Malware scan in response to power change

Patent metadata

Field	Value
Publication number	US-11657156-B2
Application number	US-202016792210-A
Country	US
Kind code	B2
Filing date	Feb 15, 2020
Priority date	Feb 15, 2020
Publication date	May 23, 2023
Grant date	May 23, 2023

Abstract

In one aspect, a device includes at least one processor and storage accessible to the at least one processor. The storage includes instructions executable by the at least one processor to identify a power change condition in the device, and responsive to the power change condition, execute a scan for malware on the device using an operating system (O.S.) loaded into memory of the device from a server separate from the device.

First claim

What is claimed is:

1. A device, comprising:
at least one processor; and
storage accessible to the at least one processor and comprising instructions executable by the at least one processor to:
identify a power change condition in the device; and
responsive to the power change condition, execute a scan for malware on the device using an operating system (O.S.) of a server separate from the device and different from a native O.S. of the device stored in the device;
wherein the instructions are executable to:
load the O.S. of the server into memory of the device; and
execute the O.S. of the server from the memory of the device to execute the scan.

2. The device of claim 1 , wherein the power change condition comprises entering a sleep mode.

3. The device of claim 1 , wherein the power change condition comprises a deenergization event.

4. The device of claim 1 , wherein the power change condition comprises a restart.

5. The device of claim 1 , wherein the scan for malware on the device using the O.S. from the server separate from the device comprises a scan of a native O.S. of the device stored in a drive of the device.

6. The device of claim 1 , comprising the memory, wherein the memory comprises a random access memory (RAM).

7. The device of claim 1 , wherein the instructions are executable to:
in a first instance, not load the O.S. of the server into the memory of the device;
in the first instance, execute the O.S. of the server at the server and remotely from the device to execute the scan;
in a second instance, load the O.S. of the server into the memory of the device; and
in the second instance, execute the O.S. of the server from the memory of the device to execute the scan.

8. At least one computer readable storage medium (CRSM) that is not a transitory signal, the computer readable storage medium comprising instructions executable by at least one processor to:
identify a condition in a device; and
responsive to the condition, execute a scan for malware on the device using an operating system (O.S.) of a server different from a native O.S. of the device;
wherein the instructions are executable to:
not load the O.S. of the server into memory of the device; and
execute the O.S. of the server at the server and remotely from the device to execute the scan.

9. The CRSM of claim 8 , wherein the condition comprises entering a sleep mode.

10. The CRSM of claim 8 , wherein the condition comprises a deenergization event.

11. The CRSM of claim 8 , wherein the condition comprises a restart.

12. The CRSM of claim 8 , wherein the scan for malware on the device using the O.S. of the server comprises a scan of a native O.S. of the device stored in a drive of the device.

13. The CRSM of claim 8 , wherein the instructions are executable to:
in a first instance, load the O.S. of the server into the memory of the device;
in the first instance, execute the O.S. of the server from the memory of the device to execute the scan;
in a second instance, not load the O.S. of the server into the memory of the device; and
in the second instance, execute the O.S. of the server at the server and remotely from the device to execute the scan.

14. The CRSM of claim 13 , wherein the memory comprises a random access memory (RAM).

15. The CRSM of claim 8 , wherein the condition is a power change condition.

16. A method, comprising:
identifying a condition in a device; and
responsive to identifying the condition in the device, executing a scan for malware on the device using an operating system (O.S.) of a server different from an O.S. of the device;
wherein the method comprises:
not loading the O.S. of the server into memory of the device; and
executing the O.S. of the server at the server and remotely from the device to execute the scan.

17. The method of claim 16 , wherein the condition comprises entering a sleep mode.

18. The method of claim 16 , wherein the condition comprises a deenergization event.

19. The method of claim 16 , wherein the condition comprises a restart.

20. The method of claim 16 , wherein the condition is a power change condition.

Assignees

• Lenovo Singapore Pte Ltd

Inventors

• Li Scott Wentao
• Kapinos Robert J
• Vanblon Russell Speight
• Norton Robert

Classifications

• G06F21/567 Primary

  using dedicated hardware · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F21/575 Primary

  Secure boot · CPC title