Cyber security boot status markers

Solution Overview

Problem

Conventional antimalware drivers often block critical boot-start drivers during the boot process, leading to endless boot loops and system failures, as they lack the ability to differentiate between essential and non-essential drivers.

Innovation Solution

Implementing boot status markers that record the success or failure of previous boot processes, allowing antimalware drivers to classify drivers as boot critical or non-boot critical, ensuring critical drivers are loaded and non-critical drivers are blocked, thereby preventing boot loops.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If antimalware drivers block unknown or suspicious drivers during boot process, then cyber security protection is improved, but system reliability deteriorates due to potential blocking of critical boot-start drivers causing boot loops

Engineering Contradiction:

Improvesystem reliabilityVSAvoidmalicious driver execution

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary classification of drivers as boot-critical or non-boot-critical before the boot process begins. Boot status markers are pre-established in a database, allowing the antimalware driver to immediately recognize and allow boot-critical drivers without blocking them, while still blocking suspicious non-critical drivers. This preliminary categorization prevents boot loops by ensuring critical drivers are never blocked.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system uses boot status markers that record whether previous boot processes succeeded or failed. This feedback mechanism allows the antimalware driver to learn from past boot outcomes and adjust its blocking decisions. If blocking a driver caused a boot failure, the system records this and prevents future blocking of that driver, creating a self-learning security system that improves reliability while maintaining protection.

Inventive Principle:

Principle #23Feedback

2Object-affected harmful factors

If antimalware drivers block all suspicious drivers, then security protection is improved, but system availability deteriorates due to boot loops

Engineering Contradiction:

Improvemalicious driver executionVSAvoidsystem availability

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The system performs preliminary classification of drivers as boot-critical or non-boot-critical before the boot process begins. Boot status markers are pre-established in a database, allowing the antimalware driver to immediately recognize and allow boot-critical drivers without blocking them, while still blocking suspicious non-critical drivers. This preliminary categorization prevents boot loops by ensuring critical drivers are never blocked.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system uses boot status markers that record whether previous boot processes succeeded or failed. This feedback mechanism allows the antimalware driver to learn from past boot outcomes and adjust its blocking decisions. If blocking a driver caused a boot failure, the system records this and prevents future blocking of that driver, creating a self-learning security system that improves reliability while maintaining protection.

Inventive Principle:

Principle #23Feedback

3Productivity

If antimalware drivers allow all drivers to execute, then system availability is improved, but security protection deteriorates due to malicious driver execution

Engineering Contradiction:

Improvesystem availabilityVSAvoidmalicious driver execution

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system segments drivers into distinct categories: boot-critical drivers, non-boot-critical drivers, and suspicious drivers. This segmentation is based on boot status markers that track historical boot success/failure data. By dividing the driver population into segments with different security policies, the system can allow critical drivers to execute freely while blocking suspicious ones, achieving both high availability and security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system applies different security inspection qualities to different driver segments. Boot-critical drivers receive minimal or no security inspection to ensure system availability, while non-critical and suspicious drivers undergo thorough security scanning. This local differentiation of security quality allows the system to maintain high availability for essential functions while providing strong protection against malicious drivers.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS12380215B2Cyber security boot status markers

Publication Date: 2025.08.05 CROWDSTRIKE

AI summary

Boot status markers record historical boot processes performed by a computer system. Each time the computer system boots, an operating system performs a boot process and interfaces with an antimalware driver. The antimalware driver determines the boot status markers that were set during previous boot processes. The antimalware driver may then classify other drivers based on the boot status markers set during the previous boot processes. The antimalware driver may then report driver classifications to the operating system. The operating system may then block, or allow, the drivers based on the driver classifications.