Pre-Boot FDE Malware Scanning With Reputation Service Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The pre-boot environment in Full Disk Encryption (FDE) systems lacks access to online reputation services for performing malware scans due to the absence of network configuration, leaving computers vulnerable to malware threats before the main operating system is loaded.
Innovation Solution
A system and method that leverages the FDE pre-boot environment to conduct anti-malware scans by using processor circuitry to identify indicators in targeted memory and communicate with a reputation service for feedback, enabling malware identification and mitigation before the operating system loads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the FDE pre-boot environment is used to conduct malware scans, then security is enhanced by identifying threats before OS load, but the pre-boot environment lacks network configuration preventing access to online reputation services
Solution Approach 1:
The patent performs malware scanning actions in the pre-boot environment before the operating system loads, utilizing available pre-boot resources to identify threats early. This preliminary action enables security checks to occur before full system initialization, resolving the contradiction by making use of the pre-boot environment's capabilities rather than being limited by its lack of network configuration.
Solution Approach 2:
The patent introduces an intermediary mechanism that bridges the pre-boot environment and online reputation services. This intermediary enables the pre-boot environment to access external reputation data despite lacking native network configuration, allowing malware indicators to be checked against online databases without requiring the pre-boot environment to have direct network access capabilities.
2Reliability
If full disk encryption is implemented, then data security is improved, but scanning duration and resource usage increase during startup
Solution Approach 1:
The patent performs a focused malware scan on specific indicators and targeted memory regions during pre-boot rather than a comprehensive full-system scan. This partial action approach maintains security by checking critical areas for threats while significantly reducing scanning duration and resource consumption compared to exhaustive scanning methods.
Solution Approach 2:
The patent applies different scanning strategies to different memory regions and objects based on their importance and risk level. Critical system areas receive thorough inspection while less critical regions use lighter checking methods. This localized quality approach ensures high security for essential components while minimizing overall scanning time and resource usage during the pre-boot phase.
Data Source
AI summary
A computer device, system, and method are provided for leveraging the Full Disk Encryption (FDE) pre-boot environment to conduct anti-malware scans during computer startup, enhancing security by identifying and mitigating malware threats before the main operating system is loaded. To do so, a processor circuitry of the computer device identifies indicators for objects stored in a targeted memory to be scanned. The processor circuitry sends the indicators to a reputation service via a communication interface and receives feedback concerning whether the objects are malicious, suspicious, or benign.