Providing an immutable antivirus payload for internet ready compute nodes

Patent metadata

Field	Value
Publication number	US-9251347-B2
Application number	US-201213993540-A
Country	US
Kind code	B2
Filing date	Mar 30, 2012
Priority date	Mar 30, 2012
Publication date	Feb 2, 2016
Grant date	Feb 2, 2016

Abstract

In one embodiment, a method includes initializing a portion of a computing system in a pre-boot environment using a basic input/output system (BIOS) stored in a non-volatile storage of the computing system, launching a boot manager to enable a launch of an operating system (OS) payload, and if the OS payload is not successfully launched, executing an OS payload portion and an antivirus stack stored in the non-volatile storage to restore an integrity of the mass storage. Other embodiments are described and claimed.

First claim

What is claimed is:

1. An apparatus comprising:
a processor to execute instructions;
a chipset coupled to the processor;
at least one user interface coupled to the chipset via a trusted path; and
a non-volatile storage including a first volume to store a basic input/output system (BIOS) and a second volume to store an operating system (OS) payload portion including an antivirus software stack, wherein the OS payload portion is separate from and is a subset of an OS kernel stored in a different storage than the non-volatile storage and the antivirus software stack is to restore an integrity of the different storage subsequent to corruption of the different storage, wherein in a pre-boot environment, a user is to be authenticated based on user input via the at least one user interface, and if the user authentication is successful, the BIOS is to pass control to a boot manager of the OS kernel stored in the different storage, and if the OS kernel does not successfully launch in a predetermined period, the BIOS to cause execution of the antivirus software stack to restore the integrity of the different storage, wherein the different storage comprises a mass storage.

2. The apparatus of claim 1 , wherein a virus definition of the antivirus stack stored in the non-voltage storage is to be updated in a secure management mode of a computing system.

3. The apparatus of claim 1 , wherein the OS payload portion comprises a lightweight kernel to validate an image of the OS kernel stored in the different storage.

4. The apparatus of claim 1 , wherein the BIOS is to prevent launch of the OS kernel if the antivirus stack is not identified to the BIOS within the predetermined period.

5. A system comprising:
a processor to execute instructions;
a chipset coupled to the processor;
at least one user interface coupled to the chipset via a trusted path;
a first non-volatile storage coupled to the processor to store an operating system (OS) kernel; and
a second non-volatile storage to store a basic input/output system (BIOS) and an operating system (OS) payload portion including an antivirus software stack, wherein the OS payload portion is separate from and is a subset of the OS kernel and the antivirus software stack is to restore an integrity of the first non-volatile storage subsequent to corruption of the first non-volatile storage, the first non-volatile storage a different storage than the second non-volatile storage, wherein in a pre-boot environment, a user is to be authenticated based on user input via the at least one user interface, and if the user authentication is successful, the BIOS is to pass control to a boot manager of the OS kernel stored in the first non-volatile storage, and if the OS kernel does not successfully launch in a predetermined period, the BIOS to cause execution of the antivirus software stack to restore the integrity of the first non-volatile storage.

6. The system of claim 5 , wherein the BIOS is to launch the OS payload portion and the antivirus software stack if the OS kernel is not successfully launched.

7. The system of claim 5 , further comprising a virus definition database for the antivirus software stack stored in the second non-volatile storage.

8. The system of claim 5 , wherein the BIOS is to launch the antivirus software stack if a timer set for the predetermined period expires prior to successful launch of the OS payload.

9. The system of claim 5 , wherein the first non-volatile storage comprises a solid state drive for the system.

10. At least one non-transitory machine readable medium comprising a plurality of instructions that in response to being executed on a computing device, cause the computing device to:
initialize a hardware portion of the computing device in a pre-boot environment using a basic input/output system (BIOS) stored in a non-volatile storage of the computing device;
receive user input of a user from at least one user interface of the computing device, via a trusted path;
authenticate the user based on the user input;
responsive to not authenticating the user, execute an antivirus stack stored in the non-volatile storage;
responsive to authenticating the user, launch a boot manager in the pre-boot environment to enable a launch of an operating system (OS) payload stored in a mass storage of the computing device, if the OS payload is not successfully launched in a predetermined period, execute an OS payload portion stored in the non-volatile storage and the antivirus stack to restore an integrity of the mass storage, and otherwise enter into a boot environment using the OS payload stored in the mass storage, the mass storage separate from the non-volatile storage.

11. The at least one non-transitory machine readable medium device of claim 10 , further comprising instructions that in response to being executed on the computing device, cause the computing device to, after restoring the integrity, perform a reset of the computing device to cause the hardware portion to be initialized in the pre-boot environment.

12. The at least one non-transitory machine readable medium device of claim 10 , further comprising instructions that in response to being executed on the computing device, cause the computing device to determine that the OS payload is not successfully launched if a timer set for the predetermined period expires prior to successful launch of the OS payload.

13. The at least one non-transitory machine readable medium device of claim 10 , further comprising instructions that in response to being executed on the computing device, cause the computing device to maintain the antivirus stack and the OS payload portion in a first volume of the non-volatile storage and maintain the BIOS in a second volume of the non-volatile storage.

14. A method comprising:
initializing a portion of a computing system in a pre-boot environment using a basic input/output system (BIOS) stored in a non-volatile storage of the computing system;
receiving user input of a user from at least one user interface of the computing system, via a trusted path;
authenticating the user based on the user input;
responsive to not authenticating the user, executing an antivirus stack stored in the non-volatile storage;
responsive to authenticating the user, launching a boot manager in the pre-boot environment to enable a launch of an operating system (OS) payload stored in a mass storage of the computing system, the mass storage separate from the non-volatile storage; and
if the OS payload is not successfully launched in a predetermined period, executing an OS payload portion and the antivirus stack stored in the non-volatile storage to restore an integrity of the mass storage, and otherwise entering into a boot environment using the OS payload stored in the mass storage.

15. The method of claim 14 , further comprising after restoring the integrity, performing a reset of the computing system to cause initializing the portion of the computer system in the pre-boot environment.

16. The method of claim 14 , further comprising determining that the OS payload is not successfully launched if a timer set for the predetermined period expires prior to successful launch of the OS payload.

17. The method of claim 14 , further comprising maintaining the antivirus stack in the non-volatile storage.

18. The method of claim 17 , further comprising maintaining the OS payload portion in the non-volatile storage, the OS payload corresponding to a shrink wrap OS instantiation.

19. The method of claim 17 , wherein the OS payload porti

Assignees

• Bulusu Mallik
• Swanson Robert
• Zimmer Vincent
• Bahnsen Robert Bruce
• Intel Corp

Inventors

• Bulusu Mallik
• Swanson Robert
• Zimmer Vincent
• Bahnsen Robert Bruce

Classifications

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F9/4401

  Bootstrapping (security arrangements therefor G06F21/57) · CPC title

• G06F21/575

  Secure boot · CPC title

• G06F21/561 Primary

  Virus type analysis · CPC title

• G06F9/22

  Microcontrol or microprogram arrangements · CPC title