Below-OS Firmware Module for Real-Time Malware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security software is hindered by operating systems in preventing malware from operating at the same level, allowing kernel mode malware to evade detection and compromise security solutions, as native OS services limit filtering capabilities and OS vendors control when filtering functionality is available.
Innovation Solution
Implementing a below-operating system (O/S) trapping agent that operates at a higher priority than the OS, intercepting resource access attempts and consulting security rules to determine if they are malicious, allowing for real-time module protection by trapping and managing access to sensitive resources without relying on the OS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security software operates within the operating system kernel, then it can filter behaviors and detect malware, but native OS services prevent security software from installing arbitrary hooking within the kernel, limiting filtering capabilities
Solution Approach 1:
The patent transitions from operating within the OS kernel to operating below the OS layer. The security software is implemented as a firmware module in the system firmware, creating a new dimensional layer beneath the operating system. This allows the security software to intercept and filter system calls before they reach the OS kernel, bypassing OS restrictions on kernel hooking while maintaining comprehensive filtering capabilities.
Solution Approach 2:
The patent introduces a firmware module as an intermediary layer between the hardware and the operating system. This firmware module acts as a mediator that intercepts system calls and provides filtering functionality without requiring direct kernel modifications. The firmware module communicates with the OS through standardized interfaces while maintaining security filtering capabilities independent of OS restrictions.
2Reliability
If security software filters all behaviors at the OS level, then malicious actions can be detected, but OS vendors control when filtering functionality is available, limiting real-time protection
Solution Approach 1:
The patent implements security filtering functionality in the firmware layer, which is loaded and executed before the operating system starts. This preliminary positioning allows the security software to be ready and waiting to intercept system calls immediately when the system boots, without needing to wait for OS initialization or vendor-configured timing. The firmware module establishes filtering rules and interception capabilities in advance, enabling real-time detection as soon as system calls are made.
3Reliability
If malware operates at the kernel level, then it can compromise security software and evade detection, but operating systems limit filtering functionality to maintain stability
Solution Approach 1:
The patent segments the system into distinct layers with clear boundaries: the firmware security layer below the OS, the OS kernel layer, and the user application layer. By placing security functionality in a separate firmware segment rather than within the OS kernel, the system maintains modular architecture. This segmentation allows security operations to occur independently without compromising OS stability, while the firmware layer acts as a protective barrier against kernel-level malware.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Technologies for securing an electronic device include trapping an attempt to access a secured system resource of the electronic device, determining a module associated with the attempt, determining a subsection of the module associated with the attempt, the subsection including a memory location associated with the attempt, accessing a security rule to determine whether to allow the attempted access based on the determination of the module and the determination of the subsection, and handling the attempt based on the security rule. The module includes a plurality of distinct subsections.