# US 2022/0035909 A1 · Real-time monitoring and policy enforcement of active applications and services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0035909 A1 - Document ID: US20220035909A1 - Status: Published application - Kind: A1 - Application number: 16/983,807 - Filed: 2020-08-03 - Published: 2022-02-03 - Earliest claimed: 2020-08-03 - Assignees: Dell Products L.P. - Applicants: Dell Products, L.P. - Inventors: Anantha K. Boyapalle; Abeye Teshome; Vaibhav Soni - Web page: https://patentgrep.com/patent/US20220035909A1 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 21/6281: {at program execution time, where the protection is within the operating system} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/82: Protecting input, output or interconnection devices - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments of systems and methods for real-time monitoring and policy enforcement of active applications and services are described. In some embodiments, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: provide a hardware-rooted, Operating System (OS)-agnostic resource monitoring agent; receive, at the resource monitoring agent from a remote resource monitoring service via an out-of-band channel, a resource enforcement policy; determine, by the resource monitoring agent, that an application is using or attempting to use a resource in a manner that conflicts with the resource enforcement policy; and stop or prevent the application from using the resource in response to the determination. ## Claims ### Claim 1 An Information Handling System (IHS), comprising: a processor; and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: provide a hardware-rooted, Operating System (OS)-agnostic resource monitoring agent; receive, at the resource monitoring agent from a remote resource monitoring service via an out-of-band channel, a resource enforcement policy; determine, by the resource monitoring agent, that an application is using or attempting to use a resource in a manner that conflicts with the resource enforcement policy; and stop or prevent the application from using the resource in response to the determination. ### Claim 2 (depends on 1) The IHS of claim 1, wherein the processor comprises an Embedded Controller (EC). ### Claim 3 (depends on 1) The IHS of claim 1, wherein the resource monitoring agent establishes a root-of-trust with a hardware trust module during a boot process. ### Claim 4 (depends on 3) The IHS of claim 3, wherein the hardware trust module comprises a Trusted Platform Module (TPM). ### Claim 5 (depends on 1) The IHS of claim 1, wherein the out-of-band channel comprises a Management Engine (ME) channel, and wherein the resource enforcement policy is received using Management Component Transport Protocol (MCTP) communications. ### Claim 6 (depends on 1) The IHS of claim 1, wherein the resource enforcement policy comprises a list one or more applications, one or more resources associated with each application, and a restriction associated with each resource. ### Claim 7 (depends on 6) The IHS of claim 6, wherein the program instructions, upon execution, further cause the IHS to select one of a plurality of resource enforcement policies or restrictions based upon context information. ### Claim 8 (depends on 7) The IHS of claim 7, wherein the context information comprises at least one of: an identity of a user, a time-of-day, a day-of-the-week, a calendar event, a type of calendar event, an application currently under execution, a duration of execution of an application, a mode of execution of an application, a user's proximity to the IHS, or a user's gaze direction. ### Claim 9 (depends on 7) The IHS of claim 7, wherein the context information comprises at least one of: a current location of the IHS, a current memory usage, a characteristic of a current network connection, a current power usage, an identification of a currently connected peripheral device, or a current IHS posture. ### Claim 10 A memory storage device having program instructions stored thereon that, upon execution by one or more processors of an Information Handling System (IHS), cause the IHS to: provide a hardware-rooted, Operating System (OS)-agnostic resource monitoring agent; receive, at the resource monitoring agent from a remote resource monitoring service via an out-of-band channel, a resource enforcement policy; determine, by the resource monitoring agent, that an application is using or attempting to use a resource in a manner that conflicts with the resource enforcement policy; and stop or prevent the application from using the resource in response to the determination. ### Claim 11 (depends on 10) The memory storage device of claim 10, wherein the resource enforcement policy comprises a list one or more applications, one or more resources associated with each application, and a restriction associated with each resource. ### Claim 12 (depends on 11) The memory storage device of claim 11, wherein the application comprises a video conferencing application, wherein the resource comprises a camera coupled to the IHS, and wherein the restriction comprises a time-of-day or a day-of-the-week that the video conferencing application is allowed to or forbidden from accessing the camera. ### Claim 13 (depends on 11) The memory storage device of claim 11, wherein the program instructions, upon execution, further cause the IHS to select one of a plurality of resource enforcement policies or restrictions based upon at least one of: a user's proximity to the IHS or a current IHS posture. ### Claim 14 (depends on 11) The memory storage device of claim 11, wherein the program instructions, upon execution, further cause the IHS to select one of a plurality of resource enforcement policies or restrictions based upon a current location of the IHS. ### Claim 15 (depends on 11) The memory storage device of claim 11, wherein the program instructions, upon execution, further cause the IHS to select one of a plurality of policies or restrictions based upon: an identity of a user, a time-of-day, a day-of-the-week, a calendar event, a type of calendar event, a user's gaze direction, a current memory usage, a characteristic of a current network connection, a current power usage, an identification of a currently connected peripheral device. ### Claim 16 A method, comprising: providing a hardware-rooted, Operating System (OS)-agnostic resource monitoring agent; receiving, at the resource monitoring agent from a remote resource monitoring service via an out-of-band channel, a resource enforcement policy; determining, by the resource monitoring agent, that an application is using or attempting to use a resource in a manner that conflicts with the resource enforcement policy; and stopping or preventing the application from using the resource in response to the determination. ### Claim 17 (depends on 16) The method of claim 16, wherein the resource enforcement policy comprises a list one or more applications, one or more resources associated with each application, and a restriction associated with each resource. ### Claim 18 (depends on 17) The method of claim 17, further comprising selecting one of a plurality of resource enforcement policies or restrictions based upon a user's proximity to the IHS. ### Claim 19 (depends on 17) The method of claim 17, further comprising selecting one of a plurality of resource enforcement policies based upon a current IHS posture. ### Claim 20 (depends on 17) The method of claim 17, further comprising selecting one of a plurality of resource enforcement policies based upon a current location of the IHS.