Method for configuring device resources based on network identification and system therefor
A method for configuring resources at an information handling system may include determining, during initialization, a wide area network (WAN) Internet Protocol (IP) address associated with the information handling system, and retrieving a list of trusted IP addresses from a storage location at the information handling system. The method may further include configuring a first resource at the information handling system to operate in a first state in response to determining that the WAN IP address is included at the list of trusted IP addresses, and configuring the first resource at the information handling system to operate in a second state in response to determining that the WAN IP address is not included at the list of trusted IP addresses.
1. A method comprising:
initializing operation of an information handling system by executing basic input/output system (BIOS) firmware; and
during a boot device selection (BDS) phase of the initializing operation and prior to handing control of the information handling system to an operating system:
determining a wide area network (WAN) Internet Protocol (IP) address associated with the information handling system;
retrieving a list of trusted IP addresses from a storage location at the information handling system in response to determining that the WAN IP address associated with the information handling system is not a local IP address;
configuring a first resource at the information handling system to operate in a first state in response to determining that the WAN IP address is included at the list of trusted IP addresses; and
configuring the first resource to operate in a second state according to policy information based on the WAN IP address in response to determining that the WAN IP address is not included at the list of trusted IP addresses, the second state different than the first state.
2. The method of claim 1 , wherein the policy information is stored at the information handling system, the policy information identifying a configuration of one or more resources at the information handling system in response to determining that the WAN IP address is not included at the list of trusted IP addresses.
3. The method of claim 1 , wherein the first resource is a network interface controller, and wherein the first state is a fully operational configuration and the second state is a disabled configuration.
4. The method of claim 1 , wherein the first resource is a universal serial bus controller, and wherein the first state is a fully operational configuration and the second state is a disabled configuration.
5. The method of claim 1 , wherein the first resource is an interface to update the BIOS firmware, and wherein the interface is enabled in the first state and disabled in the second state.
6. The method of claim 1 , wherein the first resource is a BIOS recovery mechanism, and wherein the BIOS recovery mechanism is enabled in the first state and disabled in the second state.
7. The method claim 1 , further comprising revoking security credentials in response to determining that the WAN IP address is not included at the list of trusted IP addresses.
8. The method claim 1 , further comprising retrieving an interface control policy stored at the information handling system in response to determining that the WAN IP address is not included at the list of trusted IP addresses.
9. The method of claim 1 , further comprising sending a message to an Intel Management Engine, the message indicating that the WAN IP address is not included at the list of trusted IP addresses.
10. The method of claim 1 , further comprising configuring the first resource to operate in the first state if the WAN IP address is not included at the list of trusted IP addresses in response to receiving override authorization from an information technology system administrator.
11. The method of claim 1 , further comprising restricting boot of the information handling system to a software assembly retrieved from a Preboot Execution Environment network server in response to determining that the WAN IP address is not included at the list of trusted IP addresses.
12. The method of claim 1 , further comprising blocking network boot of the information handling system in response to determining that the WAN IP address is not included at the list of trusted IP addresses.
13. The method of claim 1 , further comprising notifying system administration personnel in response to determining that the WAN IP address is not included at the list of trusted IP addresses.
14. An information handling system comprising:
a basic input/output system (BIOS); and
a processor to execute instructions included at the BIOS, the instructions to:
initialize operation of the information handling system;
determine a wide area network (WAN) Internet Protocol (IP) address associated with the information handling system;
retrieve a list of trusted IP addresses from a storage location at the information handling system in response to determining that the WAN IP address associated with the information handling system is not a local IP address;
configure a first resource at the information handling system to operate in a first state in response to determining that the WAN IP address is included at the list of trusted IP addresses; and
configure the first resource to operate in a second state according to policy information based on the WAN IP address in response to determining that the WAN IP address is not included at the list of trusted IP addresses, the second state being different than the first state.
15. The information handling system of claim 14 , wherein the policy information stored at the information handling system, the policy information identifying a configuration of one or more resources at the information handling system in response to determining that the WAN IP address is not included at the list of trusted IP addresses.
16. The information handling system of claim 14 , wherein the first resource is a network interface controller, and wherein the first state is a fully operational configuration and the second state is a disabled configuration.
17. The information handling system of claim 14 , wherein the first resource is an interface to update a BIOS firmware, and wherein the interface is enabled in the first state and disabled in the second state.
18. A method comprising:
determining, during a boot device selection (BDS) phase of an initialization operation of an information handling system, a wide area network (WAN) Internet Protocol (IP) address associated with a network interface controller at the information handling system;
retrieving a list of trusted IP addresses from a storage location at the information handling system, in response to determining that the WAN IP address associated with the information handling system is not a local IP address;
enabling operation of a first resource of the information handling system in response to determining that the WAN IP address is included at the list of trusted IP addresses; and
disabling operation of the first resource according to policy information based on the WAN IP address in response to determining that the WAN IP address is not included at the list of trusted IP addresses.
19. The method of claim 18 , wherein the first resource is identified by an interface control policy stored at the information handling system.
20. The method of claim 18 , wherein the first resource is the network interface controller, and wherein a first state is a fully operational configuration and a second state is a disabled configuration.