Bootstrap OS protection and recovery

• US 10,002,251 B2
• Filed: 03/11/2016
• Issued: 06/19/2018
• Est. Priority Date: 02/12/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Horvath, Akos, Faieta, Alessandro
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/068,069
• Publication Number:
  US 20170213035A1
• Time in Patent Office: 830 Days
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method, system, and computer program product for protecting a computer system provides bootstrap operating system detection and recovery and provides the capability to detect malware, such as rootkits, before the operating system has been loaded and provides the capability to patch malfunctions that block the ability of the computer system to access the Internet. A method for protecting a computer system includes reading stored status information indicating whether network connectivity was available the last time an operating system of the computer system was operational, when the stored status information indicates that network connectivity was not available, obtaining a software patch, and executing and applying the software patch.

Claims

1. A method, comprising:

verifying an integrity of a Basic Input/Output System (BIOS);

performing an integrity scan of the BIOS, at least a portion of a bootloader and anti-malware software, after the verifying;

loading and executing the bootloader, after the performing;

loading the anti-malware software, after an operating system boots; and

performing a scan with the anti-malware software to ensure a network connectivity is available.

2. The method of claim 1, further comprising:

constructing a system environment for the operating system, before the loading the anti-malware software.

3. The method of claim 1, wherein the performing the integrity scan is performed by software loaded by a first sector of a hard disk drive.

4. The method of claim 3, further comprising:

restoring the first sector of the hard disk drive based on a detection that the first sector of the hard disk drive has been overwritten.

5. The method of claim 1, further comprising:

loading a network driver, when status information indicates that the network connectivity was not previously available;

downloading a software patch; and

executing and applying the software patch.

6. The method of claim 5, wherein the loading and downloading are performed before the performing the integrity scan.

7. Computer program instructions, recorded on a non-transitory, computer readable storage medium and executable by a processor, for performing a method, the instructions comprising:

instructions to verify an integrity of a Basic Input/Output System (BIOS);

instructions to perform an integrity scan of the BIOS, at least a portion of a bootloader and anti-malware software, after the integrity of the BIOS is verified;

instructions to load and execute the bootloader, after the integrity scan of the portion of the bootloader is performed;

instructions to load the anti-malware software, after an operating system boots; and

instructions to perform a scan with the anti-malware software to ensure a network connectivity is available.

8. The instructions of claim 7, further comprising:

instructions to construct a system environment for the operating system, before the anti-malware software is loaded.

9. The instructions of claim 7, wherein the integrity scan is performed by software loaded by a first sector of a hard disk drive.

10. The instructions of claim 9, further comprising:

instructions to restore the first sector of the hard disk drive based on a detection that the first sector of the hard disk drive has been overwritten.

11. The instructions of claim 7, further comprising:

instructions to load a network driver, when status information indicates that the network connectivity was not previously available;

instructions to download a software patch; and

instructions to execute and apply the software patch.

12. The instructions of claim 11, wherein the network driver is loaded and the software patch is downloaded before the integrity scan is performed.

13. The instructions of claim 7, further comprising:

instructions to verify a functionality of the processor, wherein the integrity scan is performed by the processor.

14. An apparatus, comprising:

a memory; and

a processor configured to verify an integrity of a Basic Input/Output System (BIOS), to perform an integrity scan of the BIOS, at least a portion of a bootloader and anti-malware software, after the integrity of the BIOS code is verified, to load and execute the bootloader, after the integrity scan of the portion of the bootloader is performed, to load the anti-malware software, after an operating system boots, and to perform a scan with the anti-malware software to ensure a network connectivity is available.

15. The apparatus of claim 14, wherein the processor is further configured to construct a system environment for the operating system, before the anti-malware software is loaded.

16. The apparatus of claim 14, further comprising:

a hard disk drive, wherein the integrity scan is performed by software loaded by a first sector of the hard disk drive.

17. The apparatus of claim 16, wherein the processor is further configured to restore the first sector of the hard disk drive based on a detection that the first sector of the hard disk drive has been overwritten.

18. The apparatus of claim 14, wherein the processor is further configured to load a network driver, when status information indicates that the network connectivity was not previously available, to download a software patch, and to execute and apply the software patch.

19. The apparatus of claim 18, wherein the processor is further configured to load the network driver and to download the software patch before the processor performs the integrity scan.

20. The apparatus of claim 14, wherein the processor is further configured to verify a functionality of the processor.