Real-time monitoring and policy enforcement of active applications and services
Embodiments of systems and methods for real-time monitoring and policy enforcement of active applications and services are described. In some embodiments, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: provide a hardware-rooted, Operating System (OS)-agnostic resource monitoring agent; receive, at the resource monitoring agent from a remote resource monitoring service via an out-of-band channel, a resource enforcement policy; determine, by the resource monitoring agent, that an application is using or attempting to use a resource in a manner that conflicts with the resource enforcement policy; and stop or prevent the application from using the resource in response to the determination.
1. An Information Handling System (IHS), comprising:
a processor; and
a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to:
provide a hardware-rooted, Operating System (OS)-agnostic resource monitoring agent;
receive a resource enforcement policy at the resource monitoring agent from a remote resource monitoring service using Management Component Transport Protocol (MCTP) communications via a Management Engine (ME) channel;
determine, by the resource monitoring agent, that an application is using or attempting to use a resource in a manner that conflicts with the resource enforcement policy; and
stop or prevent the application from using the resource in response to the determination.
2. The IHS of claim 1 , wherein the processor comprises an Embedded Controller (EC).
3. The IHS of claim 1 , wherein the resource monitoring agent establishes a root-of-trust with a hardware trust module during a boot process.
4. The IHS of claim 3 , wherein the hardware trust module comprises a Trusted Platform Module (TPM).
5. The IHS of claim 1 , wherein the resource enforcement policy comprises a list one or more applications, one or more resources associated with each application, and a restriction associated with each resource.
6. The IHS of claim 5 , wherein the program instructions, upon execution, further cause the IHS to select one of a plurality of resource enforcement policies or restrictions based upon context information.
7. The IHS of claim 6 , wherein the context information comprises at least one of: an identity of a user, a time-of-day, a day-of-the-week, a calendar event, a type of calendar event, an application currently under execution, a duration of execution of an application, a mode of execution of an application, a user's proximity to the IHS, or a user's gaze direction.
8. The IHS of claim 6 , wherein the context information comprises at least one of: a current location of the IHS, a current memory usage, a characteristic of a current network connection, a current power usage, an identification of a currently connected peripheral device, or a current IHS posture.
9. A memory storage device having program instructions stored thereon that, upon execution by one or more processors of an Information Handling System (IHS), cause the IHS to:
provide a hardware-rooted, Operating System (OS)-agnostic resource monitoring agent;
receive a resource enforcement policy at the resource monitoring agent from a remote resource monitoring service using Management Component Transport Protocol (MCTP) communications via a Management Engine (ME) channel;
determine, by the resource monitoring agent, that an application is using or attempting to use a resource in a manner that conflicts with the resource enforcement policy; and
stop or prevent the application from using the resource in response to the determination.
10. The memory storage device of claim 9 , wherein the resource enforcement policy comprises a list one or more applications, one or more resources associated with each application, and a restriction associated with each resource.
11. The memory storage device of claim 10 , wherein the application comprises a video conferencing application, wherein the resource comprises a camera coupled to the IHS, and wherein the restriction comprises a time-of-day or a day-of-the-week that the video conferencing application is allowed to or forbidden from accessing the camera.
12. The memory storage device of claim 10 , wherein the program instructions, upon execution, further cause the IHS to select one of a plurality of resource enforcement policies or restrictions based upon at least one of: a user's proximity to the IHS or a current IHS posture.
13. The memory storage device of claim 10 , wherein the program instructions, upon execution, further cause the IHS to select one of a plurality of resource enforcement policies or restrictions based upon a current location of the IHS.
14. The memory storage device of claim 10 , wherein the program instructions, upon execution, further cause the IHS to select one of a plurality of policies or restrictions based upon: an identity of a user, a time-of-day, a day-of-the-week, a calendar event, a type of calendar event, a user's gaze direction, a current memory usage, a characteristic of a current network connection, a current power usage, an identification of a currently connected peripheral device.
15. A method, comprising:
providing a hardware-rooted, Operating System (OS)-agnostic resource monitoring agent;
receiving a resource enforcement policy at the resource monitoring agent from a remote resource monitoring service using Management Component Transport Protocol (MCTP) communications via a Management Engine (ME) channel;
determining, by the resource monitoring agent, that an application is using or attempting to use a resource in a manner that conflicts with the resource enforcement policy; and
stopping or preventing the application from using the resource in response to the determination.
16. The method of claim 15 , wherein the resource enforcement policy comprises a list one or more applications, one or more resources associated with each application, and a restriction associated with each resource.
17. The method of claim 16 , further comprising selecting one of a plurality of resource enforcement policies or restrictions based upon a user's proximity to the IHS.
18. The method of claim 16 , further comprising selecting one of a plurality of resource enforcement policies based upon a current IHS posture.
19. The method of claim 16 , further comprising selecting one of a plurality of resource enforcement policies based upon a current location of the IHS.