Preboot Environment Integrity Checks for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Portable operating environments are vulnerable to malware infections when executed on insecure computer systems, making it difficult to detect and remove malware without risking damage to the host system or exposing sensitive information.
Innovation Solution
A secure preboot environment performs integrity checks and anti-malware operations before rebooting into a regular operating environment, using a flash memory device with a read-only section to ensure system files are unchanged and free from malware, and can invoke at various times, including system startup, shutdown, or in response to suspicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software scans for and removes malware in a executing system, then malware detection capability is improved, but system stability deteriorates due to difficulty of detecting and removing malware in running systems
Solution Approach 1:
The patent implements a pre-boot environment that performs malware scanning and system integrity verification before the operating system loads. This preliminary action occurs during the boot process, allowing security checks to be performed on system files and memory before malware can actively infect or interfere with the system, thereby achieving both detection capability and system stability
2Reliability
If the system boots into safe mode for malware scanning, then malware detection capability is improved, but user accessibility deteriorates due to unfettered access to privileged portions
Solution Approach 1:
The patent introduces a pre-boot environment as an intermediary layer between the hardware and the operating system. This intermediary environment provides the necessary privileged access for malware scanning and system verification while isolating these operations from user interaction. The environment automatically executes security checks and then transitions to the normal operating system, eliminating the need for users to manually access privileged portions during the scanning process
3Adaptability or versatility
If portable operating environment is executed on any computer system, then portability is improved, but security deteriorates due to vulnerability to malware on host system
Solution Approach 1:
The patent performs preliminary security verification in the pre-boot environment by checking system files, memory integrity, and hardware security features before the portable operating environment is loaded. This preliminary action ensures that the host system meets security requirements and is free from active malware infections, thereby enabling the portable environment to execute securely on diverse computer systems while maintaining both portability and security
Data Source
Figure 1
Figure 2
AI summary
Booting an operating system that includes a secure preboot environment that performs integrity checks against security threats. A computer system boots to a preboot environment, which performs integrity checks and other anti-malware operations. Once the preboot environment finishes, the system reboots into a regular environment. The preboot environment can reside on a secure portion of a flash memory, with a computer system booting therefrom; or the preboot environment can reside securely in the computer system. The preboot environment includes integrity checks for a regular environment, and anti-malware programming. Once the preboot environment is done, the computer system reboots into a regular environment, such as from the flash memory or on the computer system. The integrity checks confirm that files in the regular environment are unchanged or uninfected. The integrity checks include determining the accuracy of a trusted system configuration on the computer system, such as using a TPM.