Security Chip Pre-Boot Anti-Virus Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus methods are ineffective in preventing malicious programs from running before and during the operating system startup, as they rely on post-startup virus scanning and lack secure pre-startup monitoring and restoration mechanisms.
Innovation Solution
An anti-virus method utilizing a security chip as a trusted root for safe backup and restoration of key files like BIOS and MBR code files, and real-time monitoring, involving hashing operations to verify integrity and prevent malicious program execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a virus scanning engine is used to scan and monitor memory and hard disk files after operating system startup, then known viruses can be detected, but processes before and during operating system startup cannot be monitored
Solution Approach 1:
The patent performs virus scanning and integrity verification before the operating system starts up. The BIOS scans the boot sector and critical system files during the pre-boot phase, before handing control to the operating system. This preliminary action ensures that malicious code is detected and prevented from executing in the first place, rather than waiting for post-startup scanning.
Solution Approach 2:
The patent introduces a trusted platform module (TPM) and secure boot mechanism as an intermediary layer between the hardware and the operating system. This intermediary verifies the integrity of boot components and enforces security policies during the startup process, creating a secure environment before the OS loads, thus enabling pre-startup monitoring without compromising system functionality.
2Reliability
If HPA of hard disk is used to backup kernel file, then backup functionality is achieved, but security is lacking due to lack of TPM security chip technique
Solution Approach 1:
The patent extracts the security verification function from the general backup mechanism and implements it in a dedicated TPM security chip. The TPM separately handles cryptographic operations and integrity verification of backup files, while the HPA continues to provide storage. This separation allows the backup system to maintain its functionality while adding robust security through the specialized security chip.
Solution Approach 2:
The patent creates a composite security architecture combining HPA (for backup storage) with TPM (for security verification). The HPA provides the backup capability while the TPM provides cryptographic protection, hash verification, and secure key management. Together they form a unified backup system that achieves both functionality and security, protecting against tampering and unauthorized access.
3Reliability
If hash value verification is performed once for system files, then integrity checking is achieved, but double hashing provides enhanced security against sophisticated attacks
Solution Approach 1:
The patent pre-calculates and stores the double-hash values of critical system files in a secure database during system initialization or installation. This preliminary computation of hash(hash(file)) creates a reference value that can be quickly verified later without repeating the complex double hashing operation, thus enabling enhanced security verification while maintaining efficient runtime performance.
Data Source
Figure 1
Figure 2
AI summary
An anti-virus method based on a security chip according to the present invention is provided. The method comprises the following steps: a hash value obtained by a hashing operation for a computer key file and a system control program are stored in a memory of the security chip, and a backup file of the computer key file is stored in a backup storage area. When power up, the integrity of the system control program is verified by using the hash value of the system control program stored in the memory of the security chip. If the system control program is integral, a control is executed by the system control program, and the system control program verifies the integrity of the computer key file using the hash value of the computer key file stored in the memory of the security chip. If all the computer key files are integral, the operating system is started; on the contrary, if any of the computer key file is not integral, it will be restored using the backup file of the computer key file stored in the backup storage area.