Systems and methods for secure communications for modern workspaces
Systems and methods support workspaces operating on an Information Handling System (IHS), where the workspaces utilize virtualization to operate in isolation from a portion of the hardware and software of the IHS. Resources of the IHS that are available for use by workspaces are registered with an orchestration service that is remote from the IHS and that manages deployment of workspaces on the IHS. A workspace is instantiated on the IHS according to a workspace definition provided by the orchestration service. The orchestration service also provides a handle that allows the workspace to access a particular resource of the IHS, where the handle includes an interface supported by an embedded controller of the IHS for providing access to the IHS resource. The workspace invokes the IHS resource using an interface provided in the handle. The handle thus provides a communication mechanism for workspaces to utilize local resources of the IHS.
1. A method for supporting workspaces operating on an Information Handling System (IHS), the method comprising:
registering a plurality of resources of the IHS with the workspace orchestration service that are available for use by workspaces operating on the IHS, wherein the workspace orchestration service is remote from the IHS and manages deployment of workspaces on the IHS;
instantiating a first workspace according to a workspace definition provided by the workspace orchestration service;
receiving, from the workspace orchestration service, a handle for providing the first workspace with access to a first resource of the plurality of registered IHS resources, wherein the handle comprises an interface supported by an embedded controller that provides remote management of the IHS; wherein the handle supports communications between the first workspace and the embedded controller for providing the first workspace with access to the first resource of the IHS;
invoking, by the first workspace, an operation supported by the first resource of the IHS, wherein the operation is specified by the interface provided in the handle; and
responding, by the embedded controller, to the first workspace with a response to the invoked operation supported by the first resource of the IHS.
2. The method of claim 1 , wherein the handle further comprises a token specifying a duration of the validity of the handle for providing the first workspace with access to the first resource.
3. The method of claim 2 , wherein the handle further comprises one or more conditions for evaluating the validity of the token.
4. The method of claim 3 , wherein the conditions comprise a minimum security score that must be maintained for the handle to remain valid, wherein the security score is determined based on a security context in which the first workspace operations.
5. The method of claim 1 , wherein the interface of the handle comprises an API (Application Programming Interface) for invoking operations supported by the first resource of the IHS.
6. The method of claim 1 , wherein the interface of the handle further comprises an IPC (Inter-Process Communication) resource of the IHS for communications between the first workspace and the embedded controller of the IHS.
7. The method of claim 1 , wherein the first workspace cannot access the first resource of the IHS directly due to isolation of the first workspace from the portion of the hardware and software of the IHS.
8. The method of claim 1 , wherein the embedded controller comprises a remote access controller that support remote management of the IHS.
9. The method of claim 1 , wherein the token is generated by the workspace orchestration service based on a unique identifier of the IHS and based a unique identifier of the first workspace.
10. An Information Handling System (IHS) supporting a plurality of workspaces operating on the IHS, the IHS comprising:
an embedded controller providing remote management of the IHS and comprising a logic unit and a memory storing program instructions that, upon execution by the logic unit, cause the embedded controller to:
register a plurality of resources of the IHS that are available for use by the plurality workspaces, wherein the resources are registered with a remote workspace orchestration service that is remote from the IHS and manages deployment of workspaces on the IHS; and
receive, from the workspace orchestration service, a handle for providing a first workspace with access to a first resource of the plurality of registered IHS resources, wherein the handle wherein the handle supports communications between the first workspace and the embedded controller comprises an interface supported by the embedded controller for providing access to the first resource of the IHS;
one or more processors; and
a memory coupled to the processors, the memory storing program instructions that, upon execution by the processors, cause the IHS to:
instantiate the first workspace according to a workspace definition provided by the workspace orchestration service, wherein the first workspace operates in isolation from other workspaces and from a portion of the hardware and software of the IHS;
receive, from the workspace orchestration service, the handle comprising the interface supported by the embedded controller for providing access to the first resource of the IHS; and
invoke, by the first workspace, an operation supported by the first resource of the IHS as specified by the interface provided in the handle.
11. The IHS of claim 10 , wherein the handle further comprises a token specifying a duration of the validity of the handle for providing the first workspace with access to the first resource.
12. The IHS of claim 11 , wherein the handle further comprises one or more conditions for evaluating the validity of the token.
13. The IHS of claim 11 , wherein the interface of the handle comprises an API (Application Programming Interface) for invoking operations supported by the first resource of the IHS.
14. The IHS of claim 11 , wherein the interface of the handle further comprises an IPC (Inter-Process Communication) resource of the IHS for communications between the first workspace and the embedded controller of the IHS.
15. The IHS of claim 11 , wherein the token is generated by the workspace orchestration service based on a unique identifier of the IHS and based a unique identifier of the first workspace.
16. A system supporting workspaces operating on an Information Handling System (IHS), the system comprising:
a workspace orchestration service that is remote from the IHS and that manages deployment of workspaces on the IHS; and
the IHS comprising:
an embedded controller providing remote management of the IHS and comprising a logic unit and a memory storing program instructions that, upon execution by the logic unit, cause the embedded controller to:
register a plurality of resources of the IHS available for use by the workspaces operating on the IHS with the workspace orchestration service; and
receive, from the workspace orchestration service, a handle that supports communications between a first workspace and the embedded controller and for providing the first workspace with access to a first resource of the plurality of the registered IHS resources;
a processor; and
a memory coupled to the processor, the memory storing program instructions that, upon execution by the processor, cause the IHS to:
instantiate the first workspace according to a workspace definition provided by the workspace orchestration service, wherein the first workspace operates in isolation from other workspaces and from a portion of the hardware and software of the IHS;
receive, from the workspace orchestration service, the handle comprising the interface supported by the embedded controller for providing access to the first resource of the IHS; and
invoke, by the first workspace, an operation supported by the first resource of the IHS as specified by the interface provided in the handle.
17. The system of claim 16 , wherein the handle further comprises a token specifying a duration of the validity of the handle for providing the first workspace with access to the first resource.
18. The system of claim 17 , wherein the handle further comprises one or more conditions for evaluating the validity of the token.
19. The system of claim 16 , wherein the interface of the handle comprises an API (Application Programming Interface) for invoking operations supported by the first resource of the IHS.
20. The system of claim 16 , wherein the interface of the handle further comprises an IPC (Inter-Process Communication) resource of the IHS for communications between the first workspace and the embedded controller of the IHS.