Zero-Trust Telemetry Routing With Factory-Provisioned Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a zero-trust computing environment, the inability to configure and transmit accurate telemetry defeats the continuous validation of access to protected resources, leading to potential security vulnerabilities due to stale or inadequate telemetry data.
Innovation Solution
The implementation of a system that secures telemetry transmission using factory-provisioned encryption keys and adaptive telemetry orchestration, ensuring that telemetry is encrypted and transmitted based on the hardware component's location within a trusted chain, allowing continuous validation of access to protected resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If telemetry is transmitted without encryption in a zero-trust environment, then transmission simplicity is improved, but security is worsened
Solution Approach 1:
The system performs preliminary actions by provisioning encryption keys and policy decision point locators to the IHS during factory provisioning, before the IHS is deployed to the zero-trust environment. This pre-configuration enables automatic encrypted telemetry transmission without requiring complex runtime security configuration, thus maintaining ease of operation while ensuring security.
Solution Approach 2:
The system introduces a policy information point as an intermediary that receives unencrypted telemetry from the IHS, encrypts it using the factory-provisioned encryption key, and forwards it to the policy decision point. This intermediary approach allows the IHS to transmit telemetry simply without encryption, while the intermediary ensures security is maintained in the zero-trust environment.
2Reliability
If factory-provisioned encryption keys are used for all telemetry, then security is improved, but device complexity is worsened
Solution Approach 1:
The system applies local quality by provisioning different encryption keys to different IHS devices during factory provisioning. Each IHS receives its own unique encryption key stored in secure storage, allowing security to be enhanced at the local device level without requiring complex centralized key management infrastructure. The complexity is distributed and managed locally at each device.
3Adaptability or versatility
If telemetry definitions are updated dynamically, then adaptability is improved, but loss of information is worsened due to potential telemetry gaps
Solution Approach 1:
The system implements feedback by continuously monitoring telemetry transmission status and validating telemetry data at the policy information point. When telemetry definitions are updated dynamically, the system uses feedback mechanisms to ensure telemetry continuity by validating that updated telemetry definitions are properly received and implemented, preventing information loss during transitions.
Data Source
AI summary
Systems and methods that operate an Information Handling System (IHS) support secure telemetry for use in a zero-trust environment. Upon being initialized, the IHS retrieves a factory-provisioned locator of a service that provides the IHS with a network location of a policy decision point of the zero-trust environment and that provides an encryption key. The IHS identifies telemetry generated by the sensors that is ready for transmission. The IHS transmits the telemetry to a policy information point of the zero-trust environment, where the telemetry includes the factory-provisioned encryption key and also includes the provided network location of the policy decision point. The policy information point uses the network location included in the telemetry and the factory-provisioned encryption key included in the telemetry to establish an encrypted session with the policy decision point. Via the encrypted session, the telemetry is transmitted to the policy decision point.