Workspace peripheral access and management policy
Systems and methods for managing workspaces across multiple clients are described. In some embodiments, a Workspace Managing Device (WMD) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the WMD to: receive a request from a client Information Handling System (IHS) to access a peripheral device coupled to the WMD; identify a workspace management policy applicable to at least one of the request, the peripheral device, the client IHS, or a user of the client IHS; and manage access to the peripheral device by the client IHS based upon the workspace management policy.
1 . A Workspace Managing Device (WMD), comprising:
a processor; and
a memory coupled to the processor, the memory configured with program instructions stored thereon that, upon execution, cause the WMD to:
receive a first request from a first client Information Handling System (IHS) to access a peripheral device coupled to the WMD;
receive a second request from a second IHS to access the peripheral device coupled to the WMD;
identify a workspace management policy applicable to at least one of: the first request, the second request, the peripheral device, the first client IHS, the second client IHS, a user of the first client IHS, or a user of the second client IHS;
establish secure communications between (i) a respective WMD agent configured to execute on each of the first client IHS and the second client IHS and (ii) a Workspace Device Manager (WDM) of the WMD based at least in part on one or more key exchange processes or other cryptographic techniques, wherein the WDM comprises a manageability policy and encryption key manager module;
perform, via the secure communications, IHS and/or WMD verification and assertion operations; and
manage access to the peripheral device by the first client IHS and the second client IHS, wherein the WMD allows the first client IHS access to at least one hardware feature of the peripheral device while the WMD denies access by the second client IHS to the at least one hardware feature of the peripheral device based, at least in part, upon the workspace management policy and context information that comprises a proximity of the user of the first client IHS or a proximity of the user of the second client IHS to the WMD.
2 . The WMD of claim 1 , wherein the WMD comprises at least one of a dock or a display, wherein the workspace management policy is received by the dock or the display from a remote service, and wherein the remote service comprises a repository of workspace management policies and IT tools for distribution of such policies to relevant WMDs.
3 . The WMD of claim 1 , wherein to identify the workspace management policy, the program instructions, upon execution, further cause the WMD to select the workspace management policy among a plurality of policies based upon the context information.
4 . The WMD of claim 3 , wherein the context information further comprises at least one of: a type of WMD, a location of the WMD, or a service tag of the WMD.
5 . The WMD of claim 3 , wherein the context information further comprises at least one of: a type of client IHS, a service tag of the client IHS, a posture of the client IHS, an identity of the user of the first client IHS, or an identity of the user of the second client IHS.
6 . The WMD of claim 3 , wherein the context information further comprises an indication of whether the peripheral device is accessible to at least one other client IHS.
7 . The WMD of claim 3 , wherein the context information further comprises a type of workload executed by the first client IHS or the second client IHS.
8 . The WMD of claim 7 , wherein the type of workload comprises at least one of: a software-based container or a hardware-based container.
9 . The WMD of claim 1 , wherein the program instructions, upon execution, further cause the WMD to allow access to a first feature of the peripheral device and to deny access to a second feature of the peripheral device, and wherein at least one of the first or second features comprises at least one of: a network connection or a type of hard drive access operation.
10 . The WMD of claim 1 , wherein the program instructions, upon execution, further cause the WMD to, in response to a determination of whether the first client IHS or the second client IHS is a work IHS or a personal IHS, grant or deny access to the peripheral device.
11 . The WMD of claim 1 , wherein the program instructions, upon execution, further cause the WMD to, in response to a determination of whether the first client IHS or the second client IHS is a work IHS or a personal IHS, provide restricted access to the peripheral device.
12 . The WMD of claim 1 , wherein the peripheral device comprises at least one of: a display, a mouse, a keyboard, a hard drive, a microphone, or a camera.
13 . The WMD of claim 1 , wherein the first request or the second request further comprises a request to access any or all peripheral devices coupled to the WMD, and wherein to manage access to the peripheral device, the program instructions, upon execution, further cause the WMD to select a subset of all peripheral devices coupled to the WMD made at least partially accessible to the first client IHS while the WMD denies access by the second IHS to the selected subset, in response to enforcement of the workspace management policy against the context information.
14 . A non-transitory memory storage device configured with program instructions stored thereon that, upon execution by a first Information Handling System (IHS), cause the first IHS to:
receive a request from a second IHS to access a peripheral device coupled to the first IHS;
manage access to the peripheral device, wherein the first IHS is allowed access to a feature of the peripheral device and the first IHS is configured to deny access by the second IHS to the feature of the peripheral device, based at least in part on a workspace management policy and context information that comprises a proximity of a user of the second IHS to the first IHS, wherein manage access further comprises establish secure communications between (i) a WMD agent executed on the second IHS and (ii) a Workspace Device Manager (WDM) executed on the first IHS based at least in part on one or more key exchange processes or other cryptographic techniques, and wherein the WDM comprises a manageability policy and encryption key manager module; and
perform, via the secure communications, IHS and/or WMD verification and assertion operations, wherein in response to detection of a connection state change indication from the second IHS, the first IHS is configured to select a new workspace management policy determined based on the context information and the state change indication, the state change indication comprising one or more of: a hotkey command, or a hardware modification indication, and wherein in response to the new workspace management policy, the first IHS is configured to allow the second IHS access to the feature of the peripheral device.
15 . The non-transitory memory storage device of claim 14 , wherein the workspace management policy is configured to identify a level of access granted to the second IHS with respect to the peripheral device based upon the context information.
16 . A method, comprising:
receiving, at a Workspace Managing Device (WMD), a workspace management policy;
establishing secure communications between (i) a respective WMD agent executing on each of a plurality of client Information Handling Systems (IHS) and (ii) a Workspace Device Manager (WDM) of the WMD using one or more key exchange processes or other cryptographic techniques, wherein the WDM comprises a manageability policy and encryption key manager module;
performing, via the secure communications, IHS and/or WMD verification and assertion operations; and
managing access to a plurality of peripheral devices by the plurality of client IHSs by the WMD based upon the received workspace management policy that identifies a level of access granted to at least one of the plurality of client IHSs with respect to at least one peripheral device of the plurality of peripheral devices, wherein managing access further comprises allowing access by at least one client IHS of the plurality of client IHSs to a feature of at least one peripheral device of the plurality of peripheral devices based on context information that comprises a proximity of a user to the at least one client IHS of the plurality of client IHSs, and denying access by at least one other client IHS of the plurality of client IHSs to the feature of the at least one peripheral device of the plurality of peripheral devices based on context information that comprises a proximity of at least one other user to the at least one other client IHS of the plurality of client IHSs, wherein in response to receiving a connection state change indication from the at least one other client IHS of the plurality of client IHSs, the WMD selects a new workspace management policy determined based on the proximity of the at least one other user to the at least one other client IHS of the plurality of client IHSs, and wherein in response to the new workspace management policy, the WMD allows access by the at least one other client IHS to the feature of the at least one peripheral device of the plurality of peripheral devices.
17 . The method of claim 16 , wherein the context information comprises an indication of whether a workload executed by the at least one of the plurality of client IHSs comprises a software-based container or a hardware-based container.