# US 12,003,652 B2 · Geographic restrictions for information handling systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,652 B2
- Document ID: US12003652B2
- Status: Granted
- Kind: B2
- Application number: 17/508,942
- Filed: 2021-10-22
- Published: 2023-04-27
- Granted: 2024-06-04
- Earliest claimed: 2021-10-22
- Assignees: Dell Products L.P.
- Applicants: Dell Products, L.P.
- Inventors: Marshal F. Savage; Jason Matthew Young; Mukund P. Khatri
- Web page: https://patentgrep.com/patent/US12003652B2

## CPC

- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- G01S 19/14: specially adapted for specific applications
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/126: {the source of the received data}
- H04L 67/52: specially adapted for the location of the user terminal
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G01S: RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES

## Abstract

Systems and procedures are provided for enforcing geographic restrictions on the operation of an IHS (Information Handling System). During factory provisioning of the IHS, a signed inventory certificate is uploaded to the IHS that specifies a plurality of allowed geographic locations at which the IHS is operational. Upon delivery and initial powering of the IHS, a validation environment is instantiated and further initialization of the IHS is halted until a location of the IHS can be determined. Once a geographic location of the IHS has been determined, it is compared to the allowed geographic locations from the inventory certificate stored during factory provisioning. When the location of the IHS is not at an allowed geographic location specified in the inventory certificate, the IHS is rendered non-operational. When the location of the IHS is at an allowed geographic location specified in the inventory certificate, further initialization of the IHS is enabled.

## Claims

### Claim 1

A method for enforcing geographic restrictions on the operation of an IHS (Information Handling System), the method comprising:
upon initialization of the IHS, retrieving an inventory certificate uploaded to the IHS during factory provisioning of the IHS, wherein the inventory certificate specifies a plurality of allowed geographic locations at which the IHS is operational, and wherein the inventory certificate is a public key identity certificate generated by an embedded controller of the IHS in response to a CSR (Certificate Signing Request) generated by the IHS during the factory provisioning of the IHS;
halting further initialization of the IHS by the embedded controller until a location of the IHS can be determined and compared to the geographic locations from the inventory certificate;
determining a location of the IHS;
when the location of the IHS is not at an allowed geographic location specified in the inventory certificate, rendering the IHS non-operational by the embedded controller; and
when the location of the IHS is at an allowed geographic location specified in the inventory certificate, enabling further initialization of the IHS.

### Claim 2 (depends on 1)

The method of claim 1, wherein the allowed geographic locations are specified by a customer for which the IHS has been factory-provisioned.

### Claim 3 (depends on 1)

The method of claim 1, wherein the allowed geographic locations comprise a plurality of GPS (Global Positioning System) locations.

### Claim 4 (depends on 1)

The method of claim 1, wherein the location of the IHS is based on queries made by a remote access controller of the IHS.

### Claim 5 (depends on 1)

The method of claim 1, wherein the rendering of the IHS as non-operational comprises disabling one or more hardware components of the IHS.

### Claim 6 (depends on 1)

The method of claim 1, wherein the rendering of the IHS as non-operational comprises permanently deleting cryptographic information encoded by the IHS.

### Claim 7 (depends on 6)

The method of claim 6, wherein the cryptographic information is permanently deleted by blowing all fuses used to encode the cryptographic information.

### Claim 8 (depends on 1)

The method of claim 1, wherein the inventory certificate further comprises an inventory of factory-installed hardware components of the IHS.

### Claim 9 (depends on 8)

The method of claim 8, wherein, when further initialization of the IHS is enabled, the inventory of factory-installed hardware components is compared to detected hardware components of the IHS in order to in order to validate the detected hardware components of the IHS as the same hardware components installed during factory assembly of the IHS.

### Claim 10

An IHS (Information Handling System) comprising:
a persistent memory, wherein during factory provisioning of the IHS an inventory certificate is uploaded to the persistent memory, wherein the inventory certificate specifies a plurality of allowed geographic locations at which the IHS is operational, and wherein the inventory certificate is a public key identity certificate generated by an embedded controller of the IHS in response to a CSR (Certificate Signing Request) generated by the IHS during the factory provisioning of the IHS;
the embedded controller;
one or more processors; and
one or more memory devices coupled to the processors, the memory devices storing computer-readable instructions that, upon execution by the processors, cause the IHS to:
upon initialization of the IHS, retrieve the inventory certificate stored to the persistent memory during factory provisioning of the IHS;
halt further initialization of the IHS by the embedded controller until a location of the IHS can be determined and compared to the geographic locations from the inventory certificate;
determine a location of the IHS;
when the location of the IHS is not at an allowed geographic location specified in the inventory certificate, render the IHS non-operational by the embedded controller; and
when the location of the IHS is at an allowed geographic location specified in the inventory certificate, enable further initialization of the IHS.

### Claim 11 (depends on 10)

The IHS of claim 10, wherein the allowed geographic locations are specified by a customer for which the IHS has been factory-provisioned.

### Claim 12 (depends on 10)

The IHS of claim 10, wherein the allowed geographic locations comprise a plurality of GPS (Global Positioning System) locations.

### Claim 13 (depends on 10)

The IHS of claim 10, wherein the location of the IHS is based on queries made by a remote access controller of the IHS.

### Claim 14 (depends on 10)

The IHS of claim 10, wherein the rendering of the IHS as non-operational comprises disabling one or more hardware components of the IHS.

### Claim 15 (depends on 10)

The IHS of claim 10, wherein the rendering of the IHS as non-operational comprises permanently deleting cryptographic information encoded by the IHS.

### Claim 16

A computer-readable storage device having instructions stored thereon for enforcing geographic restrictions on the operation of an IHS (Information Handling System), wherein execution of the instructions by one or more processors of the IHS causes a validation process of the IHS to:
upon initialization of the IHS, retrieve an inventory certificate uploaded to the IHS during factory provisioning of the IHS, wherein the inventory certificate specifies a plurality of allowed geographic locations at which the IHS is operational, and wherein the inventory certificate is a public key identity certificate generated by an embedded controller of the IHS in response to a CSR (Certificate Signing Request) generated by the IHS during the factory provisioning of the IHS;
halt further initialization of the IHS by the embedded controller until a location of the IHS can be determined and compared to the geographic locations from the inventory certificate;
determine a location of the IHS;
when the location of the IHS is not at an allowed geographic location specified in the inventory certificate, render the IHS non-operational by the embedded controller; and
when the location of the IHS is at an allowed geographic location specified in the inventory certificate, enable further initialization of the IHS.

### Claim 17 (depends on 16)

The storage device of claim 16, wherein the allowed geographic locations are specified by a customer for which the IHS has been factory-provisioned.

### Claim 18 (depends on 16)

The storage device of claim 16, wherein the allowed geographic locations comprise a plurality of GPS (Global Positioning System) locations.

### Claim 19 (depends on 18)

The storage device of claim 18, wherein the rendering of the IHS as non-operational comprises disabling one or more hardware components of the IHS.

### Claim 20 (depends on 16)

The storage device of claim 16, wherein the rendering of the IHS as non-operational comprises permanently deleting cryptographic information encoded by the IHS.