BOOTSTRAP OS PROTECTION AND RECOVERY

• US 20170213035A1
• Filed: 03/11/2016
• Published: 07/27/2017
• Est. Priority Date: 02/12/2008
• Status: Active Grant

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Horvath, Akos, Faieta, Alessandro
• Granted Patent: US 10,002,251 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method, system, and computer program product for protecting a computer system provides bootstrap operating system detection and recovery and provides the capability to detect malware, such as rootkits, before the operating system has been loaded and provides the capability to patch malfunctions that block the ability of the computer system to access the Internet. A method for protecting a computer system includes reading stored status information indicating whether network connectivity was available the last time an operating system of the computer system was operational, when the stored status information indicates that network connectivity was not available, obtaining a software patch, and executing and applying the software patch.

Claims

1-24. -24. (canceled)

25. A method, comprising:

verifying an integrity of Basic Input/Output System (BIOS) code;

performing an integrity scan of the BIOS and at least a portion of a bootloader, after the verifying; and

loading and executing the bootloader, after the performing.

26. The method of claim 25, further comprising:

performing an integrity scan of anti-malware software, after the verifying;

loading the anti-malware software, after an operating system boots; and

performing a scan with the anti-malware software to ensure a network connectivity is available.

27. The method of claim 26, further comprising:

constructing a system environment for the operating system, before the loading the anti-malware software.

28. The method of claim 25, wherein the performing is performed by software loaded by a first sector of a hard disk drive.

29. The method of claim 28, further comprising:

restoring the first sector of the hard disk drive based on a detection that the first sector of the hard disk drive has been overwritten.

30. The method of claim 25, further comprising:

loading a network driver, when status information indicates that a network connectivity was not previously available;

downloading a software patch; and

executing and applying the software patch.

31. Computer program instructions, recorded on a non-transitory, computer readable storage medium and executable by a processor, for performing a method, the instructions comprising:

instructions to verify an integrity of Basic Input/Output System (BIOS) code;

instructions to perform an integrity scan of the BIOS and at least a portion of a bootloader, after the integrity of the BIOS code is verified; and

instructions to load and execute the bootloader, after the integrity scan of the portion of the bootloader is performed.

32. The instructions of claim 31, further comprising:

instructions to perform an integrity scan of anti-malware software, after the integrity of the BIOS code is verified;

instructions to load the anti-malware software, after an operating system boots; and

instructions to perform a scan with the anti-malware software to ensure a network connectivity is available.

33. The instructions of claim 32, further comprising:

instructions to construct a system environment for the operating system, before the anti-malware software is loaded.

34. The instructions of claim 31, wherein the integrity scan is performed by software loaded by a first sector of a hard disk drive.

35. The instructions of claim 34, further comprising:

instructions to restore the first sector of the hard disk drive based on a detection that the first sector of the hard disk drive has been overwritten.

36. The instructions of claim 31, further comprising:

instructions to load a network driver, when status information indicates that a network connectivity was not previously available;

instructions to download a software patch; and

instructions to execute and apply the software patch.

37. The instructions of claim 31, further comprising:

instructions to verify a functionality of a processor, wherein the integrity scan is performed by the processor.

38. An apparatus, comprising:

a processor configured to verify an integrity of Basic Input/Output System (BIOS) code, to perform an integrity scan of the BIOS and at least a portion of a bootloader, after the integrity of the BIOS code is verified, and to load and execute the bootloader, after the integrity scan of the portion of the bootloader is performed.

39. The apparatus of claim 38, wherein the processor is further configured to perform an integrity scan of anti-malware software, after the integrity of the BIOS code is verified, to load the anti-malware software, after an operating system boots, and to perform a scan with the anti-malware software to ensure a network connectivity is available.

40. The apparatus of claim 39, wherein the processor is further configured to construct a system environment for the operating system, before the anti-malware software is loaded.

41. The apparatus of claim 38, further comprising:

a hard disk drive, wherein the integrity scan is performed by software loaded by a first sector of the hard disk drive.

42. The apparatus of claim 41, wherein the processor is further configured to restore the first sector of the hard disk drive based on a detection that the first sector of the hard disk drive has been overwritten.

43. The apparatus of claim 38, wherein the processor is further configured to load a network driver, when status information indicates that a network connectivity was not previously available, to download a software patch, and to execute and apply the software patch.

44. The apparatus of claim 38, wherein the processor is further configured to verify a functionality of the processor.