Back to results
US 11,443,041 B2Granted
Firmware integrity check using silver measurements
AssigneeAbsolute Software Corporation
InventorEugene Khoruzhenko
Life of this patent
Estimating the term…
Abstract
Measurements of a device's firmware are made regularly and compared with prior, derived measurements. Prior measurements are derived from a set of identical firmware measurements obtained from multiple devices having the same make, model and firmware version number. The firmware integrity status is reported on a data and device security console for a group of managed endpoints. Alerts about firmware changes, which may be potential attacks on the firmware, are given automatically.
Claims19
A method for checking firmware integrity of electronic devices comprising:
- receiving, by a server from each of a first threshold number of electronic devices, an identically performed firmware integrity measurement, wherein said devices have an identical make, an identical model and a firmware with an identical version number;
- determining, by the server, that at least a second threshold number of the received firmware integrity measurements are identical;
- defining, by the server, one of said identical firmware integrity measurements to be a silver measurement;
- receiving, by a processor in the server or in a further electronic device having the identical make, identical model and firmware with the identical version number, a further identically performed firmware integrity measurement from the further electronic device, wherein the firmware integrity measurements and the further firmware integrity measurement are based on measurement of firmware instructions and not on measurement of firmware data or firmware settings, wherein the firmware integrity measurements and the further firmware integrity measurement are hashes;
- and
- comparing, by the processor, the further firmware integrity measurement with the silver measurement;
- and
- wherein the second receiving step and the comparing step are repeated periodically, randomly, from time to time or on every boot of the further electronic device, and when the further firmware integrity measurement is different from the silver measurement, the processor generates an alert, sends information, displays a pop-up message on the further electronic device, the server or a web front-end connected to the server, locks the further electronic device or permits restricted use of the further electronic device.
5 more elements
A system for checking firmware integrity of electronic devices comprising:
- a server;
- a processor in the server;
- and
- a non-transient computer readable memory in the server that stores instructions, which, when executed by the processor, cause the server to:
- (a) receive from each of a first threshold number of electronic devices, an identically performed firmware integrity measurement, wherein said devices have an identical make, an identical model and a firmware with an identical version number;
- (b) determine that at least a second threshold number of the received firmware integrity measurements are identical;
- (c) define one of said identical firmware integrity measurements to be a silver measurement;
- (d) receive, from a further electronic device having the identical make, identical model and identical firmware version, a further identically performed firmware integrity measurement, wherein the firmware integrity measurements and the further firmware integrity measurement are based on measurement of firmware instructions and not on measurement of firmware data or firmware settings, wherein the firmware integrity measurements and the further firmware integrity measurement are hashes;
- (e) compare the further firmware integrity measurement with the silver measurement;
- and
- (f) repeat (d) and (e) periodically, randomly, from time to time or on every boot of the further electronic device;
- and
- (q) when the further firmware integrity measurement is different from the silver measurement, generate an alert, display a pop-up message on the further electronic device, the server or a web front-end connected to the server, lock the further electronic device or permit restricted use of the further electronic device.
10 more elements
A non-transient computer readable medium that stores instructions, which, when executed by a processor, cause the processor to:
- (a) receive from each of a first threshold number of electronic devices, an identically performed firmware integrity measurement, wherein said devices have an identical make, an identical model and a firmware with an identical version number;
- (b) determine that at least a second threshold number of the received firmware integrity measurements are identical;
- (c) define one of said identical firmware integrity measurements to be a silver measurement;
- (d) receive, from a further electronic device having the identical make, identical model and identical firmware version, a further identically performed firmware integrity measurement, wherein the firmware integrity measurements and the further firmware integrity measurement are based on measurement of firmware instructions and not on measurement of firmware data or firmware settings, wherein the firmware integrity measurements and the further firmware integrity measurement are hashes;
- (e) compare the further firmware integrity measurement with the silver measurement;
- and
- (f) repeat (d) and (e) periodically, randomly, from time to time or on every boot of the further electronic device;
- and
- (g) when the further firmware integrity measurement is different from the silver measurement, generate an alert, display a pop-up message on the further electronic device, the server or a web front-end connected to the server, lock the further electronic device or permit restricted use of the further electronic device.
6 more elements
Dependencies are inferred from the claim text.