Systems and methods for self-protecting and self-refreshing workspaces
Systems and methods for self-protecting and self-refreshing workspaces are described. In some embodiments, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: receive, from a workspace orchestration service, one or more files or policies configured to enable the client IHS to instantiate a workspace based upon a workspace definition; determine that a context of the client IHS has been modified; in response to the determination, terminate the workspace; and receive, from the workspace orchestration service, one or more files or policies configured to enable the client IHS to re-instantiate the workspace based upon the workspace definition.
1. An Information Handling System (IHS), the IHS comprising:
a processor; and
a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to:
receive, from a workspace orchestration service, one or more files or policies configured to enable the IHS to instantiate a workspace based upon a workspace definition;
derive a key based, at least in part, upon a static portion of the workspace;
encrypt a memory using the key;
derive another key based, at least in part, upon a modified static portion of the workspace;
fail to decrypt the memory using the other key;
in response to the failure, terminate the workspace; and
receive, from the workspace orchestration service, one or more files or policies configured to enable the IHS to re-instantiate the workspace based upon the workspace definition.
2. The IHS of claim 1 , wherein the workspace definition identifies a memory address of the static portion of the workspace.
3. The IHS of claim 1 , wherein the workspace orchestration service is configured to detect a failure event and to receive a copy of a mutable portion of the workspace.
4. The IHS of claim 3 , wherein the program instructions, upon execution, further cause the IHS to receive, from the workspace orchestration service, another copy of the mutable portion of the workspace.
5. The IHS of claim 2 , wherein the static portion of the workspace becomes the modified static portion of the workspace in response to the installation of software in the workspace.
6. The IHS of claim 1 , wherein the static portion of the workspace becomes the modified static portion of the workspace in response to a tampering with intrusion software executed or installed in the workspace.
7. A memory storage device having program instructions stored thereon that, upon execution by an Information Handling System (IHS), cause the IHS to:
receive, from a workspace orchestration service, one or more files or policies configured to enable the IHS to instantiate a workspace based upon a workspace definition;
derive a key based, at least in part, upon a static portion of the workspace;
encrypt a memory using the key;
derive another key based, at least in part, upon a modified static portion of the workspace;
fail to decrypt the memory using the other key;
in response to the failure, terminate the workspace; and
receive, from the workspace orchestration service, one or more files or policies configured to enable the IHS to re-instantiate the workspace based upon the workspace definition.
8. The memory storage device of claim 7 , wherein the workspace definition identifies a memory address of the static portion of the workspace.
9. The memory storage device of claim 7 , wherein the program instructions, upon execution, further cause the IHS to transmit, to the workspace orchestration service, a copy of a mutable portion of the workspace.
10. The memory storage device of claim 9 , wherein the program instructions, upon execution, further cause the IHS to receive, from the workspace orchestration service, another copy of the mutable portion of the workspace.
11. The memory storage device of claim 7 , wherein the static portion of the workspace becomes the modified static portion of the workspace in response to the installation of software in the workspace.
12. The memory storage device of claim 7 , wherein the static portion of the workspace becomes the modified static portion of the workspace in response to a tampering with intrusion software executed or installed in the workspace.
13. A method, comprising:
receiving, from a workspace orchestration service, one or more files or policies configured to enable an Information Handling System (IHS) to instantiate a workspace based upon a workspace definition;
deriving a key based upon a static portion of workspace state;
encrypting memory using the key;
deriving another key based upon a modified static portion of the workspace state;
failing to decrypt the memory using the other key;
in response to the failure, terminating the workspace; and
receiving, from the workspace orchestration service, one or more files or policies configured to enable the IHS to re-instantiate the workspace based upon the workspace definition.
14. The method of claim 13 , wherein the workspace definition identifies a memory address of the static portion of the workspace state.
15. The method of claim 13 , further comprising transmitting, to the workspace orchestration service, a copy of a mutable portion of the workspace state.
16. The method of claim 15 , wherein the program instructions, upon execution, further cause the IHS to receive, from the workspace orchestration service, another copy of the mutable portion of the workspace state.
17. The method of claim 13 , wherein the static portion of the workspace becomes the modified static portion of the workspace in response to the installation of software in the workspace.
18. The method of claim 13 , wherein the static portion of the workspace becomes the modified static portion of the workspace in response to a tampering with intrusion software executed or installed in the workspace.