Multilevel authorization of workspaces using certificates
Systems and methods provide multilevel authorization of workspaces using certificates, where all of the authorization levels may be authorized separately or may instead be authorized at once. A measurement of an IHS (Information Handling System) is calculated based on the identity of the IHS and based on firmware of the IHS. A measurement of the configuration of the IHS is calculated based on information for configuring the IHS for supporting workspaces and also based on the IHS measurement. A measurement of a workspace session is calculated based on properties of a session used to remotely support operation of the workspace by the IHS and also based on the configuration measurement. Workspace session data may by authorized at all three levels by evaluating the session measurement against a reference session measurement.
1. A method for securing a workspace for providing access to a plurality of managed resources via an IHS (Information Handling System), comprising:
calculating an IHS measurement based on an identity of the IHS and further based on firmware of the IHS;
calculating a configuration measurement based on information for configuring the IHS for operation of a workspace on the IHS and further based on the IHS measurement;
calculating a session measurement based on properties of a session used to remotely support operation of the workspace by the IHS and further based on the configuration measurement; and
validating a workspace session by evaluating the session measurement against a reference session measurement, wherein validation of the workspace session against the reference session measurement also validates the configuration of the IHS for supporting the workspace and also validates the IHS measurement.
2. The method of claim 1 , wherein the reference session value is generated by a remote workspace orchestration service to support deployment and operation of the workspace according to a first workspace definition, wherein the remote workspace orchestration service is remote from the IHS.
3. The method of claim 2 , wherein an updated reference session value is generated by the remote workspace orchestration service to support redeployment of the workspace according to a second workspace definition.
4. The method of claim 1 , further comprising:
validating hardware of the IHS by evaluating the IHS measurement against a reference measurement generated as part of manufacturing the IHS.
5. The method of claim 1 , further comprising:
validating a configuration of the IHS for supporting the workspace by evaluating the configuration measurement against a reference measurement generated as part of a trusted administration of IHS.
6. The method of claim 1 , wherein the session value is further calculated based on a workspace definition associated with the workspace, wherein the workspace definition is generated by a remote workspace orchestration service and specifies software applications that are available within the workspace.
7. The method of claim 1 , wherein the IHS measurement, the configuration measurement and the session measurement are calculated by a local management agent of the IHS, wherein the local management agent interfaces with a remote orchestration services in order for the workspace to be operated on the IHS.
8. An Information Handling System (IHS), comprising:
a processor; and
a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to:
calculate an IHS measurement based on an identity of the IHS and further based on firmware of the IHS;
calculate a configuration measurement based on information for configuring the IHS for operation of a workspace on the IHS and further based on the IHS measurement;
calculate a session measurement based on properties of a session used to remotely support operation of the workspace by the IHS and further based on the configuration measurement; and
validate a workspace session by evaluating the session measurement against a reference session measurement, wherein validation of the workspace session against the reference session measurement also validates the configuration of the IHS for supporting the workspace and also validates the IHS measurement.
9. The IHS of claim 8 , further comprising:
a trusted controller comprising a logic unit and a memory coupled to the logic unit, the memory having program instructions stored thereon that, upon execution by the processor, cause the trusted controller to receive the reference session measurement for attestation of the workspace, IHS and IHS configuration from a secure connection with a remote workspace orchestration service.
10. The IHS of claim 8 , wherein the reference session value is generated by a workspace orchestration service that is remote from the IHS, wherein validation of the session against the reference session value supports deployment and operation of the workspace via the IHS according to a first workspace definition from which the session measurement is calculated.
11. The IHS of claim 10 , wherein an updated reference session value is generated by the remote workspace orchestration service to support redeployment of the workspace via the IHS according to a second workspace definition.
12. The IHS of claim 8 , wherein the memory further comprises program instructions stored thereon that, upon execution by the processor, cause the IHS to:
validate hardware of the IHS by evaluating the IHS measurement against a reference measurement generated as part of manufacturing the IHS.
13. The IHS of claim 8 , wherein the memory further comprises program instructions stored thereon that, upon execution by the processor, cause the IHS to:
validate a configuration of the IHS for supporting the workspace by evaluating the configuration measurement against a reference measurement generated as part of a trusted administration of IHS.
14. The IHS of claim 8 , wherein the session value is further calculated based on a workspace definition that is generated by a remote workspace orchestration service and specifies software applications that are available within the workspace.
15. The IHS of claim 9 , wherein the IHS measurement, the configuration measurement and the session measurement are calculated by the trusted controller.
16. A non-transitory computer-readable storage device having instructions stored thereon for securing a workspace for providing access to a plurality of managed resources via an IHS (Information Handling System), wherein upon execution by one or more processors, the instructions cause the one or more processors to:
calculate an IHS measurement based on an identity of the IHS and further based on firmware of the IHS;
calculate a configuration measurement based on information for configuring the IHS for operation of a workspace on the IHS and further based on the IHS measurement;
calculate a session measurement based on properties of a session used to remotely support operation of the workspace by the IHS and further based on the configuration measurement; and
validate a workspace session by evaluating the session measurement against a reference session measurement, wherein validation of the workspace session against the reference session measurement also validates the configuration of the IHS for supporting the workspace and also validates the IHS measurement.
17. The computer-readable storage device of claim 16 , wherein the computer-readable storage device is a component of a trusted controller that operates in isolation from the operating system of the IHS.
18. The computer-readable storage device of claim 16 , wherein the reference session value is generated by a remote workspace orchestration service that is remote from the IHS, wherein validation of the session against the reference session value supports deployment and operation of the workspace via the IHS according to a first workspace definition.
19. The computer-readable storage device of claim 18 , wherein an updated reference session value is generated by the remote workspace orchestration service to support deployment of the workspace via the IHS according to a second workspace definition.
20. The computer-readable storage device of claim 16 , wherein the session value is further calculated based on a workspace definition associated with the workspace.