Security policy enforcement based on dynamic security context updates

An information handling system (IHS), comprising:

• a memory having a basic input output system (BIOS), which operates within a secure environment within the IHS;
• at least one sensor, which operates within the secure environment to generate security related data for the IHS;
• a controller coupled between the at least one sensor and the BIOS, wherein the controller operates within the secure environment and comprises a security policy management engine, which is executable during runtime of the IHS to continuously:
• monitor the security related data generated by the at least one sensor;
• determine whether the security related data violates at least one security policy rule specified for the IHS;
• and
• modify a security compliance state stored within the BIOS to reflect a security violation, if the security related data violates the at least one security policy rule;
• and
• a filter driver, which operates outside of the secure environment and comprises a security enforcement engine that is executable to:
• access the security compliance state stored within the BIOS via a secure communications channel connecting the filter driver to the BIOS;
• and
• revoke access to a key used to encrypt and decrypt data, if the security compliance state reflects a security violation.

A method to enforce security within an information handling system (IHS), the method comprising using a controller operating within a secure environment to:

• monitor security related data generated by at least one sensor operating within a secure environment of the IHS;
• determine whether the security related data violates at least one security policy rule specified for the IHS;
• provide a notification of security policy violation to a basic input/output system (BIOS) of the IHS, if the security related data violates the at least one security policy rule;
• and
• update security context information stored within the BIOS to reflect a particular security violation or a change in a security compliance state, if the security related data violates the at least one security policy rule;
• wherein the controller is distinct from, yet operatively coupled to the at least one sensor and the BIOS for communicating information securely there between.