Location-based policy enforcement for data processing systems using out-of-band methods

A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor of a data processing system, cause the processor to perform operations for managing the data processing system, the operations comprising:

• obtaining, by a management controller of the data processing system and via an out-of-band communication channel, at least one policy from a provisioning server, wherein the at least one policy is to be enforced while the data processing system is within a geographical region and indicates a desired manner of operation of the data processing system while the data processing system is within the geographical region;
• after obtaining the at least one policy, obtaining, by the management controller and via the out-of-band communication channel, location data for the data processing system, the data processing system comprises a single network module that is shared by both of the management controller and hardware resources of the data processing system, the hardware resources comprise the processor, and the single network module being adapted to separately advertise network endpoints for the management controller and the hardware resources such that first communications meant for the hardware resources never flow through the management controller and second communications meant for the management controller never flow through the hardware resources;
• identifying, by the management controller, applicability of the at least one policy based on the location data;
• and
• in a first instance of the identifying where the at least one policy is applicable:
• making an identification regarding whether the data processing system is operating out of compliance with respect to the at least one policy, and
• in a first instance of the identification where the data processing system is operating out of compliance:
• performing, by the management controller, an action set based on the at least one policy to update operation of the data processing system to improve compliance of the data processing system with respect to the at least one policy;
• and
• providing, by the data processing system, a computer-implemented service based on the updated operation,
• wherein to enter the desired manner of operation, an action set is performed, the action set comprising disabling, by the management controller, a trusted platform module of the data processing system.

A data processing system, comprising:

• a processor;
• and
• a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations for managing the data processing system, the operations comprising:
• obtaining, by a management controller of the data processing system and via an out-of-band communication channel, at least one policy from a provisioning server, wherein the at least one policy is to be enforced while the data processing system is within a geographical region and indicates a desired manner of operation of the data processing system while the data processing system is within the geographical region;
• after obtaining the at least one policy, obtaining, by the management controller and via the out-of-band communication channel, location data for the data processing system, the data processing system comprises a single network module that is shared by both of the management controller and hardware resources of the data processing system, the hardware resources comprise the processor, and the single network module being adapted to separately advertise network endpoints for the management controller and the hardware resources such that first communications meant for the hardware resources never flow through the management controller and second communications meant for the management controller never flow through the hardware resources,
• identifying, by the management controller, applicability of the at least one policy based on the location data, and
• in a first instance of the identifying where the at least one policy is applicable:
• making an identification regarding whether the data processing system is operating out of compliance with respect to the at least one policy;
• and
• in a first instance of the identification where the data processing system is operating out of compliance:
• performing, by the management controller, an action set based on the at least one policy to update operation of the data processing system to improve compliance of the data processing system with respect to the at least one policy, and
• providing, by the data processing system, a computer-implemented service based on the updated operation,
• wherein to enter the desired manner of operation, an action set is performed, the action set comprising disabling, by the management controller, a trusted platform module of the data processing system.