# US 12,223,059 B2 · Systems and methods for vulnerability proofing when configuring an IHS > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,059 B2 - Document ID: US12223059B2 - Status: Granted - Kind: B2 - Application number: 18/048,469 - Filed: 2022-10-21 - Published: 2024-04-25 - Granted: 2025-02-11 - Earliest claimed: 2022-10-21 - Assignees: Dell Products L.P. - Applicants: Dell Products, L.P. - Inventors: Raveendra Babu Madala; Santosh Gore - Web page: https://patentgrep.com/patent/US12223059B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods are provided for vulnerability proofing the launching of application instances by an IHS (Information Handling System). The launching of an application instance on the IHS is detected, where the application instance is launched using an application template that includes configurations for one or more hardware components of the IHS. One or more catalogs are accessed that specify known vulnerabilities of hardware components. Hardware component configurations included in the application template are identified as vulnerable in one or more of the catalogs. If the application template includes configurations that are identified as vulnerable in the catalogs, launching of the application is prevented until the hardware component configurations within the application template are modified to include no configurations with vulnerabilities identified in the catalogs. ## Claims ### Claim 1 An IHS (Information Handling System) comprising: one or more CPUs utilizing one or more buses that connect to a plurality of hardware components of the IHS; and a remote access controller supporting remote management of the Information Handling System (IHS), the remote access controller comprising a logic unit and a memory device having instructions stored thereon that, upon execution by the logic unit, cause the remote access controller to: detect an application instance being launched using an application template comprising configurations for one or more of the plurality of hardware components of the IHS; access a plurality of catalogs specifying known vulnerabilities of hardware components; determine whether any of the one or more of the hardware component configurations in the application template are identified as vulnerable in one or more of the catalogs; and prevent launching of the application until the hardware component configurations within the application template are modified to include no configurations with vulnerabilities identified in the plurality of catalogs. ### Claim 2 (depends on 1) The IHS of claim 1, wherein the plurality of catalogs comprise a catalog of hardware component vulnerabilities known to a manufacturer of the IHS. ### Claim 3 (depends on 1) The IHS of claim 1, wherein the application template further comprises one or more software configurations. ### Claim 4 (depends on 1) The IHS of claim 1, wherein execution of the instructions further causes the remote access controller to identify one or more vulnerability proofing requirements for the application template within a factory provisioned identity certificate of the IHS. ### Claim 5 (depends on 4) The IHS of claim 4, wherein the factory-provisioned identity certificate comprises digital signatures for authenticating instructions used by one or more of the hardware components of the IHS. ### Claim 6 (depends on 4) The IHS of claim 4, wherein the validation proofing requirements in the identity certificate further specify the plurality of catalogs of known vulnerabilities for use in identifying hardware component configurations that are vulnerable. ### Claim 7 (depends on 1) The IHS of claim 1, wherein the application template comprises configurations for operation of a virtual machine on the IHS. ### Claim 8 (depends on 1) The IHS of claim 1, wherein the hardware component configurations of the application template specify use of a firmware version by a first of the hardware components of the IHS. ### Claim 9 (depends on 8) The IHS of claim 8, wherein the vulnerability catalogs specify alternate firmware versions that are used to operate the first of the hardware components and that are not associated with known vulnerabilities. ### Claim 10 (depends on 1) The IHS of claim 1, wherein execution of the instructions further causes the remote access controller to, when vulnerabilities are identified in the hardware component configurations in the application template, identify one or more application instances that are already running on the IHS and that were launched using the application template in which the vulnerabilities have been identified. ### Claim 11 (depends on 10) The IHS of claim 10, wherein execution of the instructions further causes the remote access controller to halt the one or more application instances that are already running on the IHS and that were launched using the application template in which the vulnerabilities have been identified. ### Claim 12 A method for vulnerability proofing the launching of application instances by an IHS (Information Handling System), wherein the vulnerability proofing is implemented by a remote access controller of the IHS that provides remote management of the IHS, the method comprising: detecting an application instance being launched using an application template comprising configurations for one or more of the plurality of hardware components of the IHS; accessing a plurality of catalogs specifying known vulnerabilities of hardware components; determining whether any of the one or more of the hardware component configurations in the application template are identified as vulnerable in one or more of the catalogs; and preventing launching of the application until the hardware component configurations within the application template are modified to include no configurations with vulnerabilities identified in the plurality of catalogs. ### Claim 13 (depends on 12) The method of claim 12, wherein the plurality of catalogs comprise a catalog of hardware component vulnerabilities known to a manufacturer of the IHS. ### Claim 14 (depends on 12) The method of claim 12, wherein the application template further comprises one or more software configurations. ### Claim 15 (depends on 12) The method of claim 12, further comprising identifying one or more vulnerability proofing requirements for the application template within a factory provisioned identity certificate of the IHS. ### Claim 16 (depends on 15) The method of claim 15, wherein the validation proofing requirements in the identity certificate further specify the plurality of catalogs of known vulnerabilities for use in identifying hardware component configurations that are vulnerable. ### Claim 17 (depends on 12) The method of claim 12, further comprising, when vulnerabilities are identified in the hardware component configurations in the application template, identifying one or more application instances that are already running on the IHS and that were launched using the application template in which the vulnerabilities have been identified. ### Claim 18 (depends on 17) The method of claim 17, further comprising halting the one or more application instances that are already running on the IHS and that were launched using the application template in which the vulnerabilities have been identified. ### Claim 19 A remote access controller supporting remote management of an Information Handling System (IHS), the remote access controller comprising a memory device having instructions stored thereon that, upon execution by a logic unit, cause the remote access controller to: detect an application instance being launched using an application template comprising configurations for one or more of the plurality of hardware components of the IHS; access a plurality of catalogs specifying known vulnerabilities of hardware components; determine whether any of the one or more of the hardware component configurations in the application template are identified as vulnerable in one or more of the catalogs; and prevent launching of the application until the hardware component configurations within the application template are modified to include no configurations with vulnerabilities identified in the plurality of catalogs. ### Claim 20 (depends on 19) The remote access controller of claim 19, wherein the plurality of catalogs comprise a catalog of hardware component vulnerabilities known to a manufacturer of the IHS.