Extensible firmware interface virus scan

• US 6,907,524 B1
• Filed: 10/13/2000
• Issued: 06/14/2005
• Est. Priority Date: 10/13/2000
• Status: Expired due to Fees

• Current Assignee: Kinglite Holdings Inc.
• Original Assignee: Phoenix Technologies Limited (Pharaoh Acquisition LLC)
• Inventors: Huntington, II, Jonathan T., Bramley, Jr., Richard A.
• Primary Examiner(s): LAFORGIA, CHRISTIAN A
• Application Number:
  US09/687,008
• Time in Patent Office: 1,705 Days
• Field of Search: 713/164, 713/200, 713/1, 713/2, 380/28
• US Class Current: 713/164
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

A secure method for implementing virus protection on a computer system including an Extensible Firmware Interface (EFI), a hard disk, a nonvolatile memory and a BIOS is disclosed. A command is added to the command shell of the EFI which results in the automatic copying of the boot sector of the hard disk to the nonvolatile memory when the computer system is initialized. The boot sector of the hard disk is automatically read back from the nonvolatile memory on each boot, which bypasses the boot sector access of the hard disk during system initialization; thereby, protecting the computer system from and eliminating potential viruses. The command shell of the EFI may also be modified to include a command to include a security signature input field. The required signature is provided by the user prior to updating the stored boot sector.

Claims

1. A method for providing virus protection of a computer system including a central processing unit, a hard disk, a nonvolatile memory, an Extensible Firmware Interface, and a basic input and output system, the method comprising the steps of:

modifying a command shell of the Extensible Firmware Interface to include a command that operates to copy a boot sector of the hard disk to the nonvolatile memory;

storing the modified Extensible Firmware Interface in the nonvolatile memory;

when the computer system is initialized, copying the boot sector of the hard disk to the nonvolatile memory;

reading back the boot sector of the hard disk from the nonvolatile memory on each boot to bypass boot sector access of the hard disk during system initialization.

2. The method recited in claim 1 further comprising the steps of:

adding a field to a BIOS SETUP portion of the BIOS, that allows a user to enable or disable reading the boot record from nonvolatile memory on boot;

running the BIOS SETUP portion of the BIOS; and

enabling or disabling reading the boot record from nonvolatile memory on boot.

3. The method recited in claim 2 further comprising the steps of:

further modifying the command shell of the Extensible Firmware Interface to include a security signature input field;

during execution of the Extensible Firmware Interface, displaying the security signature input field to a user; and

receiving the required signature prior to updating the stored boot sector.

4. The method recited in claim 1 further comprising the steps of:

further modifying the command shell of the Extensible Firmware Interface to include a security signature field;

during execution of the Extensible Firmware Interface, displaying the security signature input field to a user; and

receiving the required signature prior to updating the stored boot sector.

5. The method recited in claim 1 wherein the modified Extensible Firmware Interface is stored in a read-only memory.

6. The method recited in claim 1 wherein the modified Extensible Firmware Interface is stored in a flash memory.

7. A system for providing virus protection, comprising:

a processor; and

a nonvolatile memory, coupled to the processor, the nonvolatile memory maintaining instructions that when executed by the processor, cause the processor to;

modify a command shell of an Extensible Firmware Interface to include a command that operates to copy a boot sector of a hard disk to the nonvolatile memory,

store the modified Extensible Firmware Interface in the nonvolatile memory,

copy the boot sector of the hard disk to the nonvolatile memory when the system is initialized,

read back the boot sector of the hard disk from the nonvolatile memory on each boot to bypass boot sector access of the hard disk during system initialization.

8. The system of claim 7, wherein the nonvolatile memory further includes instructions that when executed by the processor, cause the processor to:

add a field to a setup portion of BIOS that allows a user to enable or disable reading of the boot record from nonvolatile memory;

run the setup portion of the BIOS; and

enable or disable reading of the boot record from nonvolatile memory on boot.

9. The system of claim 8, wherein the nonvolatile memory further includes instructions that when executed by the processor, cause the processor to:

further modify the command shell to include a security signature input field;

display the security signature input field to a user during execution of an Extensible Firmware Interface; and

receiving the security input prior to updating the stored boot sector.

10. The system of claim 7, wherein the nonvolatile memory further includes instructions that when executed by the processor, cause the processor to:

further notify the command shell to include a security signature input field;

display the security signature input field to a user during execution of an Extensible Firmware Interface; and

receiving the security input prior to updating the stored boot sector.

11. The system of claim 7, wherein the Extensible Firmware Interface is stored in a read-only memory.

12. The system of claim 7, wherein the Extensible Firmware Interface is stored in a flash memory.