PROVIDING AUTHENTICATED ANTI-VIRUS AGENTS A DIRECT ACCESS TO SCAN MEMORY

• US 20110107423A1
• Filed: 10/30/2009
• Published: 05/05/2011
• Est. Priority Date: 10/30/2009
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Kolar Sunder, Divya Naidu, Khosravi, Hormuzd M., Durham, David M.
• Granted Patent: US 9,087,188 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/567 using dedicated hardware

Abstract

A computer platform may support anti-virus agents that may be provided access to directly scan the memory. The computer platform may comprise a platform control hub, which may comprise a manageability engine and a virtualizer engine, wherein the manageability engine may allow the anti-virus agents to be downloaded to a platform hardware space that is isolated from an operating system. The manageability engine may authenticate the anti-virus agents and provide an access for the anti-virus agents to directly scan a memory or a storage device coupled to the platform hardware.

Claims

1. A method in a computer platform comprising:

allowing anti-virus agents to be downloaded to a platform hardware space that is isolated from an operating system coupled to the computer platform,

authenticating the anti-virus agents, and

providing an access for the anti-virus agents to directly scan a memory coupled to the computer platform.

2. The method of claim 1, wherein the anti-virus agents are authenticated by verifying the source from which the anti-virus agents are downloaded, wherein the anti-virus agents are downloaded to a third party data storage provisioned within the platform hardware.

3. The method of claim 2, wherein the anti-virus agent is inhibited from processing if the authentication of the anti-virus agent fails.

4. The method of claim 2, wherein the anti-virus agents are provided a direct access to scan a storage device coupled to the computer platform if the authentication of the anti-virus agent is successful.

5. The method of claim 4, wherein the anti-virus agents are provided a direct access to scan the memory through a direct memory access engine if the authentication of the anti-virus agent is successful.

6. The method of claim 1 comprises authenticating a scripting engine before using the scripting engine to support the anti-virus agents to scan the memory through the direct memory access engine.

7. The method of claim 6 comprises authenticating the scripting engine by verifying a signature of the scripting engine with a key, wherein the key is stored in a flash device.

8. The method of claim 7, wherein the scripting engine is deleted from a static random access memory if the signature of the scripting engine mismatches with the key stored in the flash device.

9. The method of claim 2, wherein the anti-virus agents are provided a direct access to scan the storage device through a virtualizer engine.

10. The method of claim 1 further comprises scanning the operating system using processor state information, wherein the scanning is performed by a remote server in response to receiving the processor state information.

16. The apparatus of claim 10, wherein the controller is to support a scripting engine, wherein the authentication engine is to authenticate the scripting engine before using the scripting engine to support the anti-virus agents to scan the memory through the direct memory access engine.

17. The apparatus of claim 16, wherein the authentication engine is to authenticate the scripting engine by verifying a signature of the scripting engine with a key, wherein the key is stored in a flash device.

18. The apparatus of claim 17, wherein the controller is to delete the scripting engine from a static random access memory if the signature of the scripting engine mismatches with the key stored in the flash device.

11. An apparatus comprising:

a platform control hub comprising a manageability engine, wherein the manageability engine is to,

store the anti-virus agents downloaded to a platform hardware space that is isolated from an operating system coupled to the computer platform,

authenticate the anti-virus agents, and

provide an access for the anti-virus agents to directly scan a memory coupled to the platform hardware.

12. The apparatus of claim 11 the manageability engine further comprises an authentication engine, wherein the authentication engine is to authenticate the anti-virus agents by verifying the source from which the anti-virus agents are downloaded, wherein the anti-virus agents are downloaded to a third party data storage provisioned within the platform hardware.

13. The apparatus of claim 12 the manageability engine further comprises a controller block, wherein the controller block is to inhibit the anti-virus agent from getting processing if the authentication of the anti-virus agent fails.

14. The apparatus of claim 12, wherein the controller is to provide a direct access for the anti-virus agents to scan a storage device coupled to the computer platform if the authentication of the anti-virus agent is successful.

15. The apparatus of claim 14 the manageability engine further comprises a direct memory access engine, wherein the direct memory access engine is to support the anti-virus agents to directly scan the memory if the authentication of the anti-virus agent is successful.

19. The apparatus of claim 12 further comprises a virtualizer engine, wherein the virtualizer engine is to provide the anti-virus agents a direct access to scan the storage device through the virtualizer engine.

20. The apparatus of claim 11 the manageability engine is to provide processor state information to a remote server that is used to scan the operating system.