Abstract: Systems and methods for secure communications between subordinate workspaces and third parties are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: transmit one or more files received from a workspace orchestration service to a peripheral device, where the one or more files enable the peripheral device to instantiate a subordinate workspace; and facilitate secure communications between the subordinate workspace and a third-party.

Abstract: Disclosed systems and methods for securing an information handling system monitor for certain predetermined events, and, upon detecting any one of the predetermined events, requesting ownership data indicative of the authorized or recognized owner. In some embodiments, the ownership data is conveyed via a digital certificate establishing a trusted relationship between the owner and the information handling system. The digital certificate cryptographically associates a manifest of the system's key components and a device identifier such as a service tag.

Abstract: Systems and methods for securely deploying a collective workspace across multiple local management agents are described. In some embodiments, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: receive, at a workspace orchestration service from a first local management agent, first context information and a first split key; receive, at the workspace orchestration service from a second local management agent, second context information and a second split key; determining, by the workspace orchestration service, that the first and second context information match a collaborative workspace policy; in response to the determination, authenticate the first and second split keys; and in response to the authentication, transmit a collaborative workspace definition to the first and second local management agents.

Abstract: Systems and methods that operate an Information Handling System (IHS) support secure telemetry for use in a zero-trust environment. Upon being initialized, the IHS retrieves a factory-provisioned resource locator of a service that provides the location of a policy decision point of the zero-trust environment. The IHS establishes an encrypted session with the policy decision point that is located using the factory-provisioned resource locator. Via the encrypted session, the IHS receives a symmetric key from the policy decision point, where the key may be fleet-wide key for encryption of a customer's telemetry. Telemetry that is generated by the sensors is identified when ready for transmission and encrypted using the symmetric key received from the policy decision point. The customer's encrypted telemetry can then be securely transmitted.

Abstract: Techniques for analyzing risk for devices within a managed environment are described. One example method includes receiving a provisioning request from a device including a device identifier, device credentials, and a current firmware revision, wherein the provisioning request indicates that the device is newly connected to the managed environment; verifying the authenticity of the device based at least in part on the device identifier and the device credentials; verifying that the current firmware revision of the device matches a master firmware revision associated with a type of the device; and determining a risk score associated with the device based at least in part on the device identifier, the device credentials, the current firmware revision of the device, and on whether any known vulnerabilities are associated with the type of the device.

Abstract: A method may include retrieving a media identifier for an item of content to be published, publishing a public key associated with the item of content to a database in order to store the public key in an entry associated with the media identifier, encrypting the media identifier with a private key of a public-private key pair including the public key to generate an encrypted media identifier, and during creation of the item of content, embedding the encrypted media identifier in the item of content.

Abstract: Systems and methods that operate an Information Handling System (IHS) support secure telemetry for use in a zero-trust environment. Upon being initialized, the IHS retrieves a factory-provisioned locator of a service that provides the IHS with a network location of a policy decision point of the zero-trust environment and that provides an encryption key. The IHS identifies telemetry generated by the sensors that is ready for transmission. The IHS transmits the telemetry to a policy information point of the zero-trust environment, where the telemetry includes the factory-provisioned encryption key and also includes the provided network location of the policy decision point. The policy information point uses the network location included in the telemetry and the factory-provisioned encryption key included in the telemetry to establish an encrypted session with the policy decision point. Via the encrypted session, the telemetry is transmitted to the policy decision point.

Abstract: Techniques for secure peripheral management are described. One example method includes detecting that a peripheral device has been connected to the computer system; sending, via a network, a verification request for the peripheral device to a management server identified by a network address stored in a firmware of the peripheral device, wherein the verification request is encrypted based on credentials associated with the peripheral device; receiving, via the network, a verification response from the management server including a policy associated with the peripheral device; determining that the verification response is authentic based on the credentials stored in the firmware of the peripheral device; and in response, operating the peripheral device according to the received policy.

Abstract: Systems and methods for workspace orchestration based on energy scores are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include: a processor; and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: receive, at a local management agent from a workspace orchestration service, one or more files configured to enable the local management agent to instantiate a workspace, where the one or more files are selected or assembled based upon a workspace definition created, at least in part, based upon an energy score; and instantiate the workspace.

Abstract: Computer-based information security techniques are provided that enable a user to reduce and control the amount of personal information digitally supplied to any given service provider when transacting or otherwise interacting with these service providers. Using these techniques, the user can release the minimally required personal information needed for a particular service provider to perform a particular service, without a link to a public identity of the user. Stated differently, only the information that a particular service provider needs in order to complete a service provided by the service provider is conveyed to the service provider based on the user's policy settings. An encryption scheme is used to securely transfer the various portions of personal information to the various service providers.

Abstract: Systems and methods for providing trusted local orchestration of workspaces are described. In some embodiments, an Information Handling System (IHS) may include a processor and a system memory coupled to the processor, the system memory having program instructions stored thereon that, upon execution, cause the IHS to: receive an orchestration code from a workspace orchestration service; record, using a trusted controller coupled to the processor, a log comprising: the orchestration code, and an indication of a sequence of operations performed during an instantiation of a workspace by the local management agent; provide a copy of the log to the workspace orchestration service; and establish a connection between the workspace and the workspace orchestration service in response to the workspace orchestration service's successful: (i) authentication of the orchestration code, and (ii) verification of the sequence of operations.

Abstract: Systems and methods for distributed orchestration using delegate workspaces are described. In an illustrative, non-limiting embodiment, a remote orchestrator with respect to a workspace executed by a client Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the remote orchestrator to: communicate with a database of delegate workspaces, each delegate workspace instantiated by a respective one of a plurality of edge IHSs; and assign a management task with respect to a client IHS's workspace to a delegate workspace executed by a selected edge IHS, where the delegate workspace is selected, at least in part, based upon information stored in the database.

Abstract: A method for securely providing a second user with access to a static facsimile captured by a first user is provided. An embodiment of the method includes receiving an indication, associated with a first user, to capture a static facsimile of digital content; capturing the static facsimile of the digital content in accordance with the indication; determining an encrypted static facsimile by encrypting the static facsimile; and transmitting the encrypted static facsimile and access instructions to an access control device for providing a second user with access to the static facsimile. The access instructions define conditions of the access provided to the second user.

Abstract: Systems and methods for workspace orchestration with ephemeral hardware attestation are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: transmit measurement data from a local management agent to a workspace orchestration service; receive, at the local management agent in response to attestation of the measurement data by the workspace orchestration service, a workspace definition configured to enable the local management agent to instantiate a workspace; and instantiate the workspace.

Abstract: Systems and methods for secure communications between subordinate workspaces and third parties are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: transmit one or more files received from a workspace orchestration service to a peripheral device, where the one or more files enable the peripheral device to instantiate a subordinate workspace; and facilitate secure communications between the subordinate workspace and a third-party.

Abstract: Systems and methods for bi-directional attestation for workspace orchestrators are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: receive, from a workspace orchestrator, a request to attest a workspace component within a workspace instantiated by a client IHS; send an indication of the request to an attester within the workspace component; and receive attestation evidence from the attester, where the attestation evidence is signed with an attestation key.

Abstract: An information handling system may receive, from a first sensor of the information handling system, content to be associated with a semantic cryptographic fingerprint. The first information handling system may also receive, from the first sensor context data contains information about time and date, geolocation coordinates, metadata, etc. Based, at least in part, on the semantic cryptographic fingerprint and the context data, the information handling system may determine a cryptographic tag. The information handling system may sign the cryptographic hash with a private key. Finally, the information handling system may then publish the cryptographic hash with an indicator of the content to a public database or directory.

Abstract: Systems and methods for third-party evaluation of workspace orchestration services are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: evaluate a workspace orchestration service based, at least in part, upon (i) anonymized orchestration data received from the workspace orchestration service, and (ii) synthetic user data produced based, at least in part, upon user data and notify an Information Technology Decision Maker (ITDM) of the evaluation.

Abstract: Computer-based information security techniques are provided that enable a user to reduce and control the amount of personal information digitally supplied to any given service provider when transacting or otherwise interacting with these service providers. Using these techniques, the user can release the minimally required personal information needed for a particular service provider to perform a particular service, without a link to a public identity of the user. Stated differently, only the information that a particular service provider needs in order to complete a service provided by the service provider is conveyed to the service provider based on the user's policy settings. An encryption scheme is used to securely transfer the various portions of personal information to the various service providers.

Abstract: An information handling system may receive, from a first sensor of the information handling system, first sensor data. The information handling system may receive, from a second sensor of the information handling system, second sensor data. Based, at least in part, on the first sensor data and the second sensor data, the information handling system may generate a plurality of security profiles for the information handling system. Based, at least in part, on the first sensor data and the second sensor data, the information handling system may apply a security profile of the plurality of security profiles to the information handling system.