US 12,592,820 B2Granted

Systems and methods for digital retirement of information handling systems

AssigneeDell Products L.P.

InventorsTomer Shachar, Maxim Balin, Yevgeni Gehtman

Life of this patent

Estimating the term…

Loading patent…

Abstract

Digital retirement of an IHS may include encrypting, by the IHS, data on the IHS, using an encryption key stored in a trusted platform module (TPM) of the IHS, and incapacitating the TPM. This encryption key may be a (unique (256-bit encryption)) data sanitization key stored protected inside the TPM, thereby, the encryption key is protected inside the TPM by being immutable and unreadable by external devices. Digital retirement of the IHS may also include verifying all data on the IHS is encrypted successfully, prior to incapacitating the TPM. Incapacitation of the TPM may be carried out by instructing a power supply of the IHS to overvolt the TPM. Digital retirement of the IHS may be carried out in response to receipt of a digital retirement command that has been authorized and/or authenticated through two users and may be further manually approved by a third authorized and/or authenticated user.

Claims20

Dependent claims

A method for digital retirement of an information handling system, comprising:

providing a user of the information handling system with of access to data stored by the information handling system;
upon receipt of a digital retirement command configured to cause unreversible loss of access to data, requesting, from at least two sources independently validated based at least in part on Multi-Factor Authentication (MFA), at least two approvals for executing the digital retirement command;
upon receipt of the at least two approvals, requesting on-premise approval, at the information handling system, of the unreversible loss of access to data;
upon receipt of the on-premise approval of the unreversible loss of access to data, authenticating the digital retirement command based at least in part on a disk-on-key (DOK) pair stored in a trusted platform module of the information handling system;
upon authentication of the digital retirement command, initiating a retirement mode of operations by the information handling system;
upon entering the retirement mode, encrypting, by the information handling system, all data stored by the information handling system, using an encryption key stored in the trusted platform module;
and
as part of the retirement mode, incapacitating the trusted platform module such that all data stored by the information handling system is no longer recoverable.

5 more elements

An information handling system that comprises:

one or more processors;
one or more memory devices coupled to the one or more processors, wherein the one or more memory devices comprise stored computer-readable instructions that, upon execution by the one or more processors, cause an operating system to provide applications for access to data stored by the information handling system;
a trusted platform module incorporated into the information handling system, the trusted platform module configured to store an immutable unique data sanitization key unreadable by external devices;
and
a remote access controller integrated into the information handling system and configured to perform operations that comprise:
in response to receipt of a digital retirement command configured to cause unreversible loss of access to data, request, from at least two sources independently validated based at least in part on Multi-Factor Authentication (MFA), at least two approvals for execution of the digital retirement command;
upon receipt of the at least two approvals, request on-premise approval, at the information handling system, of the unreversible loss of access to data;
upon receipt of the on-premise approval of the unreversible loss of access to data, authenticate the digital retirement command based at least in part on a disk-on-key (DOK) pair stored in the trusted platform module;
upon authentication of the digital retirement command, initiate a retirement mode of operations by the information handling system;
upon entry to the retirement mode, encrypt all data stored by the information handling system, based at least in part on the immutable unique data sanitization key;
and
as part of the retirement mode, incapacitate the trusted platform module such that all data stored by the information handling system is no longer recoverable.

9 more elements

A system that comprises:

a first information handling system that comprises a first remote access controller integrated into the first information handling system, wherein the first remote access controller is configured to perform first remote access controller operations that comprise:
receive, from a first user, selection of a second information handling system for digital retirement, wherein the second information handling system comprises one or more processors and one or more memory devices coupled to the one or more processors, the one or more memory devices configured with stored computer-readable instructions that, upon execution by the one or more processors, cause an operating system to provide a user of the second information handling system with applications for access to data stored by the second information handling system and peripheral devices coupled to the second information handling system;
authorize and/or authenticate the first user, based at least in part on Multi-Factor Authentication (MFA) of the first user;
request a second user approve the selection of the second information handling system for digital retirement, in response to the authorization and/or authentication of the first user;
authorize and/or authenticate the second user, based at least in part on MFA of the second user;
send a digital retirement command configured to cause unreversible loss of access to data to the second information handling system, in response to approval of the selection of the second information handling system for digital retirement by, and the authorization and/or authentication of, the second user, wherein the second information handling system comprises:
a trusted platform module incorporated into the second information handling system, the trusted platform module configured to store an immutable unique data sanitization key unreadable by external devices;
a second remote access controller integrated into the second information handling system and configured to perform second remote access controller operations that comprise:
in response to receipt of the digital retirement command:
request on-premise approval, at the second information handling system, of the unreversible loss of access to data;
upon receipt of the on-premise approval of the unreversible loss of access to data, authenticate the digital retirement command based at least in part on a disk-on-key (DOK) pair stored in the trusted platform module, and correlation of a serial number read from a motherboard of the second information handling system with a serial number of the DOK pair;
upon authentication of the digital retirement command, encrypt all data stored by the second information handling system, based at least in part on the immutable unique data sanitization key;
and
incapacitate the trusted platform module such that all data stored by the second information handling system is no longer recoverable.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/056,885Filed 18 Nov 2022
Published: US 2024/0171392 A123 May 2024
Granted: 31 Mar 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 9/0897
Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage: involving additional devices, e.g. trusted…
G06F 21/60
Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity: protecting data
H04L 9/321
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…
H04L
Digital communication