Rootkit Detection via Storage Subsystem Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information handling systems are vulnerable to sophisticated rootkits that evade detection by subverting operating systems, anti-virus/anti-malware software, and system administrators, especially in environments with encryption and remote storage, making it difficult and costly for organizations to maintain high security standards.
Innovation Solution
Implementing security-aware storage components and communication interfaces with a cloud-based security host that integrates security technology across system layers, performs external verification, and utilizes multiple signature databases, along with dedicated security servers and administrative controls, to detect hidden malware and rootkits across various system configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional rootkit detection methods are used within the operating system, then detection can be performed, but sophisticated rootkits can subvert the operating system and anti-virus software to avoid detection
Solution Approach 1:
The patent introduces a storage subsystem with a management interface as an intermediary between the rootkit detection system and the storage drive. This intermediary operates at a lower level than the operating system, allowing detection of rootkits that may be subverting OS-level security software. The management interface enables direct access to storage data blocks for verification without relying on OS-provided information that could be compromised.
Solution Approach 2:
Instead of trusting the operating system to provide accurate information about storage contents, the patent inverts the approach by having the storage subsystem itself verify data integrity through digital signatures. The management interface directly reads data blocks and verifies them against cryptographic signatures, reversing the traditional model where the OS is the trusted authority.
2Reliability
If encryption technology and virtualization are implemented to enhance security, then system protection is improved, but rootkit detection becomes more complicated
Solution Approach 1:
The patent applies preliminary action by pre-storing cryptographic signatures of legitimate data blocks in a signature database before rootkit detection is needed. During operation, the management interface can quickly verify data blocks by comparing them against these pre-computed signatures, enabling efficient detection even in encrypted or virtualized environments where direct inspection would be complex.
3Reliability
If organizations maintain high security standards with dedicated security administrators and multiple signature databases, then detection assurance is improved, but administrative and computational resources increase significantly
Solution Approach 1:
The patent extracts the complex security management functions from the local organization and relocates them to a remote security service provider. The management interface communicates with external signature databases and security services over a network, allowing organizations to benefit from high-assurance detection capabilities without maintaining complex local security infrastructure or specialized administrative staff.
Data Source
AI summary
A rootkit detection method includes obtaining, from a target system, first data comprising raw data stored in a data block of a storage drive, checking the first data for known malware, and generating a first alert if known malware is detected. The drive may include a public key, the first data may include a digital signature based on the key, and checking the first data may include validating the signature. The method may be performed by a system management resource that sends a management request for a particular data block. Second data, corresponding to an operating system access of the particular data block, may be obtained and compared to the first data. Responsive to detecting a discrepancy, generating a second alert. The system management resource may be a cloud based server, a premise installed appliance, premise installed security server, or a management controller of the target system.