Boot Sequence Hashing for Early Boot Kit Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Boot kit attacks, which target the boot sequence of computational devices, are difficult to detect and remove, as they operate before the initialization of the operating system, making them invisible to traditional antivirus applications.
Innovation Solution
A system and method that monitor the boot process of computational devices, perform a hash on boot data, and compare it to a previously stored hash value using a private blockchain, enabling quick detection and prevention of boot kit attacks by taking preventive actions such as quarantining the device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus applications are used to detect malware, then they can detect and prevent malware that operates after operating system initialization, but they cannot detect boot kit attacks that occur before operating system initialization
Solution Approach 1:
The system performs preliminary hashing of boot data during the boot process itself, before the operating system fully initializes. This allows detection of boot kit attacks at the earliest possible stage, capturing malicious modifications to boot sectors and firmware that would be invisible to traditional antivirus applications running after OS initialization.
Solution Approach 2:
The patent introduces a hash value comparison mechanism as an intermediary between the boot process and security detection. Instead of relying on traditional antivirus scanning, the system uses cryptographic hashing of boot data and compares it against known good hashes, creating a new detection layer that operates independently of the operating system and can identify boot kit attacks.
2Reliability
If the boot sequence is extensively modified to improve detection, then detection capability may improve, but device complexity and potential performance loss increase
Solution Approach 1:
The patent extracts the security detection function from the main boot sequence by implementing it as a separate hash computation and comparison process. The boot data is hashed and compared against stored good hashes without requiring extensive modifications to the core boot流程, thus maintaining boot sequence simplicity while improving detection capability.
Solution Approach 2:
The system creates a cryptographic copy (hash) of the boot data rather than analyzing the boot sequence directly. This allows detection of boot kit attacks by comparing hash values against known good hashes, avoiding the need to extensively modify or analyze the complex boot sequence structure itself.
3Speed
If hash values are stored in a traditional database, then retrieval is fast, but the data may be compromised or altered by malicious actors
Solution Approach 1:
The patent employs blockchain technology, which uses a distributed ledger structure similar to how pneumatic and hydraulic systems use distributed networks, to store hash values across multiple nodes. This decentralized storage mechanism ensures that hash values cannot be easily compromised or altered by malicious actors while maintaining efficient retrieval capabilities through the blockchain's native query mechanisms.
Solution Approach 2:
The system maintains a consistent and uniform structure for storing hash values in the blockchain, where each hash is recorded in the same format and location across the distributed network. This homogeneous storage approach ensures integrity and reliability of hash values while enabling efficient and consistent retrieval across all nodes in the blockchain network.
Data Source
AI summary
A system and method for detecting boot kit attacks that includes a memory configured to store previous hash values associated with a good boot sequence and a processor operably coupled to the memory. The processor is configured to receive from an external device current boot data associated with a current boot procedure of the external device. The current boot data includes at least an amount of network data sent and received by the external device. Once the processor receives the current boot data, the processor then performs a hash function on the current boot data to produce a current hash value. The processor then compares the current hash value with the previous hash value stored in the memory and sends to the external device a notification to use a previous boot procedure when the current hash value is different than the previous hash value.