Office Action 1: Notice of Allowance (2024-09-25)

CLAIMS:
Claims
1\. A system comprising: an update system configured to:receive an indication of an update comprising updated configurations for one or more hardware components of an IHS (Information Handling System);query the IHS for a plurality of vulnerability proofing requirements for updates that modify configurations of hardware components of the IHS;based on vulnerability proofing requirements received from the IHS, determine whether the updated configurations for the one or more hardware components of the IHS are identified as vulnerable in the one or more of catalogs specified in the vulnerability proofing requirements; when the updated configurations are not identified in the plurality of catalogs, transmit the update to the IHS; when one or more configurations from the update are identified in the plurality of catalogs specified in the vulnerability proofing requirements, terminate the update and notify the IHS of the terminated update; andthe IHS (Information Handling System) comprising: one or more CPUs utilizing one or more buses that connect to a plurality of hardware components of the IHS; a remote access controller supporting remote management of the Information Handling System (IHS), the remote access controller comprising a logic unit and a memory device having instructions stored thereon that, upon execution by the logic unit, cause the remote access controller to: in response to the query from the update system, retrieve, from a persistent data storage of the IHS, the plurality of vulnerability proofing requirements for updates that modify configurations of the plurality of hardware components of the IHS; transmit the vulnerability proofing requirements to the update system, wherein the vulnerability proofing requirements comprise one or more of catalogs of known vulnerabilities of hardware components.
2\. The system of claim 1, wherein the plurality of catalogs comprise a catalog of vulnerabilities known to a manufacturer of the IHS.
3\. The system of claim 1, wherein the plurality of catalogs comprise a catalog of vulnerabilities known to an entity operating the IHS.
4\. The system of claim 1, wherein the vulnerability proofing requirements are retrieved from a factory provisioned identity certificate of the IHS.
5\. The system of claim 4, wherein the factory-provisioned identity certificate is cryptographically bound to the remote access controller and stored in a secured memory of the IHS.
6\. The system of claim 1, wherein further logic execution causes the remote access controller to reject any received update that is not preceded by a request for the vulnerability proofing requirements for updates that modify configurations of the plurality of hardware components of the IHS.
7\. The system of claim 1, wherein the configurations of the update comprises a firmware update for instructions used to operate a first of the hardware components.
8\. The system of claim 7, wherein the catalogs specify alternate firmware versions that are used to operate the first of the hardware components and that are not associated with known vulnerabilities.
9\. The system of claim 4, wherein, in response to the notification from the update system that the update has been terminated, further logic execution causes the remote access controller to issue a request for an updated identity certificate with updated vulnerability proofing requirements.
10\. A method for vulnerability proofing updates to an IHS (Information Handling System), wherein the vulnerability proofing is implemented by a remote access controller of the IHS that provides remote management of the IHS, the method comprising: receiving, by an update system, an indication of an update comprising updated configurations for one or more hardware components of an IHS (Information Handling System); querying, by the update system, the IHS for a plurality of vulnerability proofing requirements for updates that modify configurations of hardware components of the IHS; in response to the query, retrieving, from a persistent data storage of the IHS, the plurality of vulnerability proofing requirements for updates that modify configurations of the plurality of hardware components of the IHS; transmitting, by the IHS, the vulnerability proofing requirements to the update system, wherein the vulnerability proofing requirements comprise one or more of catalogs of known vulnerabilities of hardware components; based on vulnerability proofing requirements received by the update system from the IHS, determining whether the updated configurations for the one or more hardware components of the IHS are identified as vulnerable in the one or more of catalogs specified in the vulnerability proofing requirements; when the updated configurations are not identified in the plurality of catalogs by the update system, transmitting the update to the IHS; and when one or more configurations from the update are identified by the update system in the plurality of catalogs specified in the vulnerability proofing requirements, terminating the update and notifying the IHS of the terminated update.
11\. The method of claim 10, wherein the plurality of catalogs comprise a catalog of vulnerabilities known to a manufacturer of the IHS.
12\. The method of claim 10, wherein the plurality of catalogs comprise a catalog of vulnerabilities known to an entity operating the IHS.
13\. The method of claim 10, wherein the vulnerability proofing requirements are retrieved from a factory provisioned identity certificate of the IHS.
14\. The method of claim 13, wherein the validation proofing requirements in the inventory certificate further specify the plurality of catalogs of known vulnerabilities for use in identifying configurations that are vulnerable.
15\. The method of claim 10, wherein the configurations of the update comprises a firmware update for instructions used to operate a first of the hardware components.
16\. The method of claim 15, wherein the catalogs specify alternate firmware versions that are used to operate the first of the hardware components and that are not associated with known vulnerabilities.
17\. An IHS (Information Handling System) comprising: one or more CPUs utilizing one or more buses that connect to a plurality of hardware components of the IHS; and a remote access controller supporting remote management of the Information Handling System (IHS), the remote access controller comprising a logic unit and a memory device having instructions stored thereon that, upon execution by the logic unit, cause the remote access controller to: receive, from an update system, an indication of update comprising configurations for one or more of the plurality of hardware components of the IHS; retrieve a plurality of vulnerability proofing requirements for updates that modify the configuration the plurality of hardware components of the IHS; transmit the vulnerability proofing requirements to the update system, where based on the vulnerability proofing requirements a plurality of catalogs specifying known vulnerabilities of hardware components are consulted to determine whether configurations from the update are identified as vulnerable in one or more of the catalogs; when the configurations from the update are not identified in the plurality of catalogs specified in the vulnerability proofing requirements, receive transmission of the update from the update system for use in updating the configurations for one or more of the plurality of hardware components of the IHS; and when the configurations from the update are identified in the plurality of catalogs specified in the vulnerability proofing requirements, receive an notification from the update system that the update has been terminated.
18\. The IHS of claim 17, wherein the plurality of catalogs comprise a catalog of vulnerabilities known to a manufacturer of the IHS.
19\. The IHS of claim 17, wherein the plurality of catalogs comprise a catalog of vulnerabilities known to an entity operating the IHS.
20\. The IHS of claim 17, wherein the vulnerability proofing requirements are retrieved from a factory provisioned identity certificate of the IHS.

OFFICE ACTION:
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 are presented for examination.
Allowable Subject Matter
Claims 1-20 are allowed.
The claims are directed to novel and non-obvious systems, IHSes (Information Handling Systems) and methods for vulnerability proofing updates to an IHS (Information Handling System), wherein the vulnerability proofing is implemented by a remote access controller of the IHS that provides remote management of the HIS.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See PTOL-892.



CITED REFERENCE SUMMARIES: Ref US20170078322A1: Claims:
A computerized method comprising: by a computing device having one or more computer processors and a non-transitory computer readable storage device storing software instruction for execution by the one or more computer processors, accessing: network device information indicating one or more of: configuration information of network devices within a network, or a network topology indicating communication paths between network devices determined using, at least, monitored network traffic between the network devices; and user account information indicating: user access rights of respective user accounts, and one or more of: profile information of respective user accounts, user account rules enforced on the network, or network actions associated with the user accounts; for each of the network devices and user accounts: determining a vulnerability indicating a likelihood of the network device or user account being compromised, the vulnerability based on values of a plurality of vulnerability metrics determined using network device information associated with the network device or user account information associated with the user account; determining an importance indicating a priority an attacker would place on compromising the network device or user account, the importance based on values of a plurality of importance metrics determined using network device information associated with the network device or user account information associated with the user account; and providing, for presentation, an interactive user interface comprising a visual representation of: at least some of the determined vulnerabilities for network devices and/or user accounts; at least some of the determined importances for network devices and/or user accounts, wherein the interactive user interface is operable to modify, in response to received input indicating a weighting for one or more network device, user account, vulnerability metric, or importance metric, the determined vulnerabilities and/or importances, included in the interactive user interface.
by a computing device having one or more computer processors and a non-transitory computer readable storage device storing software instruction for execution by the one or more computer processors,
accessing: network device information indicating one or more of: configuration information of network devices within a network, or a network topology indicating communication paths between network devices determined using, at least, monitored network traffic between the network devices; and user account information indicating: user access rights of respective user accounts, and one or more of: profile information of respective user accounts, user account rules enforced on the network, or network actions associated with the user accounts;
network device information indicating one or more of: configuration information of network devices within a network, or a network topology indicating communication paths between network devices determined using, at least, monitored network traffic between the network devices; and
configuration information of network devices within a network, or
a network topology indicating communication paths between network devices determined using, at least, monitored network traffic between the network devices; and
user account information indicating: user access rights of respective user accounts, and one or more of: profile information of respective user accounts, user account rules enforced on the network, or network actions associated with the user accounts;
user access rights of respective user accounts, and
one or more of: profile information of respective user accounts, user account rules enforced on the network, or network actions associated with the user accounts;
profile information of respective user accounts,
user account rules enforced on the network, or
network actions associated with the user accounts;
for each of the network devices and user accounts: determining a vulnerability indicating a likelihood of the network device or user account being compromised, the vulnerability based on values of a plurality of vulnerability metrics determined using network device information associated with the network device or user account information associated with the user account; determining an importance indicating a priority an attacker would place on compromising the network device or user account, the importance based on values of a plurality of importance metrics determined using network device information associated with the network device or user account information associated with the user account; and
determining a vulnerability indicating a likelihood of the network device or user account being compromised, the vulnerability based on values of a plurality of vulnerability metrics determined using network device information associated with the network device or user account information associated with the user account;
determining an importance indicating a priority an attacker would place on compromising the network device or user account, the importance based on values of a plurality of importance metrics determined using network device information associated with the network device or user account information associated with the user account; and
providing, for presentation, an interactive user interface comprising a visual representation of: at least some of the determined vulnerabilities for network devices and/or user accounts; at least some of the determined importances for network devices and/or user accounts,
at least some of the determined vulnerabilities for network devices and/or user accounts;
at least some of the determined importances for network devices and/or user accounts,
wherein the interactive user interface is operable to modify, in response to received input indicating a weighting for one or more network device, user account, vulnerability metric, or importance metric, the determined vulnerabilities and/or importances, included in the interactive user interface.
The method of claim 1 , wherein the interactive user interface is further operable to adjust a time period associated with determining vulnerabilities and determining importances, wherein vulnerabilities and importances are determined based on network device information and user account information associated with the adjusted time period.
The method of claim 1 , further comprising: providing, for presentation, selectable options associated with creating a vulnerability metric or an importance metric, the selectable options including indications of aspects of network devices or user accounts to be associated with the created vulnerability metric or importance metric; and receiving selections of indications of aspects, and values associated with respective aspects, wherein the values indicate conditions that are to be satisfied for the vulnerability metric or importance metric to be associated with an effect on a vulnerability or an importance.
providing, for presentation, selectable options associated with creating a vulnerability metric or an importance metric, the selectable options including indications of aspects of network devices or user accounts to be associated with the created vulnerability metric or importance metric; and
receiving selections of indications of aspects, and values associated with respective aspects, wherein the values indicate conditions that are to be satisfied for the vulnerability metric or importance metric to be associated with an effect on a vulnerability or an importance.
The method of claim 3 , further comprising: receiving information associated with an effect of the created vulnerability metric or importance metric when determining a vulnerability or an importance, the information specifying a weighting to be applied a value of the created vulnerability metric or importance metric.
receiving information associated with an effect of the created vulnerability metric or importance metric when determining a vulnerability or an importance, the information specifying a weighting to be applied a value of the created vulnerability metric or importance metric.
The method of claim 1 , wherein the interactive user interface includes a search user interface element, and wherein the method further comprises: receiving a search query specifying aspects of network devices or user accounts; and filtering the network devices or user accounts based on the aspects specified in the search query, and presenting network devices or user accounts that are associated with the specified aspects;
receiving a search query specifying aspects of network devices or user accounts; and
filtering the network devices or user accounts based on the aspects specified in the search query, and presenting network devices or user accounts that are associated with the specified aspects;
The method of claim 5 , further comprising: monitoring received search queries, and sharing one or more received search queries with an outside system associated with a different network, wherein the outside system determines vulnerabilities and importances for network devices and/or user accounts that are associated with the different network, and wherein the received search queries filter the network devices and/or user accounts based on respective specified aspects.
monitoring received search queries, and sharing one or more received search queries with an outside system associated with a different network, wherein the outside system determines vulnerabilities and importances for network devices and/or user accounts that are associated with the different network, and wherein the received search queries filter the network devices and/or user accounts based on respective specified aspects.
A computerized method comprising: by a computing device having one or more computer processors and a non-transitory computer readable storage device storing software instruction for execution by the one or more computer processors, obtaining configuration information describing network devices within one or more networks; determining, from the configuration information and for at least one network device, one or more metrics measuring aspects of a network device compromise vulnerability of the network device; obtaining indications of user access rights of user accounts to respective network devices; determining, for each network device and using the user access rights and configuration information, one or more metrics measuring aspects of a network device compromise value of the network device; and determining, for at least one user account, one or more metrics measuring aspects of a user account compromise vulnerability, and one or more metrics measuring aspects of a user account compromise value.
obtaining configuration information describing network devices within one or more networks;
determining, from the configuration information and for at least one network device, one or more metrics measuring aspects of a network device compromise vulnerability of the network device;
obtaining indications of user access rights of user accounts to respective network devices;
determining, for each network device and using the user access rights and configuration information, one or more metrics measuring aspects of a network device compromise value of the network device; and
determining, for at least one user account, one or more metrics measuring aspects of a user account compromise vulnerability, and one or more metrics measuring aspects of a user account compromise value.
The method of claim 7 , further comprising: generating user interface data for presentation, the user interface data comprising a visual representation of one or more of: network device compromise vulnerabilities mapped to corresponding network device compromise values, or user account compromise vulnerabilities mapped to corresponding user account compromise values.
generating user interface data for presentation, the user interface data comprising a visual representation of one or more of: network device compromise vulnerabilities mapped to corresponding network device compromise values, or user account compromise vulnerabilities mapped to corresponding user account compromise values.
network device compromise vulnerabilities mapped to corresponding network device compromise values, or
user account compromise vulnerabilities mapped to corresponding user account compromise values.
The method of claim 8 , wherein the visual representation associated with network devices comprises a chart mapping, for each network device, a network device compromise vulnerability to a network device compromise value of the network device, the mapping for the network device comprising a visual element included in the chart.
The method of claim 7 , further comprising: obtaining information identifying a real world event that informs or affects one or more metrics associated with user account compromise vulnerabilities and/or network device compromise vulnerabilities, the information associated with a portion of configuration information and/or user account information; and modifying compromise vulnerabilities of user accounts and/or network devices with same user account information and/or configuration information as the obtained information.
obtaining information identifying a real world event that informs or affects one or more metrics associated with user account compromise vulnerabilities and/or network device compromise vulnerabilities, the information associated with a portion of configuration information and/or user account information; and
modifying compromise vulnerabilities of user accounts and/or network devices with same user account information and/or configuration information as the obtained information.
The method of claim 10 , further comprising: generating user interface data illustrating the modification.
generating user interface data illustrating the modification.
The method of claim 7 , wherein determining, for a particular network device, a metric measuring an aspect of a network device compromise value of the particular network device comprises: obtaining information describing network traffic between the network devices; determining, based on the information describing network traffic, a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, wherein each edge indicates a communication path, and wherein each node is associated with one or more network devices; determining a number of edges connecting to a node associated with the particular network device; and assigning a value associated with the metric based on the determined number of edges.
obtaining information describing network traffic between the network devices;
determining, based on the information describing network traffic, a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, wherein each edge indicates a communication path, and wherein each node is associated with one or more network devices;
determining a number of edges connecting to a node associated with the particular network device; and
assigning a value associated with the metric based on the determined number of edges.
The method of claim 7 , further comprising: receiving an indication of a metric measuring aspects of a network device compromise value or network device compromise vulnerability or user account compromise value or user account compromise vulnerability; monitoring, over a threshold amount of time, a number of network devices or user accounts that are affected by the metric; and providing, for presentation, information associated with a reduction in the number of network devices or user accounts that are effected by the metric.
receiving an indication of a metric measuring aspects of a network device compromise value or network device compromise vulnerability or user account compromise value or user account compromise vulnerability;
monitoring, over a threshold amount of time, a number of network devices or user accounts that are affected by the metric; and
providing, for presentation, information associated with a reduction in the number of network devices or user accounts that are effected by the metric.
A system comprising one or more computer systems and one or more computer storage media storing instructions that when executed by the computer systems cause the computer systems to perform operations comprising: obtaining configuration information describing network devices within one or more networks; determining, from the configuration information and for at least one network device, one or more metrics measuring aspects of a network device compromise vulnerability of the network device; obtaining indications of user access rights of user accounts to respective network devices; determining, for each network device and using the user access rights and configuration information, one or more metrics measuring aspects of a network device compromise value of the network device; and determining, for at least one user account, one or more metrics measuring aspects of a user account compromise vulnerability, and one or more metrics measuring aspects of a user account compromise value.
determining, for each network device and using the user access rights and configuration information, one or more metrics measuring aspects of a network device compromise value of the network device; and determining, for at least one user account, one or more metrics measuring aspects of a user account compromise vulnerability, and one or more metrics measuring aspects of a user account compromise value.
The system of claim 14 , wherein the operations further comprise: generating user interface data for presentation, the user interface data comprising a visual representation of one or more of: network device compromise vulnerabilities mapped to corresponding network device compromise values, or user account compromise vulnerabilities mapped to corresponding user account compromise values.
The system of claim 15 , wherein the visual representation associated with network devices comprises a chart mapping, for each network device, a network device compromise vulnerability to a network device compromise value of the network device, the mapping for the network device comprising a visual element included in the chart.
The system of claim 14 , wherein the operations further comprise: obtaining information identifying a real world event that informs or affects one or more metrics associated with user account compromise vulnerabilities and/or network device compromise vulnerabilities, the information associated with a portion of configuration information and/or user account information; and modifying compromise vulnerabilities of user accounts and/or network devices with same user account information and/or configuration information as the obtained information.
The system of claim 17 , wherein the operations further comprise: generating user interface data illustrating the modification.
The system of claim 14 , wherein determining, for a particular network device, a metric measuring an aspect of a network device compromise value of the particular network device comprises: obtaining information describing network traffic between the network devices; determining, based on the information describing network traffic, a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, wherein each edge indicates a communication path, and wherein each node is associated with one or more network devices; determining a number of edges connecting to a node associated with the particular network device; and assigning a value assoc
[Truncated to input limit]