Firmware Retrieval Through Bus Filter Drivers for Pre-OS Security Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting security exploits in firmware after an operating system has loaded pose risks to system performance and can cause issues like race conditions, and pre-OS scans are often inadequate.
Innovation Solution
A bus filter driver and security agent components are used to retrieve and analyze firmware images, providing security status determination through comparison with prevalence information, expected values, and whitelists or blacklists, utilizing a remote security service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security software accesses different memory locations to scan firmware after OS has loaded, then security detection capability is improved, but system performance is degraded
Solution Approach 1:
The patent performs firmware scanning actions before the operating system fully loads and before security software is executed. By conducting security scans during the pre-OS initialization phase, the system detects firmware exploits before they can interfere with normal system operations, thus maintaining both security detection capability and system performance.
2Reliability
If firmware scans are performed using command line tools before OS has loaded, then security detection is achieved, but the scanning capability is limited and inadequate
Solution Approach 1:
The patent introduces a dedicated security agent as an intermediary component that operates during the pre-OS phase. This security agent provides enhanced scanning capabilities compared to simple command line tools, enabling comprehensive firmware analysis while maintaining compatibility with the pre-OS environment. The security agent acts as a bridge between the initialization process and security detection requirements.
3Reliability
If security software accesses memory locations to find and scan firmware, then security scanning is enabled, but race conditions and other issues are caused
Solution Approach 1:
The patent performs firmware scanning before the operating system and security software are executed, eliminating the race conditions that occur when multiple processes compete for memory access. By completing the security scan during the pre-OS initialization phase, the system ensures stable memory access without interference from concurrent operations.
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
A bus filter driver and security agent components configured to retrieve and analyze firmware images are described herein. The bus filter driver may attach to a bus device associated with a memory component and retrieve a firmware image of firmware stored on the memory component. The bus filter driver may also retrieve hardware metadata. A kernel-mode component of the security agent may then retrieve the firmware image and hardware metadata from the bus filter driver and provide the firmware image and hardware metadata to a user-mode component of the security agent for security analysis. The security agent components may then provide results of the analysis and/or the firmware image and hardware metadata to a remote security service to determine a security status for the firmware.