Systems and methods for digital retirement of information handling systems

Patent metadata

Field	Value
Publication number	US-12592820-B2
Application number	US-202218056885-A
Country	US
Kind code	B2
Filing date	Nov 18, 2022
Priority date	Nov 18, 2022
Publication date	Mar 31, 2026
Grant date	Mar 31, 2026

Abstract

Digital retirement of an IHS may include encrypting, by the IHS, data on the IHS, using an encryption key stored in a trusted platform module (TPM) of the IHS, and incapacitating the TPM. This encryption key may be a (unique (256-bit encryption)) data sanitization key stored protected inside the TPM, thereby, the encryption key is protected inside the TPM by being immutable and unreadable by external devices. Digital retirement of the IHS may also include verifying all data on the IHS is encrypted successfully, prior to incapacitating the TPM. Incapacitation of the TPM may be carried out by instructing a power supply of the IHS to overvolt the TPM. Digital retirement of the IHS may be carried out in response to receipt of a digital retirement command that has been authorized and/or authenticated through two users and may be further manually approved by a third authorized and/or authenticated user.

First claim

What is claimed is:

1 . A method for digital retirement of an information handling system, comprising:
providing a user of the information handling system with of access to data stored by the information handling system; upon receipt of a digital retirement command configured to cause unreversible loss of access to data, requesting, from at least two sources independently validated based at least in part on Multi-Factor Authentication (MFA), at least two approvals for executing the digital retirement command; upon receipt of the at least two approvals, requesting on-premise approval, at the information handling system, of the unreversible loss of access to data; upon receipt of the on-premise approval of the unreversible loss of access to data, authenticating the digital retirement command based at least in part on a disk-on-key (DOK) pair stored in a trusted platform module of the information handling system; upon authentication of the digital retirement command, initiating a retirement mode of operations by the information handling system; upon entering the retirement mode, encrypting, by the information handling system, all data stored by the information handling system, using an encryption key stored in the trusted platform module; and as part of the retirement mode, incapacitating the trusted platform module such that all data stored by the information handling system is no longer recoverable.

2 . The method of claim 1 , wherein the encryption key is a unique data sanitization key protected inside the trusted platform module.

3 . The method of claim 2 , wherein the unique data sanitization key is a 256-bit encryption key.

4 . The method of claim 2 , wherein the encryption key protected inside the trusted platform module is immutable and unreadable by external devices.

5 . The method of claim 1 , further comprising verifying all data on the information handling system is encrypted successfully, prior to incapacitating the trusted platform module.

6 . The method of claim 1 , wherein incapacitating the trusted platform module further comprises instructing a power supply of the information handling system to overvolt the trusted platform module.

7 . The method of claim 1 , wherein encrypting data on the information handling system using the encryption key stored in the trusted platform module and subsequently incapacitating the trusted platform module are in response to receipt of the digital retirement command.

8 . The method of claim 1 , further comprising:
receiving, from a first user, by a remote access controller, selection of the information handling system for digital retirement; authorizing and/or authenticating the first user, by the remote access controller; requesting, by the remote access controller, that a second user approve the selection of the information handling system for digital retirement; authorizing and/or authenticating the second user, by the remote access controller; and sending, by the remote access controller, the digital retirement command to the information handling system, in response to approval, by the second user, of the selection of the information handling system for digital retirement.

9 . The method of claim 8 , wherein encrypting data on the information handling system using the encryption key stored in the trusted platform module and subsequently incapacitating the trusted platform module are automatically carried out in response to receipt, by the information handling system, of the digital retirement command, and wherein the method further comprises authenticating the digital retirement command based, at least in part, on correlating a DOK pair serial number with a serial number read from an information handling system motherboard.

10 . The method of claim 8 further comprising:
determining, by the information handling system, if manual approval of digital retirement of the information handling system is required;
authorizing and/or authenticating a third user, by the information handling system, in response to a determination that manual approval of digital retirement of the information handling system is required; and
encrypting data on the information handling system using the encryption key stored in the trusted platform module followed by incapacitation of the trusted platform module, in response to receipt, by the information handling system from the third user, of manual approval of digital retirement of the information handling system.

11 . An information handling system that comprises:
one or more processors; one or more memory devices coupled to the one or more processors, wherein the one or more memory devices comprise stored computer-readable instructions that, upon execution by the one or more processors, cause an operating system to provide applications for access to data stored by the information handling system; a trusted platform module incorporated into the information handling system, the trusted platform module configured to store an immutable unique data sanitization key unreadable by external devices; and a remote access controller integrated into the information handling system and configured to perform operations that comprise:
in response to receipt of a digital retirement command configured to cause unreversible loss of access to data, request, from at least two sources independently validated based at least in part on Multi-Factor Authentication (MFA), at least two approvals for execution of the digital retirement command;
upon receipt of the at least two approvals, request on-premise approval, at the information handling system, of the unreversible loss of access to data;
upon receipt of the on-premise approval of the unreversible loss of access to data, authenticate the digital retirement command based at least in part on a disk-on-key (DOK) pair stored in the trusted platform module;
upon authentication of the digital retirement command, initiate a retirement mode of operations by the information handling system;
upon entry to the retirement mode, encrypt all data stored by the information handling system, based at least in part on the immutable unique data sanitization key; and
as part of the retirement mode, incapacitate the trusted platform module such that all data stored by the information handling system is no longer recoverable.

12 . The information handling system of claim 11 , wherein the immutable unique data sanitization key is stored in the trusted platform module at time of manufacture of the information handling system or at time of manufacture of the trusted platform module.

13 . The information handling system of claim 11 , wherein the remote access controller is further configured to verify all data on the information handling system is encrypted successfully, prior to incapacitation of the trusted platform module.

14 . The information handling system of claim 11 , wherein the remote access controller is further configured to incapacitate the trusted platform module by instruction to a power supply of the information handling system to overvolt the trusted platform module.

15 . The information handling system of claim 11 wherein the remote access controller is further configured to:
determine if manual approval of selection of the information handling system for digital retirement is required for digital retirement of the information handling system;
authorize and/or authenticate a third user in response to a determination that manual approval of the selection of the information handling system for digital retirement is required; and
encrypt data on the information hand

Assignees

• Dell Products Lp

Inventors

• Shachar Tomer
• Balin Maxim
• Gehtman Yevgeni

Classifications

• G06F21/60

  Protecting data · CPC title

• H04L9/321 Primary

  involving a third party or a trusted authority · CPC title

• H04L9/0897 Primary

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title