Abstract: The technology described herein, which can be incorporated into a bare metal as a service environment, is generally directed towards monitoring retrieving and analyzing security configuration stored on recovery partition storage (e.g., OEM partition drives), which can contain critical logs, error state data, and boot critical security data. A backend security policy engine enforces security context configuration policy data, including to prevent malicious attacks on the backend services. Bare metal in-band compute device health is monitored by an out-of-band network using telemetry data services. When an unrecoverable system state is detected, the out-of-band network activates the recovery partition storage for recording the system sensitive logs, debug data and error states, which is stored as encrypted per security policies. Security policy is enforced, including on system logs, to prevent data tampering and/or malicious attacks. A recovery scenario is performed to restore operation of the compute device.

Abstract: A system can receive an untrusted onboard announcement message from a remote computer, wherein the untrusted onboard announcement message comprises first data that identifies the remote computer and second data that indicates a current configuration of the remote computer. The system can identify a stored indication of an authorized configuration of the remote computer based on the data that identifies the remote computer. The system can determine that there is a mismatch between the authorized configuration of the remote computer and the current configuration of the remote computer. The system can determine a trust metrics evaluation score for the remote computer based on a type of hardware component change between the authorized configuration of the remote computer and the current configuration of the remote computer. The system can, in response to determining that the trust metrics evaluation score is greater than a threshold value, onboard the remote computer.

Abstract: The technology described herein, which can be incorporated into a bare metal as a service environment, is generally directed towards monitoring retrieving and analyzing security configuration stored on recovery partition storage (e.g., OEM partition drives), which can contain critical logs, error state data, and boot critical security data. A backend security policy engine enforces security context configuration policy data, including to prevent malicious attacks on the backend services. Bare metal in-band compute device health is monitored by an out-of-band network using telemetry data services. When an unrecoverable system state is detected, the out-of-band network activates the recovery partition storage for recording the system sensitive logs, debug data and error states, which is stored as encrypted per security policies. Security policy is enforced, including on system logs, to prevent data tampering and/or malicious attacks. A recovery scenario is performed to restore operation of the compute device.

Abstract: A system can receive an untrusted onboard announcement message from a remote computer, wherein the untrusted onboard announcement message comprises first data that identifies the remote computer and second data that indicates a current configuration of the remote computer. The system can identify a stored indication of an authorized configuration of the remote computer based on the data that identifies the remote computer. The system can determine that there is a mismatch between the authorized configuration of the remote computer and the current configuration of the remote computer. The system can determine a trust metrics evaluation score for the remote computer based on a type of hardware component change between the authorized configuration of the remote computer and the current configuration of the remote computer. The system can, in response to determining that the trust metrics evaluation score is greater than a threshold value, onboard the remote computer.