Systems and methods for managing operations of data processing systems based on geolocation tracking
Methods and systems for managing operation of a data processing system are disclosed. To manage operation of the data processing system, a management controller of the data processing system may obtain location data for the data processing system and trusted device(s) using an out-of-band communication channel and determine a distance between the data processing system and trusted device(s). Based on the determined distance, the management controller may identify a security policy that may regulate operation of the data processing system by performing an action set to update operations of the data processing system.
1 . A method for managing operations of a data processing system, the method comprising:
obtaining, by a management controller of the data processing system and via an out-of-band communication channel, first location data for the data processing system, the management controller being a first computing device that is physically installed in and operates independently from a second computing device configured as the data processing system;
obtaining, by the management controller and via the out-of-band communication channel, second location data for an auxiliary device;
obtaining, by the management controller, a distance between the data processing system and the auxiliary device using the first location data and the second location data;
identifying, by the management controller, a first security policy from among a plurality of security policies that regulate the operations of the data processing system, the first security policy being identified based at least in part on the distance; and
performing, by at least the management controller, an action set specified by the first security policy to update the operations of the data processing system.
2 . The method of claim 1 , wherein the plurality of security policies indicate increasing levels of restriction on the operations of the data processing system as a function of the distance.
3 . The method of claim 2 , wherein each of the plurality of security policies defines:
a threshold for comparison to the distance that when met indicates that the data processing system is subject to one among the plurality of security policies.
4 . The method of claim 1 , wherein the action set comprises:
obscuring at least a portion of information displayed on a display by the data processing system to prevent unauthorized access to the portion of the information.
5 . The method of claim 1 , wherein the action set comprises:
initiating a system level lock to user access of the data processing system, the system level lock requiring that a user re-enter at least a portion of previously provided security information to regain use of the data processing system.
6 . The method of claim 1 , wherein the action set comprises:
at least temporarily suspending the operations of the data processing system.
7 . The method of claim 1 , further comprising:
obtaining third location data for a third device, the third device being a trusted device by the data processing system,
wherein the first security policy is keyed to both the distance and the third location data.
8 . The method of claim 7 , wherein the action set comprises:
issuing, by the data processing system, a security alert for the third device.
9 . The method of claim 1 , wherein the first location data and the second location data are provided to the management controller by a network module of the data processing system via the out-of-band communication channel, the network module being a sole network module of the data processing system that is shared by the management controller and hardware resources of the data processing system.
10 . The method of claim 9 , wherein the network module is adapted to separately advertise network endpoints for the management controller and the hardware resources of the data processing system, the network endpoints being usable by a server to separately address first communications by the server to the hardware resources using an in-band communication channel and second communications by the server to the management controller using the out-of-band communication channel.
11 . The method of claim 10 , wherein the management controller and the network module are on separate power domains from the hardware resources so that the management controller and the network module are operable while the hardware resources are inoperable.
12 . The method of claim 10 , wherein the out-of-band communication channel runs through the network module, and the in-band communication channel that services the hardware resources also runs through the network module.
13 . The method of claim 10 , wherein the network module hosts a transmission control protocol/internet protocol (TCP/IP) stack to facilitate network communications via the out-of-band communication channel.
14 . A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform first operations for managing second operations of a data processing system, the first operations comprising:
obtaining, by a management controller of the data processing system and via an out-of-band communication channel, first location data for the data processing system, the management controller being a first computing device that is physically installed in and operates independently from a second computing device configured as the data processing system;
obtaining, by the management controller and via the out-of-band communication channel, second location data for an auxiliary device;
obtaining, by the management controller, a distance between the data processing system and the auxiliary device using the first location data and the second location data;
identifying, by the management controller, a first security policy from among a plurality of security policies that regulate the second operations of the data processing system, the first security policy being identified based at least in part on the distance; and
performing, by at least the management controller, an action set specified by the first security policy to update the second operations of the data processing system.
15 . The non-transitory machine-readable medium of claim 14 , wherein the plurality of security policies indicate increasing levels of restriction on the second operations of the data processing system as a function of the distance.
16 . The non-transitory machine-readable medium of claim 15 , wherein each of the plurality of security policies defines:
a threshold for comparison to the distance that when met indicates that the data processing system is subject to one among the plurality of security policies.
17 . The non-transitory machine-readable medium of claim 14 , wherein the action set comprises:
obscuring at least a portion of information displayed on a display by the data processing system to prevent unauthorized access to the portion of the information.
18 . A data processing system, comprising:
a processor; and
a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform first operations for managing second operations of a data processing system, the first operations comprising:
obtaining, by a management controller of the data processing system and via an out-of-band communication channel, first location data for the data processing system, the management controller being a first computing device that is physically installed in and operates independently from a second computing device configured as the data processing system;
obtaining, by the management controller and via the out-of-band communication channel, second location data for an auxiliary device;
obtaining, by the management controller, a distance between the data processing system and the auxiliary device using the first location data and the second location data;
identifying, by the management controller, a first security policy from among a plurality of security policies that regulate the second operations of the data processing system, the first security policy being identified based at least in part on the distance; and
performing, by at least the management controller, an action set specified by the first security policy to update the second operations of the data processing system.
19 . The data processing system of claim 18 , wherein the plurality of security policies indicate increasing levels of restriction on the second operations of the data processing system as a function of the distance.
20 . The data processing system of claim 19 , wherein each of the plurality of security policies defines:
a threshold for comparison to the distance that when met indicates that the data processing system is subject to one among the plurality of security policies.