Secure communications between subordinate workspaces and third parties
Systems and methods for secure communications between subordinate workspaces and third parties are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: transmit one or more files received from a workspace orchestration service to a peripheral device, where the one or more files enable the peripheral device to instantiate a subordinate workspace; and facilitate secure communications between the subordinate workspace and a third-party.
1 . An Information Handling System (IHS), comprising:
a processor; and a memory coupled to the processor, the memory configured with program instructions stored thereon that, upon execution by the processor, cause the IHS to:
transmit one or more files received from a workspace orchestration service to a peripheral device, wherein the one or more files comprise a subordinate workspace definition configured to enable the peripheral device to instantiate a subordinate workspace based on the subordinate workspace definition such that the peripheral device is capable to operate the subordinate workspace, wherein the peripheral device is selected from the group consisting of:
a docking station, a display, a projector, a flash drive, a keyboard, a mouse, a trackpad, a joystick, a camera, a microphone, a speaker, a printer, a scanner, a sound card, or a video card, and wherein the peripheral device comprises a processor/controller and a memory; and
facilitate secure communications between the subordinate workspace and a third-party, wherein facilitate the secure communications comprises:
relay, by a primary workspace configured to be executed by the IHS, a telemetry initiation request comprising an identifier and/or certificate from the subordinate workspace to the third-party;
relay, by the primary workspace, a cryptographic or identity challenge comprising a nonce from the third-party to the subordinate workspace;
relay, by the primary workspace, a response to the cryptographic or identity challenge comprising a signed nonce from the subordinate workspace to the third-party; and
after the third-party successfully verifying the signed nonce, enable the subordinate workspace and the third-party to select a key agreement protocol based at least in part on public/private keys for establishment of a secure communication channel to transmit telemetry data collected by the peripheral device to the third-party, wherein cryptographic material used to establish the secure communication channel is unknown to the primary workspace and to the workspace orchestration service.
2 . The IHS of claim 1 , wherein the secure communications utilizes the cryptographic material provisioned by the third-party prior to deployment of the peripheral device.
3 . The IHS of claim 2 , wherein the cryptographic material comprises at least one of: an encryption key pair, or a digital certificate.
4 . The IHS of claim 1 , wherein the third party third-party comprises a manufacturer of the peripheral device.
5 . The IHS of claim 1 , wherein the secure communications comprise the telemetry data collected by the peripheral device.
6 . The IHS of claim 5 , wherein the telemetry data comprises data indicative of use or health of the peripheral device.
7 . The IHS of claim 5 , wherein the program instructions, upon execution, further cause the IHS to transmit at least a modified portion of the telemetry data to the workspace orchestration service.
8 . The IHS of claim 7 , wherein the modified portion of the telemetry data is anonymized or scrubbed of confidential data.
9 . A memory storage device configured with program instructions stored thereon that, upon execution by one or more processors of an Information Handling System (IHS), cause the IHS to:
provision cryptographic material to a peripheral device prior to orchestration by a workspace orchestration service, wherein the peripheral device is configured to execute a subordinate workspace relative to a primary workspace based on a subordinate workspace definition such that the peripheral device is capable of operation of the subordinate workspace, wherein the peripheral device is selected from the group consisting of:
a docking station, a display, a projector, a flash drive, a keyboard, a mouse, a trackpad, a joystick, a camera, a microphone, a speaker, a printer, a scanner, a sound card, or a video card, and wherein the peripheral device comprises a processor/controller and a memory; and
establish a secure communication channel with the subordinate workspace based at least in part on the cryptographic material, wherein establish the secure communication channel comprises:
receive a telemetry initiation request including an identifier and/or certificate;
issue a cryptographic or identity challenge including a nonce;
receive a response to the cryptographic or identity challenge comprising a signed nonce;
verify the signed nonce by the third party; and
in response to successfully verifying the singed nonce, enable the subordinate workspace and the third party to select a key agreement protocol based at least in part on public/private keys to establish the secure communication channel; and
receive data from the subordinate workspace, wherein the data comprises telemetry data transmitted via the secure communication channel, wherein the telemetry data is encrypted, based at least in part, the cryptographic material, and wherein the secure communication channel is unknown to the primary workspace and to the workspace orchestration service.
10 . The memory storage device of claim 9 , wherein the cryptographic material comprises at least one of: an encryption key pair, or a digital certificate.
11 . The memory storage device of claim 9 , wherein the IHS is operated by a manufacturer of the peripheral device.
12 . The memory storage device of claim 9 , wherein the data is indicative of use or health of the peripheral device.
13 . A method, comprising:
receiving one or more files from a primary workspace at a peripheral device, wherein the one or more files comprise a subordinate workspace definition configured to enable the peripheral device to instantiate a subordinate workspace based on the subordinate workspace definition such that the peripheral device is capable of operating the subordinate workspace, wherein the peripheral device is selected from the group consisting of: a docking station, a display, a projector, a flash drive, a keyboard, a mouse, a trackpad, a joystick, a camera, a microphone, a speaker, a printer, a scanner, a sound card, or a video card, and wherein the peripheral device comprises a processor/controller and a memory; and
establishing secure communications between the subordinate workspace and a third-party, wherein establishing the secure communications comprises:
transmitting, by the subordinate workspace, a telemetry initiation request comprising an identifier and/or certificate to the primary workspace for relaying to the third-party;
receiving, by the subordinate workspace from the third-party via the primary workspace, a cryptographic or identity challenge comprising a nonce;
transmitting, by the subordinate workspace to the third-party via the primary workspace, a response to the cryptographic or identity challenge comprising a signed nonce; and
after the third-party successfully verifies the signed nonce, selecting by the subordinate workspace and the third-party a key agreement protocol using public/private keys for establishing a secure communication channel used to transmit telemetry data collected by the peripheral device to the third-party, wherein cryptographic material used to establish the secure communication channel is unknown to the primary workspace.
14 . The method of claim 13 , wherein the secure communications utilize cryptographic material provisioned by the third-party, and wherein the cryptographic material comprises at least one of: an encryption key pair, or a digital certificate.
15 . The method of claim 13 , wherein the third-party comprises a manufacturer of the peripheral device.
16 . The method of claim 13 , wherein the third-party comprises a contributor of the subordinate workspace.
17 . The method of claim 13 , wherein the secure communications comprise data collected by the peripheral device, and wherein the data is indicative of use or health of the peripheral device.