherein a source of the second cryptographically signed message is considered as an untrusted source within the multiple node environment, wherein the second cryptographically signed message includes a request having multiple states, the multiple states includes a first state;
based on the second cryptographically signed message being transmitted prior to the first cryptographically signed message, determine that the second cryptographically signed message is preempted by the first cryptographically signed message;
verify the second cryptographically signed message as an authoritative message;
in response to the second cryptographically signed message being verified as an authoritative message and based on the second cryptographically signed message being preempted, determine whether the multiple states described within the second cryptographically signed message match multiple current system states, wherein one of the current system states includes a current firmware version of the information handling system, wherein the first state includes a first firmware version in the second cryptographically signed messages; and
in response to all of the multiple states described within the second cryptographically signed message matching all of the current system states:
determine that the first cryptographically signed message did not change any of the current system states associated with the multiple states described within the second cryptographically signed message;
execute the request associated with the second cryptographically signed message, wherein the state described within the second cryptographically signed message matches the current system state based on the first firmware version matching the current firmware version; and
provide a real-time status of the request, wherein the information handling system is an endpoint of the multiple node environment.

2 . The information handling system of claim 1 , wherein the processor further to receive one or more certificates to synchronize different user roles and different user access permissions.

3 . The information handling system of claim 1 , wherein in response to the state being invalid, the processor further to:
provide error data in a response message, wherein the error data indicates that the state of the second cryptographically signed message was invalid.

4 . The information handling system of claim 1 , wherein the second cryptographically signed message includes one or more certificates signed with a public key of a trusted user.

5 . The information handling system of claim 1 , wherein the state identifies an expected specific global variable for the information handling system.

6 . The information handling system of claim 1 , wherein the second cryptographically signed message is sent from a second information handling system in the multiple node environment.

7 . The information handling system of claim 6 , wherein both the information handling system and the second information handling system are control plane nodes in the multiple node environment.

8 . The information handling system of claim 1 , wherein the multiple node environment is a disaggregated environment.

9 . A method comprising:
receiving, at a first information handling system of a multiple node environment, a first cryptographically signed message; receiving a second cryptographically signed message after the first cryptographically signed message, wherein the second cryptographically signed message was transmitted prior to the first cryptographically signed message, wherein a source of the second cryptographically signed message is considered as an untrusted source within the multiple node environment, wherein the second cryptographically signed message includes a request having multiple states, the multiple states includes a first state; based on the second cryptographically signed message being transmitted prior to the first cryptographically signed message, determining that the second cryptographically signed message is preempted by the first cryptographically signed message; verifying the second cryptographically signed message as an authoritative message; in response to the second cryptographically signed message being verified as an authoritative message and based on the second cryptographically signed message being preempted, determining whether the multiple states described within the second cryptographically signed message match multiple current system states, wherein one of the current system states includes a current firmware version of the information handling system, wherein the first state includes a first firmware version in the second cryptographically signed messages; and in response to all of the multiple states described within the second cryptographically signed message matching all of the current system states:
determining that the first cryptographically signed message did not change any of the current system states associated with the multiple states described within the second cryptographically signed message;
executing the request associated with the second cryptographically signed message, wherein the state described within the second cryptographically signed message matches the current system state based on the first firmware version matching the current firmware version; and
providing a real-time status of the request, wherein the information handling system is an endpoint of the multiple node environment.

10 . The method of claim 9 , further comprising providing one or more certificates to each node of the multiple node environment to synchronize different user roles and different user access permissions.

11 . The method of claim 9 , further comprising in response to the state being invalid, providing error data in a response message, wherein the error data indicates that the state described within the second cryptographically signed message was invalid.

12 . The method of claim 9 , wherein the second cryptographically signed message includes one or more certificates signed with a public key of a trusted user.

13 . The method of claim 9 , wherein the state identifies an expected specific global variable for the first information handling system.

14 . The method of claim 9 , wherein the second cryptographically signed message is sent from a second information handling system in the multiple node environment.

15 . The method of claim 14 , wherein both the first and second information handling systems are control plane nodes in the multiple node environment.

16 . The method of claim 9 , wherein the multiple node environment is a disaggregated environment.

17 . A non-transitory computer-readable medium including code that when executed performs a method, the method comprising:
receiving, at a first information handling system of a multiple node environment, a first cryptographically signed message; receiving a second cryptographically signed message after the first cryptographically signed message, wherein the seco

Assignees

• Dell Products Lp

Inventors

• Goodman Bradley
• Hutchinson Kirk
• Sharma Anurag

Classifications

• H04L63/0442 Primary

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title