Boot Source Tracking for Virus Risk Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computers typically do not record the source from which they were booted, making it difficult to identify and mitigate the risk of virus introduction when booting from alternate sources, which have a higher risk of containing viruses compared to hard disk drives.
Innovation Solution
A method is implemented to identify a primary boot source, determine if the computer should be booted from it, and execute anti-virus actions if not, by hashing the identification with a secret and comparing it to a stored value, and generating signals to alert of non-primary boot sources, allowing for preemptive corrective actions such as virus scans or re-imaging.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the computer boots from alternate sources (floppy drive, memory key, CD-ROM), then the versatility and flexibility of the system is improved, but the risk of introducing viruses increases
Solution Approach 1:
The patent implements preliminary action by recording the boot source identification during the boot process and performing virus risk assessment before the operating system fully loads. The BIOS captures the boot device identifier and compares it against a database of trusted sources, executing preventive measures before potential virus introduction can occur.
Solution Approach 2:
The system establishes feedback by continuously monitoring boot source information and comparing it against security policies. The BIOS receives boot source identification, queries a security database to determine if the source is trusted, and provides feedback by either allowing the boot process to continue or blocking it with an alert message, creating a closed-loop security control system.
2Ease of operation
If the computer does not record boot source information, then the system complexity is reduced and ease of operation is improved, but the ability to detect and respond to security threats is worsened
Solution Approach 1:
The system implements self-service by automatically recording boot source information in the BIOS without requiring user intervention. The BIOS autonomously captures the boot device identifier, stores it in a dedicated data structure, and performs security validation automatically during the boot process, eliminating the need for manual tracking while enhancing security monitoring capability.
Solution Approach 2:
The patent introduces an intermediary mechanism by using a dedicated boot history data structure and security database as intermediaries between the boot process and the operating system. The BIOS interacts with these intermediaries to record and validate boot source information, providing a buffer that enables security monitoring without directly complicating the user-facing system operation.
3Reliability
If anti-virus actions are executed automatically when alternate boot source is detected, then the security protection is improved, but the loss of time during boot process increases
Solution Approach 1:
The system performs preliminary action by validating the boot source during the BIOS initialization phase before the operating system loads. By checking the boot device identifier against the security database early in the boot process, the system can make security decisions before full system initialization begins, minimizing the time impact on the overall boot sequence.
Solution Approach 2:
The patent implements skipping by allowing the boot process to proceed rapidly when the boot source is verified as trusted. The security validation occurs in the background during BIOS initialization, and if the boot source is authorized, the system skips extended security checks and proceeds directly to operating system loading, maintaining fast boot times for legitimate operations.
Data Source
AI summary
A computer determines whether it has been booted from a hard disk drive or from an alternate source (e.g., a floppy drive or portable memory) that entails a higher risk of importing a virus into the computer, and if it is determined that a non-HDD source was booted from, corrective action such as a virus scan can be preemptively taken.