# US 2025/0094591 A1 · Distribution of blueprints in edge systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2025/0094591 A1
- Document ID: US20250094591A1
- Status: Published application
- Kind: A1
- Application number: 18/468,285
- Filed: 2023-09-15
- Published: 2025-03-20
- Earliest claimed: 2023-09-15
- Assignees: Dell Products L.P.
- Applicants: Dell Products L.P.
- Inventors: MAXIM BALIN; ELIYAHU ROSENES
- Web page: https://patentgrep.com/patent/US20250094591A1

## CPC

- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 8/60: Software deployment
- G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)}
- G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods and systems for managing operation of edge devices are disclosed. The operation of the edge devices may be managed using blueprints. A blueprint may indicate a workflow for modifying operation of an edge device, and components to be used in the workflow. A security framework may be used to secure the distribution and use of the blueprints by edge systems. The security framework may include various checks to confirm that a blueprint is trustworthy and approved for use with edge systems. The checks may be performed prior to use of the blueprints.

## Claims

### Claim 1

A method for managing operation of endpoint devices of a deployment, the method comprising:
obtaining, by an endpoint device of the endpoint devices, a blueprint token that indicates that the endpoint device is to implement a blueprint;
in response to obtaining the blueprint token and by the endpoint device:
making a first determination regarding whether a blueprint specified by the blueprint token is trusted;
in a first instance of the first determination where the blueprint is trusted:
making a second determination regarding whether the blueprint is authorized for use by the endpoint device;
in a first instance of the second determination where the blueprint is authorized for use by the endpoint device:
making a third determination regarding whether integrity of the blueprint can be verified;
in a first instance of the third determination where the integrity of the blueprint can be verified: implementing a portion of objects specified by the blueprint that can be verified, the objects being implemented in an order specified by the blueprint, and implementation of the portion of the objects conforming the operation of the endpoint device to the blueprint; and providing computer implemented services using at least the portion of objects.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
in the first instance of the third determination where the integrity of the blueprint can be verified:
while the objects are being implemented, logging activity of the endpoint device to obtain an auditable implementation trail for the endpoint device.

### Claim 3 (depends on 1)

The method of claim 1, wherein making the first determination comprises:
obtaining verification data for the blueprint; and
attempting to verify trust in the blueprint using the verification data to make the first determination.

### Claim 4 (depends on 3)

The method of claim 3, wherein the verification data comprises a hash of the blueprint that is signed, and attempting to verify the trust in the blueprint comprises using a public key to check a signature applied to the hash.

### Claim 5 (depends on 1)

The method of claim 1, wherein making the second determination comprises:
obtaining at least one assignment for blueprints to the endpoint device; and
comparing the blueprint to the blueprints to ascertain whether the blueprint is one of the blueprints to make the second determination.

### Claim 6 (depends on 5)

The method of claim 5, wherein each of the at least one assignment attests an assignment of at least one of the blueprints for use by the endpoint device, the at least one assignment being made by an administrator, and the at least one assignment being cryptographically verifiable by the endpoint device.

### Claim 7 (depends on 1)

The method of claim 1, wherein making the third determination comprises:
obtaining verification data for the blueprint; and
comparing a first hash in the verification data to a second hash of the blueprint to make the third determination.

### Claim 8

A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for managing operation of endpoint devices of a deployment, the operations comprising:
obtaining, by an endpoint device of the endpoint devices, a blueprint token that indicates that the endpoint device is to implement a blueprint;
in response to obtaining the blueprint token and by the endpoint device:
making a first determination regarding whether a blueprint specified by the blueprint token is trusted;
in a first instance of the first determination where the blueprint is trusted:
making a second determination regarding whether the blueprint is authorized for use by the endpoint device;
in a first instance of the second determination where the blueprint is authorized for use by the endpoint device:
making a third determination regarding whether integrity of the blueprint can be verified;
in a first instance of the third determination where the integrity of the blueprint can be verified: implementing a portion of objects specified by the blueprint that can be verified, the objects being implemented in an order specified by the blueprint, and implementation of the portion of the objects conforming the operation of the endpoint device to the blueprint; and providing computer implemented services using at least the portion of objects.

### Claim 9 (depends on 8)

The non-transitory machine-readable medium of claim 8, wherein the operations further comprise:
in the first instance of the third determination where the integrity of the blueprint can be verified:
while the objects are being implemented, logging activity of the endpoint device to obtain an auditable implementation trail for the endpoint device.

### Claim 10 (depends on 8)

The non-transitory machine-readable medium of claim 8, wherein making the first determination comprises:
obtaining verification data for the blueprint; and
attempting to verify trust in the blueprint using the verification data to make the first determination.

### Claim 11 (depends on 10)

The non-transitory machine-readable medium of claim 10, wherein the verification data comprises a hash of the blueprint that is signed, and attempting to verify the trust in the blueprint comprises using a public key to check a signature applied to the hash.

### Claim 12 (depends on 8)

The non-transitory machine-readable medium of claim 8, wherein making the second determination comprises:
obtaining at least one assignment for blueprints to the endpoint device; and
comparing the blueprint to the blueprints to ascertain whether the blueprint is one of the blueprints to make the second determination.

### Claim 13 (depends on 12)

The non-transitory machine-readable medium of claim 12, wherein each of the at least one assignment attests an assignment of at least one of the blueprints for use by the endpoint device, the at least one assignment being made by an administrator, and the at least one assignment being cryptographically verifiable by the endpoint device.

### Claim 14 (depends on 8)

The non-transitory machine-readable medium of claim 8, wherein making the third determination comprises:
obtaining verification data for the blueprint; and
comparing a first hash in the verification data to a second hash of the blueprint to make the third determination.

### Claim 15

An endpoint device, comprising:
a processor; and
a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations for managing operation of the endpoint device as a member of a deployment, the operations comprising:
obtaining a blueprint token that indicates that the endpoint device is to implement a blueprint;
in response to obtaining the blueprint token:
making a first determination regarding whether a blueprint specified by the blueprint token is trusted;
in a first instance of the first determination where the blueprint is trusted:
making a second determination regarding whether the blueprint is authorized for use by the endpoint device;
in a first instance of the second determination where the blueprint is authorized for use by the endpoint device:
making a third determination regarding whether integrity of the blueprint can be verified;
in a first instance of the third determination where the integrity of the blueprint can be verified: implementing a portion of objects specified by the blueprint that can be verified, the objects being implemented in an order specified by the blueprint, and implementation of the portion of the objects conforming the operation of the endpoint device to the blueprint; and providing computer implemented services using at least the portion of objects.

### Claim 16 (depends on 15)

The endpoint device of claim 15, wherein the operations further comprise:
in the first instance of the third determination where the integrity of the blueprint can be verified:
while the objects are being implemented, logging activity of the endpoint device to obtain an auditable implementation trail for the endpoint device.

### Claim 17 (depends on 15)

The endpoint device of claim 15, wherein making the first determination comprises:
obtaining verification data for the blueprint; and
attempting to verify trust in the blueprint using the verification data to make the first determination.

### Claim 18 (depends on 17)

The endpoint device of claim 17 wherein the verification data comprises a hash of the blueprint that is signed, and attempting to verify the trust in the blueprint comprises using a public key to check a signature applied to the hash.

### Claim 19 (depends on 15)

The endpoint device of claim 15, wherein making the second determination comprises:
obtaining at least one assignment for blueprints to the endpoint device; and
comparing the blueprint to the blueprints to ascertain whether the blueprint is one of the blueprints to make the second determination.

### Claim 20 (depends on 19)

The endpoint device of claim 19, wherein each of the at least one assignment attests an assignment of at least one of the blueprints for use by the endpoint device, the at least one assignment being made by an administrator, and the at least one assignment being cryptographically verifiable by the endpoint device.