Security policy enforcement based on dynamic security context updates

1. An information handling system (IHS), comprising:

a memory having a basic input output system (BIOS), which operates within a secure environment within the IHS;

at least one sensor, which operates within the secure environment to generate security related data for the IHS; and

a controller, which operates within the secure environment, wherein the controller is distinct from, yet operatively coupled to the at least one sensor and the BIOS for communicating information securely there between, and wherein the controller comprises a security policy management engine, which is executable during runtime of the IHS to continuously:

monitor the security related data generated by the at least one sensor;

determine whether the security related data violates at least one security policy rule specified for the IHS, wherein if the security related data violates the at least one security policy rule, the security policy management engine is further executable to:

provide a notification of security policy violation to the BIOS; and

update security context information stored within the BIOS to reflect a particular security violation or a change in a security compliance state.

2. The information handling system as recited in claim 1 , wherein a plurality of security policy rules specified for the IHS are stored within the BIOS or the controller.

3. The information handling system as recited in claim 1 , wherein the at least one sensor is configured to generate security related data in response to at least one of the following:

detecting intrusion into a chassis of the IHS;

detecting corruption of program code or data within the BIOS;

detecting a GPS location of the IHS;

determining a connection state of a USB port included within the IHS;

determining a communication state of a network interface device included within the IHS;

determining a power state of the IHS; and

determining a docking state of the IHS.

4. The information handling system as recited in claim 1 , further comprising at least one input/output (I/O) driver, which operates outside of the secure environment and comprises a security enforcement engine that is executable to:

receive the notification of security policy violation or the updated security context information from the BIOS over a secure communications channel; and

perform at least one security measure upon receiving the notification of security policy violation or the updated security context information.

5. The information handling system as recited in claim 4 , wherein the security enforcement engine is configured to receive the notification of security policy violation immediately in response to the notification being provided to the BIOS.

6. The information handling system as recited in claim 4 , wherein the security enforcement engine is configured to receive the notification of security policy violation from the BIOS in response to a security update request transmitted from the at least one I/O driver to the BIOS over the secure communications channel.

7. The information handling system as recited in claim 6 , wherein the at least one I/O driver transmits the security update request continuously or periodically during runtime of the IHS, or in response to an event detected by the at least one I/O driver.

8. The information handling system as recited in claim 7 , wherein the event comprises at least one of the following:

a request to access or decrypt data stored within a storage medium of the IHS; and

a request to communicate with the IHS via a network.

9. The information handling system as recited in claim 4 , wherein the at least one security measure performed by the security enforcement engine comprises destroying, encrypting or revoking access to a key, which is used by the I/O driver to decrypt encrypted data stored within a storage medium of the IHS, so that the encrypted data cannot be decrypted by the I/O driver.

10. The information handling system as recited in claim 4 , wherein the at least one security measure performed by the security enforcement engine comprises one or more of the following:

disabling one or more input devices of the IHS;

disabling one or more output devices of the IHS; and

disabling at least one of a network interface, a device interface and an optical disc drive to block access to data stored within a storage medium of the IHS.

11. The information handling system as recited in claim 1 , wherein the BIOS, the at least one sensor and the controller are provided on a secure platform of the IHS, which isolates the BIOS, the at least one sensor and the controller from other IHS components and provides a secure environment that is resistant to security attacks.

12. The information handling system as recited in claim 11 , wherein the controller is directly connected to the at least one sensor on the secure platform and configured to receive an unadulterated stream of security related data from the at least one sensor that cannot be changed by malicious software.

13. An information handling system (IHS), comprising:

a memory having a basic input output system (BIOS), which operates within a secure environment within the IHS;

at least one sensor, which operates within the secure environment to generate security related data for the IHS;

a controller coupled between the at least one sensor and the BIOS, wherein the controller operates within the secure environment and comprises a security policy management engine, which is executable during runtime of the IHS to continuously:

monitor the security related data generated by the at least one sensor;

determine whether the security related data violates at least one security policy rule specified for the IHS; and

modify a security compliance state stored within the BIOS to reflect a security violation, if the security related data violates the at least one security policy rule; and

a filter driver, which operates outside of the secure environment and comprises a security enforcement engine that is executable to:

access the security compliance state stored within the BIOS via a secure communications channel connecting the filter driver to the BIOS; and

revoke access to a key used to encrypt and decrypt data, if the security compliance state reflects a security violation.

14. The information handling system as recited in claim 13 , wherein the filter driver further comprises:

a key management unit configured to store the key used to encrypt and decrypt data; and

an encryption/decryption unit configured to use the key to encrypt and decrypt data.

15. The information handling system as recited in claim 14 , wherein if the security compliance state reflects a security violation, the security enforcement engine is configured to revoke access to the key by encrypting the key, thereby preventing the encryption/decryption unit from decrypting encrypted data stored within a storage medium of the IHS.

16. The information handling system as recited in claim 15 , wherein the security enforcement engine is configured to encrypt the key using a public key obtained from a digital certificate provided to the IHS by a certificate authority.

17. The information handling system as recited in claim 16 , wherein the security enforcement engine is configured to send the encrypted key to a key recovery service for decryption with a private key.

18. The information handling system as recited in claim 17 , wherein the security enforcement engine is configured to receive the decrypted key from the key recovery service and configured to store the decrypted key in the key management unit.

19. The information handling system as recited in claim 13 , wherein the security enforcement engine is configured to access the security compliance state stored within the BIOS continuously or periodically during runtime of the IHS.

20. The information handling system as recited in claim 13 , wherein the security enforcement engine is configured to access the security compliance state stored within the BIOS in response to a request detected by the filter driver to access or decrypt data stored within a storage medium of the IHS.

21. A method to enforce security within an information handling system (IHS), the method comprising using a controller operating within a secure environment to:

monitor security related data generated by at least one sensor operating within a secure environment of the IHS;

determine whether the security related data violates at least one security policy rule specified for the IHS;

provide a notification of security policy violation to a basic input/output system (BIOS) of the IHS, if the security related data violates the at least one security policy rule; and

update security context information stored within the BIOS to reflect a particular security violation or a change in a security compliance state, if the security related data violates the at least one security policy rule;

wherein the controller is distinct from, yet operatively coupled to the at least one sensor and the BIOS for communicating information securely there between.

22. The method as recited in claim 21 , further comprising

receiving the notification of security policy violation from the BIOS over a secure communications channel; and

performing at least one security measure upon receiving the notification of security policy violation.

23. The method as recited in claim 22 , wherein:

the steps of monitoring, determining, providing and updating are conducted by a security policy management engine operating within the secure environment of the IHS; and

the steps of receiving and performing are conducted by a security enforcement engine operating outside of the secure environment of the IHS.