SYSTEMS AND METHODS FOR PROVIDING ANTI-MALWARE PROTECTION AND MALWARE FORENSICS ON STORAGE DEVICES

• US 20170109526A1
• Filed: 10/20/2015
• Published: 04/20/2017
• Est. Priority Date: 10/20/2015
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: THADIKARAN, Paul J., WRIGHT, Adam Greer, SAXENA, Paritosh, TRIANTAFILLOU, Nicholas D., BOWEN, Thomas R.
• Application Number:
  US14/918,422
• Publication Number:
  US 20170109526A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

Systems and methods for providing features that enable anti-malware protection on storage devices are described. In one embodiment, a storage device includes a controller, firmware, and memory. The controller manages input/output operations for the storage device. The firmware provides features for protection against malware. The memory includes secure storage that is configured to provide a set of storage operations.

Claims

1. A system, comprising:

an operating system for performing operations on the system;

a storage device to communicate with the operating system, the storage device comprises, firmware to provide features for protection against malware; and

memory having configurable secure storage that is configured to monitor activity or restrict activity in the secure storage.

2. The system of claim 1, wherein the memory comprises a secure log to record activity of the system.

3. The system of claim 2, wherein the secure log enables storing a unique sequence of commands that are given to the storage device along with configurable parameters.

4. The system of claim 2, wherein the secure log is accessed by an authenticated external entity to determine if the activity recorded in the log is suspicious.

5. The system of claim 4, wherein the authenticated external entity using the firmware configures a region of the secure storage to monitor activity or restrict activity in the secure storage based on determination of suspicious activity.

6. The system of claim 5, wherein the authenticated external entity using the firmware configures unused space at an end region near an end of the memory to redirect access to the secure storage.

7. The system of claim 6, wherein a read request or a write request that is intended for the unused space near the end region is redirected to the secure storage.

8. A storage device comprising:

a controller to manage input/output operations for the storage device;

firmware being implemented with the controller, the firmware to provide features for protection against malware; and

memory communicatively coupled to the controller, the memory having secure storage that is configured to provide a set of storage operations.

9. The storage device of claim 8, wherein the firmware allows the secure storage to be written by an authenticated entity or user.

10. The storage device of claim 9, wherein the firmware comprises a first set of features that allow the secure storage to be written by the authenticated entity or user.

11. The storage device of claim 10, wherein the firmware does not allow the secure storage to be overwritten.

12. The storage device of claim 11, wherein the firmware only allows the secure storage to be read from by the authenticated entity or user.

13. The storage device of claim 12, wherein the firmware comprises a second set of features that allow the secure storage to be read only by the authenticated entity or user.

14. The storage device of claim 10, wherein the authenticated external entity using the firmware configures a region of the secure storage to monitor activity or restrict activity in the secure storage based on determination of suspicious activity.

15. A computer-implemented method, comprising:

initiating a secure log with firmware of a storage device of a system based on the detection of a specified event;

maintaining active logging for a specific period of time following the occurrence of the specified event;

completing the secure log; and

storing the secure log in a secure area in the storage device.

16. The computer-implemented method of claim 15, wherein the secure log is accessible only to an authenticated entity or user.

17. The computer-implemented method of claim 16, wherein the secure log is independent of an operating system of the system.

18. The computer-implemented method of claim 15, wherein the specified event comprises one or more illegal command parameters.

19. The computer-implemented method of claim 15, wherein the secure log provides a data trail for any type of malicious activity.

20. The computer-implemented method of claim 15, wherein malware is not able to modify or delete the secure log.