Pre-boot securing of operating system (OS) for endpoint evaluation

• US 20100153696A1
• Filed: 12/12/2008
• Published: 06/17/2010
• Est. Priority Date: 12/12/2008
• Status: Active Grant

• Current Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Smith, Merrill K., Beachem, Brent R.
• Granted Patent: US 8,566,571 B2
• Time in Patent Office: Days
• US Class Current: 713/2
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network

Abstract

Methods and apparatus involve evaluating endpoint computing assets. The endpoint has both a traditional operating system for applications, and the like, and another operating system during a pre-boot phase of operation. During use, the traditional operating system identifies a last evaluation status of the computing device at a time just prior to shutting down. Upon a next booting, the pre-boot operating system loads and examines [reads] the last evaluation status. If the last evaluation status requires any completion action in order to comply with a predetermined computing policy, either or both the operating systems attend to its effectuation, including communication/handoff by way of one or more security agents. In a variety of ways, effectuation occurs by: determining a present location of the computing device, quarantining the computing device from certain network traffic; VPN enforcement; patching applications; firewall involvement; etc. Computer program products are also disclosed.

Claims

1. In a computing system environment, a method of securing an operating system of a computing device, comprising:

identifying a last evaluation status of the computing device as the computing device undertakes a last recording event;

upon a next booting of the computing device, loading a pre-boot operating system before said operating system;

by the pre-boot operating system, determining if the last evaluation status requires any completion action; and

if so, effectuating the completion action.

2. The method of claim 1, further including establishing a predetermined computing policy to enforce upon the computing device.

3. The method of claim 2, wherein the determining if the last evaluation status requires any said completion action further includes determining if the last evaluation status complies with the predetermined computing policy.

4. The method of claim 1, wherein the effectuating the completion action further includes writing to and reading from a shared portion of a remote or local storage of the computing device available to both the operating system and the pre-boot operating system.

6. The method of claim 1, wherein the effectuating the completion action further includes quarantining the computing device from certain network traffic.

7. The method of claim 1, wherein the effectuating the completion action further includes determining a current location of the computing device as the computing device serves as an endpoint location in said computing system environment.

8. The method of claim 1, further including configuring the pre-boot operating system in firmware of one or more processors of the computing device.

9. In a computing system environment, a method of securing an operating system of a computing device having a processor, memory and storage upon which the operating systems interacts during use, comprising:

configuring a computing operating system and a pre-boot operating system on the processor;

by the computing operating system, identifying a last evaluation status of the computing device as the computing device undertakes a last recording and writing the last evaluation status on a shared portion of the storage or memory available to both the computing and pre-boot operating systems;

upon a next booting of the computing device, loading the pre-boot operating system;

by the pre-boot operating system, examining the last evaluation status in the shared portion of the storage or memory;

determining if the last evaluation status requires any completion action; and

if so, effectuating the completion action.

10. In a computing system environment, a method of securing an operating system of a computing device, comprising:

identifying a last evaluation status of the computing device as the computing device shuts down;

upon a next booting of the computing device, loading a pre-boot operating system before said operating system;

by the pre-boot operating system, examining the last evaluation status;

determining if the last evaluation status requires any completion action; and

if so, from the pre-boot operating system to said operating system handing-off the completion action for effectuation.

11. The method of claim 10, upon a subsequent shutting down of the computing device, identifying a subsequent last evaluation status of the computing device.

12. The method of claim 10, further including booting applications for use with said operating system after said effectuation of the completion action.

13. In a computing system environment, a method of securing an operating system of a computing device having a processor, memory and storage upon which the operating systems interacts during use, comprising:

configuring a computing operating system and a pre-boot operating system on the processor;

upon booting the computing device, effectuating communication between the computing operating system and the pre-boot operating system by way of an embedded agent; and

upon shutting down the computing device, identifying a last evaluation status of the computing device by the computing operating system so that upon a subsequent booting of the computing device the pre-boot operating system can ascertain whether the last evaluation status requires a completion action and, if so, using the agent to inform the computing operating system of the completion action.

14. A computing device, comprising:

a hardware platform including a processor, memory and available storage; and

a computing operating system and a pre-boot operating system on the processor each having access to a shared portion of the memory or available storage whereby a last evaluation status is configured to be written to and read from regarding whether a completion action is required of the last evaluation status in order to comply with a predetermined computing policy established for the computing device, the last evaluation status of the computing device being configured to be obtained by the computing operating system just prior to shutting down of the computing device.

15. The computing device of claim 14, further including a security agent on the computing operating system to communicate with the pre-boot operating system regarding the last evaluation status and compliance with the predetermined computing policy.

16. The computing device of claim 14, further including a security agent on the pre-boot operating system to communicate with the computing operating system regarding the last evaluation status and compliance with the predetermined computing policy.

17. The computing device of claim 14, further including a wireless connection point for the computing device to wirelessly communicate as an endpoint in a computing system environment.

18. A computing device, comprising:

a hardware platform including a processor, memory and available storage; and

a computing operating system and a pre-boot operating system on the processor each having access to a shared portion of the memory or available storage; and

a security agent configured on one or both of the computing and pre-boot operating systems such that upon shutting down the computing device a last evaluation status of the computing device is configured to be identified by the computing operating system so that upon a subsequent booting of the computing device the pre-boot operating system can ascertain whether the last evaluation status requires a completion action and, if so, using the security agent to inform the computing operating system of the completion action.

19. A computer program product for loading on a computing device to secure an operating system of the computing device, the computer program product having executable instructions that upon shutting down the computing device identify, by the operating system, a last evaluation status of the computing device so that upon a subsequent booting of the computing device a pre-boot operating system can ascertain whether the last evaluation status requires a completion action and, if so, enabling communication between the operating system and the pre-boot operating system regarding effectuation of the completion action.

20. The computer program product of claim 19, further including executable instructions to install a security agent on either or both the operating system and the pre-boot operating system for said enabling communication.

21. The computer program product of claim 19, further including executable instructions for making storage available of the last evaluation status on a shared portion of memory or disk available to the computing device.

22. The computer program product of claim 21, further including executable instructions for making the shared portion available for reading from or writing to by the operating system or the pre-boot operating system.

23. In a computing system environment, a method of evaluating a computing asset having an operating system and serving as an endpoint in the computing system environment, comprising:

configuring a pre-boot operating system on a processor of the computing asset;

upon a next booting of the computing asset, securely loading the pre-boot operating system before said operating system; and

determining if a status of the computing asset complies with a predetermined computing policy, the status being earlier obtained during a last recording event by the operating system.