EFI Gateway Module for Hardware-Hardened Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Information Handling Systems (IHSs) face challenges in effectively identifying malware infiltration in the BIOS, as not all changes to boot code are malicious, and existing safe boot processes may fail to detect certain types of malware.
Innovation Solution
The implementation of a hardware-hardened advanced threat protection system that includes a processor, BIOS, and an EFI gateway module, which launches immediately after Power-On Self-Test (POST) to determine the presence of malware by applying a behavior-based threat model using an off-host authentication processing system, storing the threat model in segregated off-host memory, and comparing it with a reference template to alert users or halt the process if compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional safe boot processes compare BIOS present state with known good code, then changes can be detected, but false positives occur because not all changes are malicious
Solution Approach 1:
The patent transitions from comparing static code states to analyzing dynamic behavioral parameters during boot. The EFI gateway module monitors runtime behavior characteristics such as execution flow patterns, memory access patterns, and timing parameters to distinguish malicious from legitimate changes, reducing false positives while improving detection accuracy
Solution Approach 2:
The EFI gateway module serves as an intermediary layer between the BIOS and the operating system. It intercepts and analyzes boot-time operations, providing a neutral observation point that can identify malware behavior without directly modifying BIOS code or triggering false alerts from legitimate updates
2Reliability
If conventional safe boot processes halt on detected changes, then security is maintained, but legitimate updates are blocked
Solution Approach 1:
The system dynamically adjusts its response based on threat analysis results. Rather than statically halting all changes, the EFI gateway module continuously evaluates behavioral parameters and adapts its security measures in real-time, allowing legitimate updates to proceed while blocking confirmed malicious activities
Solution Approach 2:
The system implements feedback mechanisms where detection results inform subsequent security decisions. The EFI gateway module analyzes boot behavior, provides feedback on threat likelihood, and adjusts security responses accordingly, enabling both security maintenance and legitimate system updates through iterative evaluation
3Reliability
If behavior-based threat model is stored in off-host memory, then security is enhanced, but system complexity increases
Solution Approach 1:
The system segments security functions into distinct modules: the EFI gateway module handles boot-time analysis, the off-host authentication processing system manages threat model storage and verification, and the BIOS performs standard initialization. This segmentation distributes complexity across specialized components rather than concentrating it in one place
Data Source
AI summary
Systems and methods for hardware hardened advanced threat protection are described. In some embodiments, an Information Handling System (IHS) may include a processor; and a Basic Input/Output System (BIOS) coupled to the processor, the BIOS having BIOS instructions stored thereon that, upon execution, cause the IHS to: launch an Extensible Firmware Interface (EFI) gateway module; and determine, using the EFI gateway module, whether the BIOS instructions include malware.