BIOS Intrusion Detection via Secondary Memory and WMI
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware attacks on computer firmware, such as BIOS, can compromise the integrity of a computing system, leading to unauthorized access, remote monitoring, and control, making it difficult to ensure correct operation and security.
Innovation Solution
Implementing a secondary non-volatile memory to store a duplicate or different version of the BIOS, along with event logging and notification systems using Windows Management Instrumentation (WMI) to detect and alert users of firmware intrusions during runtime, ensuring secure storage and real-time monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If BIOS is stored in primary non-volatile memory for system operation, then system functionality is maintained, but the BIOS becomes vulnerable to malware attacks and compromise
Solution Approach 1:
The patent implements a secondary non-volatile memory that stores a copy of the BIOS firmware. This copy serves as a secure reference that can be used to verify the integrity of the primary BIOS and restore it if compromised by malware attacks.
Solution Approach 2:
The system performs preliminary integrity verification of the BIOS firmware during the boot process before the operating system gains full control. This early detection mechanism prevents compromised BIOS from executing malicious code while maintaining normal system operation.
2Difficulty of detecting and measuring
If event logging and notification systems are implemented to detect firmware intrusions, then intrusion detection capability is improved, but system complexity increases
Solution Approach 1:
The patent implements an event logging system that records firmware intrusion attempts and notifies system administrators or security software. This feedback mechanism enables continuous monitoring and response to security threats while maintaining a manageable level of system complexity through structured event recording.
Data Source
AI summary
A computer program product for providing notifications to a user of an intrusion into firmware includes, in one example, non-transitory computer readable medium including computer usable program code embodied therewith to, when executed by a processor, detect intrusion to the firmware of a computing system during runtime in a system management mode.