Information handling system (IHS) self-destruction upon unauthorized IHS access

1 . An Information Handling System (IHS) configured to comprise:

a processor; and

a memory coupled to the processor, wherein the memory comprises program instructions stored thereon that, upon execution by the processor, cause the IHS to perform operations that comprise:

detect unauthorized access to the IHS, based, at least in part, upon a blocked period of time in an IHS setup, maintenance, or locked mode, and a hardware chassis breach sensor;

identify one or more types of the unauthorized access to the IHS;

determine a severity level of the unauthorized access to the IHS, based, at least in part, on an identified one or more types of the unauthorized access to the IHS, wherein determination of the severity level comprises application of a machine learning trained decision tree configured with weights on each of a plurality of path nodes that are calculated into an aggregated value determined to indicate the severity level, and wherein the machine learning trained decision tree is deployed to IHSs via factory install or an over-the-air upgrade to keep the machine learning trained decision tree current;

determine a type of self-destruction of the IHS; and

destruct availability of the IHS, by the IHS in accordance with a determined type of self-destruction of the IHS.

2 . The IHS of claim 1 , wherein, upon execution by the processor, the program instructions further cause the IHS to send a notification that the IHS will self-destruct, prior to destruction of availability of the IHS.

3 . The IHS of claim 1 , wherein, upon execution by the processor, the program instructions further cause the IHS to collect evidence of the unauthorized access to the IHS prior to destruction of availability of the IHS, by the IHS.

4 . The IHS of claim 1 , wherein the one or more types of the unauthorized access to the IHS comprise:

unauthorized access to the IHS by an unauthorized person;

unauthorized access to the IHS from an unauthorized location;

unauthorized access to the IHS at an unauthorized time; and

unauthorized access to the IHS via an unauthorized action.

5 . The IHS of claim 4 , wherein the unauthorized access to the IHS by the unauthorized person comprises at least one of:

authentication failure;

a plurality of authentication attempts to the IHS with insufficient permission;

multi-factor authentication failure;

concurrent logins to the IHS from different locations; and

access to the IHS without a proper login.

6 . The IHS of claim 4 , wherein the one or more types of the unauthorized access further comprise at least one of:

unauthorized login to the IHS;

unauthorized access of sensitive data on, or through the IHS;

unauthorized power on of the IHS;

unauthorized power off of the IHS;

unauthorized reset of the IHS;

physical movement of the IHS; and

breach of a hardware chassis of the IHS.

7 . The IHS of claim 1 , wherein, upon execution by the processor, the program instructions further cause the IHS to determine the severity level of the unauthorized access to the IHS based, at least in part, on a pre-defined severity policy to determine a final severity level of the unauthorized access to the IHS, based, at least in part, on an identified determined one or more types of the unauthorized access to the IHS.

8 . The IHS of claim 7 , wherein, the pre-defined severity policy comprises an algorithm, wherein each type of the unauthorized access to the IHS has a pre-defined severity, and, upon execution by the processor, the program instructions further cause the IHS to, upon detection of unauthorized access to the IHS, use a max function to determine the final severity level of the unauthorized access to the IHS.

9 . The IHS of claim 8 , wherein the pre-defined severity policy comprises the machine learning trained decision tree, and wherein, upon execution by the processor, the program instructions further cause the IHS to consider a combination of identified types of the unauthorized access to the IHS, wherein the combination results in a higher severity than each of identified types of the unauthorized access to the IHS alone.

10 . The IHS of claim 9 , wherein the machine learning trained decision tree further comprises multiple paths, based on the identified types of the unauthorized access to the IHS.

11 . The IHS of claim 8 , wherein:

the pre-defined severity policy comprises the algorithm and the machine learning trained decision tree;

each type of the unauthorized access to the IHS has a pre-defined severity; and upon execution by the processor, the program instructions further cause the IHS to:

consider a combination of identified types of the unauthorized access to the IHS, wherein the combination results in a higher severity than each of identified types of the unauthorized access to the IHS alone; and

use a max function to determine the final severity level of the unauthorized access to the IHS, based on the combination.

12 . The IHS of claim 1 , wherein the determined type of self-destruction of the IHS comprises at least one of:

force the IHS to enter a locked mode;

remove one or more licenses to an operating system, software and/or hardware of the IHS;

delete sensitive data on the IHS;

activate one or more mechanisms to short circuit one or more storage devices, integrated circuit chips and boards of the IHS; and

release a destructive chemistry and/or fluid configured to destroy storage devices, integrated circuit chips and boards of the IHS.

13 . The IHS of claim 1 , wherein, upon execution by the processor, the program instructions further cause the IHS to, in response to identification of a type of the unauthorized access to the IHS as a compromise of hardware of the IHS, implement a self-destruction safety prior to destruction of availability of the IHS, to ensure destruction of availability of the IHS.

14 . The IHS of claim 13 , wherein to implement the self-destruction safety comprises at least one of: determine if a location of the IHS is unavailable for a pre-determined period of time, mark the location as not trusted, and start determination of the severity level of the unauthorized access to the IHS, based, at least in part, on the location; determine if the location of the IHS has changed within the pre-determined period of time, mark the location as not trusted, and start determination of the severity level of the unauthorized access to the IHS, based, at least in part, on the location; periodically check a synchronization of an unchangeable hardware-based timer of the IHS; release destructive chemistry and/or fluid to destroy storage devices, integrated circuit chips and boards of the IHS; employ a cellular network and/or satellite message functionality of the IHS to send a notification, by the IHS, that the IHS will self-destruct, prior to destruction of availability of the IHS; and employ the hardware chassis breach sensor to identify the type of the unauthorized access as unauthorized access to the IHS via an unauthorized action.

15 . A method comprising:

detecting, by an Information handling System (IHS), unauthorized access to the IHS, based, at least in part, upon a blocked period of time during an IHS setup, maintenance, or locked mode, and a hardware chassis breach sensor;

identifying, by the IHS, one or more types of the unauthorized access to the IHS;

determining, by the IHS, a severity level of the unauthorized access to the IHS, based, at least in part, on an identified determined one or more types of the unauthorized access to the IHS, wherein determining the severity level comprises applying a machine learning trained decision tree having weights on each of a plurality of path nodes that are calculated into an aggregated value determined to indicate the severity level, and wherein the machine learning trained decision tree is deployed to IHSs via factory install or an over-the-air upgrade to keep the machine learning trained decision tree current;

determining, by the IHS, a type of self-destruction of the IHS; and

destructing availability of the IHS, by the IHS in accordance with a determined type of self-destruction of the IHS.

16 . The method of claim 15 , further comprising at least one of:

collecting evidence of the unauthorized access to the IHS prior to destructing availability of the IHS, by the IHS; and

sending a notification, by the IHS, that the IHS will self-destruct, prior to destructing availability of the IHS, by the IHS.

17 . The method of claim 15 , wherein the one or more types of the unauthorized access to the IHS comprise:

unauthorized access to the IHS by an unauthorized person;

unauthorized access to the IHS from an unauthorized location;

unauthorized access to the IHS at an unauthorized time; and

unauthorized access to the IHS via an unauthorized action.

18 . The method of claim 15 , wherein determining the severity level of the unauthorized access comprises using an algorithm and/or the machine learning trained decision tree, wherein each type of the unauthorized access to the IHS has a pre-defined severity and the method further comprises:

considering a combination of identified types of the unauthorized access to the IHS, wherein the combination results in a higher severity than each of identified types of the unauthorized access to the IHS alone; and/or

using a max function to determine a final severity level of the unauthorized access to the IHS.

19 . The method of claim 15 , further comprising, in response to identifying a type of the unauthorized access to the IHS as a compromise of hardware of the IHS, implementing a self-destruction safety prior to destructing availability of the IHS, to ensure destructing availability of the IHS.

20 . A non-transitory computer-readable storage media configured to store program instructions, that when executed on or across one or more processors of an Information Handling System (IHS), cause the IHS to perform operations that comprise:

detect unauthorized access to the IHS, based, at least in part, upon sensor information captured by an embedded controller (EC) configured to operate from a power plane separate from any IHS host processor, in a blocked period of time in an IHS setup, maintenance, or locked mode, wherein the sensor information comprises information from a hardware chassis breach sensor coupled to the EC via an out-of-band signal pathway;

identify one or more types of the unauthorized access to the IHS;

determine a severity level of the unauthorized access to the IHS, based, at least in part, on an identified one or more types of the unauthorized access to the IHS, wherein determination of the severity level comprises application of a machine learning trained decision tree configured with weights on each of a plurality of path nodes that are calculated into an aggregated value determined to indicate the severity level, and wherein the machine learning trained decision tree is deployed to IHSs via factory install or an over-the-air upgrade to keep the machine learning trained decision tree current;

determine a type of self-destruction of the IHS; and

at least one of:

in response to identification of a type of the unauthorized access to the IHS as a compromise of hardware of the IHS, implement a self-destruction safety to ensure destruction of availability of the IHS;

collect evidence of the unauthorized access to the IHS;

send a notification that the IHS will self-destruct; and

destruct availability of the IHS, by the IHS in accordance with a determined type of self-destruction of the IHS.