Interrupt Vector Table Manipulation for Secure Boot Malware Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods are inadequate for mitigating malware threats during the booting sequence of computing devices, as they often deactivate systems, leading to significant downtime, especially in critical environments, and require hardware-specific configurations like Intel's Trusted Execution Technology.
Innovation Solution
Manipulating parameters associated with the interrupt vector table (IVT) to force a computing device into a clean state by replacing unused interrupt vectors with custom functions, implementing function filters, and erasing memory locations not holding the IVT or interrupt vector functions, thereby removing pre-existing malware and ensuring a trusted boot process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Intel's Trusted Execution Technology (TXT) is used to detect and mitigate malware during booting, then malware detection capability is improved, but system availability deteriorates due to device deactivation and extended downtime
Solution Approach 1:
The patent extracts the malware mitigation function from the operating system layer and implements it at the firmware/BIOS layer through custom interrupt vector functions. This allows security checks to occur before the OS loads, preventing malware from establishing control while avoiding the need to deactivate the entire system when threats are detected.
Solution Approach 2:
The patent performs security validation during the boot sequence by establishing custom interrupt vector functions before the operating system loads. This preliminary action prevents malware from executing during critical system initialization, eliminating the need for post-detection shutdowns and maintaining system availability.
2Reliability
If anti-virus programs are loaded within the operating system, then malware protection is provided, but protection effectiveness deteriorates against boot-time malware that loads before the OS
Solution Approach 1:
The patent implements security validation during the boot sequence by establishing custom interrupt vector functions before the operating system loads. This preliminary action prevents malware from executing during critical system initialization, eliminating the need for post-detection shutdowns and maintaining system availability.
Solution Approach 2:
The patent segments the boot process into distinct phases with security checks at critical transition points. By dividing the boot sequence and inserting validation at specific stages (interrupt vector establishment, memory initialization), the system can detect and block malware at multiple checkpoints rather than relying on a single post-OS antivirus scan.
3Reliability
If system shutdown is implemented upon malware detection, then security is improved, but system downtime increases significantly
Solution Approach 1:
The patent performs security validation during the boot sequence by establishing custom interrupt vector functions before the operating system loads. This preliminary action prevents malware from executing during critical system initialization, eliminating the need for post-detection shutdowns and maintaining system availability.
Solution Approach 2:
The patent converts the potential harm of malware execution into a benefit by using the boot sequence itself as the detection and mitigation mechanism. The system leverages the mandatory boot process to perform security checks, turning a vulnerable period into an opportunity for proactive threat prevention without requiring system shutdowns.
Data Source
AI summary
Methods for reducing the impact of malware during a booting sequence for an interrupt driven computing device are disclosed. One or more parameters associated with an interrupt vector table (IVT) are manipulated to force the computing device into a clean state following a system level portion of the booting sequence. In another embodiment, occurring prior to the loading of an operating system or a call to a non-returnable main( ) function, one or more unused interrupt vectors in an IVT are replaced. A function filter is implemented for one or more interrupt vectors in the IVT to disallow unnecessary interrupt functions from being executed. One or more required interrupt vector functions are replaced with one or more corresponding custom vector functions. One or more memory locations are wiped if the one or more memory locations do not hold at least a portion of the IVT and/or the interrupt vector functions.