Method for Detecting a Unified Extensible Firmware Interface Protocol Reload Attack and System Therefor

Patent metadata

Field	Value
Publication number	US-2016253501-A1
Application number	US-201514632429-A
Country	US
Kind code	A1
Filing date	Feb 26, 2015
Priority date	Feb 26, 2015
Publication date	Sep 1, 2016
Grant date	—

Abstract

An installation notification routine is initialized at a driver, the routine maintaining a count of installation notifications corresponding to a first global unique identifier (GUID) received at the driver. The driver registers for protocol installation notification corresponding to the first GUID. Malicious activity is identified in response to receiving more than one installation notification at the installation notification routine.

First claim

What is claimed is:

1 . A method comprising:
initializing an installation notification routine at a driver at a data processing device, the routine maintaining a count of installation notifications corresponding to a first global unique identifier (GUID) received at the driver; registering for protocol installation notification during initialization of the driver, the protocol corresponding to the first GUID; and identifying malicious activity in response to receiving more than one installation notification at the installation notification routine.

2 . The method of claim 1 , further comprising installing a protocol corresponding to the first GUID.

3 . The method of claim 2 , further comprising reloading the protocol in response to the identifying.

4 . The method of claim 2 , further comprising receiving a first installation notification in response to installing the protocol.

5 . The method of claim 2 , further comprising receiving a second installation notification in response to installing the protocol.

6 . The method of claim 1 , wherein initializing the installation notification routine further comprises initializing the count to zero, and incrementing the count in response to receiving each protocol installation notification corresponding to the first GUID.

7 . The method of claim 1 , further comprising generating an inquiry to determine whether a protocol associated with the first GUID is installed.

8 . The method of claim 1 , further comprising halting a boot sequence at an information handling system in response to the identifying.

9 . An information handling system comprising:
a processor; and a memory device for storing instructions, the instructions to:
initialize an installation notification routine at a driver, the routine maintaining a count of installation notifications corresponding to a first global unique identifier (GUID) received at the driver;
register for protocol installation notification during initialization of the driver, the protocol corresponding to the first GUID; and
identify malicious activity in response to receiving more than one installation notification at the installation notification routine.

10 . The system of claim 9 , further comprising instructions to install a protocol corresponding to the first GUID.

11 . The system of claim 10 , further comprising instructions to reload the protocol in response to the identifying.

12 . The system of claim 10 , further comprising instructions to receive a first installation notification in response to installing the protocol.

13 . The system of claim 10 , further comprising instructions to receive a second installation notification in response to installing the protocol.

14 . The system of claim 9 , wherein initializing the installation notification routine further comprises initializing the count to zero, and incrementing the count in response to receiving each protocol installation notification corresponding to the first GUID.

15 . The system of claim 9 , further comprising instructions to generate an inquiry to determine whether a protocol associated with the first GUID is installed.

16 . The system of claim 9 , further comprising instructions to halt a boot sequence at the information handling system in response to the identifying.

17 . A non-transitory data storage medium storing instructions executable by a processor to cause the processor to:
initialize an installation notification routine at a driver, the routine maintaining a count of installation notifications corresponding to a first global unique identifier (GUID) received at the driver; register for protocol installation notification during initialization of the driver, the protocol corresponding to the first GUID; and identify malicious activity in response to receiving more than one installation notification at the installation notification routine.

18 . The storage medium of claim 17 , further comprising instructions to install a protocol corresponding to the first GUID.

19 . The storage medium of claim 18 , further comprising instructions to receive a first installation notification in response to installing the protocol.

20 . The storage medium of claim 17 , further comprising instructions to halt a boot sequence at the information handling system in response to the identifying.

Assignees

• Dell Products Lp

Inventors

• Wynn Allen C

Classifications

• G06F8/61

  Installation · CPC title

• G06F21/575

  Secure boot · CPC title

• G06F9/4411

  Configuring for operating with peripheral devices; Loading of device drivers · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title