System, method, and computer program product for mounting an image of a computer system in a pre-boot environment for validating the computer system

• US 8,914,887 B2
• Filed: 09/06/2013
• Issued: 12/16/2014
• Est. Priority Date: 03/31/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Dalcher, Gregory W.
• Primary Examiner(s): SHEHNI, GHAZAL B
• Application Number:
  US14/020,467
• Publication Number:
  US 20140173728A1
• Time in Patent Office: 466 Days
• Field of Search: 726 23- 25
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/4403 Processor initialisation
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A system, method, and computer program product are provided for mounting an image of a computer system in a pre-boot environment for validating the computer system. In use, an image of a computer system is mounted in a pre-boot environment of the computer system, where the image includes a file system structure and initialization data of the computer system. Furthermore, at least one task is performed on the mounted image for validating the computer system.

Claims

1. A non-transitory computer readable medium comprising instructions stored thereon that when executed cause a programmable device to:

mount an image of an operating system for a computer system in a pre-boot environment of the programmable device;

identify an untrusted component of the operating system registered to be automatically loaded or loaded during a boot-up stage of the operating system that is predetermined to be early; and

determine, in the pre-boot environment, whether to allow the operating system to load, based on characteristics of the untrusted component.

2. The non-transitory computer readable medium of claim 1, wherein the instruction stored thereon that when executed cause programmable device to determine, in the pre-boot environment, whether to allow the operating system to load, based on characteristics of the untrusted component comprise instructions that when executed cause the programmable device to:

reschedule a load order of the untrusted component.

3. The non-transitory computer readable medium of claim 1, wherein the instruction stored thereon that when executed cause the programmable device to determine, in the pre-boot environment, whether to allow the operating system to load, based on characteristics of the untrusted component comprise instructions that when executed cause the programmable device to:

substitute a trusted component for the untrusted component.

4. The non-transitory computer readable medium of claim 1, wherein the instruction stored thereon that when executed cause the programmable device to determine, in the pre-boot environment, whether to allow the operating system to load, based on characteristics of the untrusted component comprise instructions that when executed cause the programmable device to:

load the operating system without the untrusted component.

5. The non-transitory computer readable medium of claim 1, wherein the instruction stored thereon that when executed cause the programmable device to determine, in the pre-boot environment, whether to allow the operating system to load, based on characteristics of the untrusted component comprise instructions that when executed cause the programmable device to:

abort loading the operating system if the untrusted component is a critical non-substitutable component.

6. The non-transitory computer readable medium of claim 1, wherein the instructions stored thereon further comprise instructions that when executed cause the programmable device to:

monitor a security system of the programmable device during execution of the operating system, to ensure that the security system executes as expected.

7. The non-transitory computer readable medium of claim 1, wherein the pre-boot environment is a virtualized pre-boot environment.

8. The non-transitory computer readable medium of claim 1, wherein the pre-boot environment is provided by a chipset extension.

9. The non-transitory computer readable medium of claim 1, wherein the instruction that when executed cause the computer system to identify an untrusted component of the operating system comprise instructions that when executed cause the programmable device to:

verify a digital signature associated with components of the operating system registered to be automatically loaded or loaded during a boot-up stage of the operating system that is predetermined to be early.

10. A programmable apparatus, comprising:

one or more processors; and

a memory, coupled to the one or more processors, on which are stored instructions, comprising instructions that when executed cause at least some of the one or more processors to;

mount an image of an operating system in a pre-boot environment of the programmable apparatus;

identify an untrusted component of the operating system registered to be automatically loaded or loaded during a boot-up stage of the operating system that is predetermined to be early; and

determine, in the pre-boot environment, whether to allow the operating system to load, based on characteristics of the untrusted component.

11. The programmable apparatus of claim 10, wherein the programmable apparatus is a mobile device.

12. The programmable apparatus of claim 10, wherein the programmable apparatus is an embedded programmable device.

13. The programmable apparatus of claim 10, wherein the instructions that when executed cause at least some of the one or more processors to determine, in the pre-boot environment, whether to allow the operating system to load, based on characteristics of the untrusted component comprise instructions that when executed cause at least some of the one or more processors to:

reschedule a load order of the untrusted component.

14. The programmable apparatus of claim 10, wherein the instructions that when executed cause at least some of the one or more processors to determine, in the pre-boot environment, whether to allow the operating system to load, based on characteristics of the untrusted component comprise instructions that when executed cause at least some of the one or more processors to:

substitute a trusted component for the untrusted component.

15. The programmable apparatus of claim 10, wherein the instructions that when executed cause at least some of the one or more processors to determine, in the pre-boot environment, whether to allow the operating system to load, based on characteristics of the untrusted component comprise instructions that when executed cause at least some of the one or more processors to:

load the operating system without the untrusted component.

16. The programmable apparatus of claim 10, wherein the instruction that when executed cause at least some of the one or more processors to determine, in the pre-boot environment, whether to allow the operating system to load, based on characteristics of the untrusted component comprise instructions that when executed cause at least some of the one or more processors to:

abort loading the operating system if the untrusted component is a critical non-substitutable component.

17. The programmable apparatus of claim 10, wherein the instructions that are stored in the memory further comprise instructions that when executed cause the at least some of the one or more processors to:

monitor a security system of the programmable apparatus during execution of the operating system, to ensure that the security system executes as expected.

18. The programmable apparatus of claim 10, wherein the one or more processors and memory are virtualized.

19. A method of controlling loading of an operating system, comprising:

analyzing an image of an operating system in a pre-boot environment of a programmable device;

identifying an untrusted component of the operating system configured to be automatically loaded or loaded during a boot-up stage of the operating system that is predetermined to be early; and

determining, in the pre-boot environment, whether to load the operating system, based on characteristics of the untrusted component.

20. The method of claim 19, further comprising:

determining whether the untrusted component is a non-substitutable component; and

aborting loading the operating system in the programmable device if the untrusted component is a critical non-substitutable component.