# US 11,443,041 B2 · Firmware integrity check using silver measurements > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,443,041 B2 - Document ID: US11443041B2 - Status: Granted - Kind: B2 - Application number: 16/639,876 - Filed: 2018-04-10 - Published: 2020-11-19 - Granted: 2022-09-13 - Earliest claimed: 2017-08-22 - Assignees: Absolute Software Corporation - Applicants: Absolute Software Corporation - Inventors: Eugene Khoruzhenko - Web page: https://patentgrep.com/patent/US11443041B2 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/73: by creating or determining hardware identification, e.g. serial numbers - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - H04L 63/14: {for detecting or protecting against malicious traffic} - H04W 12/12: Detection or prevention of fraud - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Measurements of a device's firmware are made regularly and compared with prior, derived measurements. Prior measurements are derived from a set of identical firmware measurements obtained from multiple devices having the same make, model and firmware version number. The firmware integrity status is reported on a data and device security console for a group of managed endpoints. Alerts about firmware changes, which may be potential attacks on the firmware, are given automatically. ## Claims ### Claim 1 A method for checking firmware integrity of electronic devices comprising: receiving, by a server from each of a first threshold number of electronic devices, an identically performed firmware integrity measurement, wherein said devices have an identical make, an identical model and a firmware with an identical version number; determining, by the server, that at least a second threshold number of the received firmware integrity measurements are identical; defining, by the server, one of said identical firmware integrity measurements to be a silver measurement; receiving, by a processor in the server or in a further electronic device having the identical make, identical model and firmware with the identical version number, a further identically performed firmware integrity measurement from the further electronic device, wherein the firmware integrity measurements and the further firmware integrity measurement are based on measurement of firmware instructions and not on measurement of firmware data or firmware settings, wherein the firmware integrity measurements and the further firmware integrity measurement are hashes; and comparing, by the processor, the further firmware integrity measurement with the silver measurement; and wherein the second receiving step and the comparing step are repeated periodically, randomly, from time to time or on every boot of the further electronic device, and when the further firmware integrity measurement is different from the silver measurement, the processor generates an alert, sends information, displays a pop-up message on the further electronic device, the server or a web front-end connected to the server, locks the further electronic device or permits restricted use of the further electronic device. ### Claim 2 (depends on 1) The method of claim 1, wherein the processor is in the server. ### Claim 3 (depends on 1) The method of claim 1, further comprising: determining, by the processor, that the further firmware integrity measurement is different from the silver measurement. ### Claim 4 (depends on 3) The method of claim 3, wherein the security action taken is one or more of: generation of an alert; locking of the further electronic device; display of a pop-up message on the further electronic device; and display of a pop-up message on the server. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining, by the processor, that the further firmware integrity measurement is equal to the silver measurement; and determining, by the processor, that the firmware of the further electronic device is out of date. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving, by the processor, a different version number from the further electronic device; determining, by the processor, that the different version number is earlier than the identical version number; and generating, by the processor, a security alert indicating that the firmware of the further electronic device has been rolled back. ### Claim 7 (depends on 1) The method of claim 1, further comprising: determining, by the processor, that the further firmware integrity measurement is different from the silver measurement; and determining, by the processor, that non-volatile memory in which the firmware of the further electronic device is stored is not properly locked. ### Claim 8 (depends on 1) The method of claim 1, further comprising: determining, by the processor, that the further firmware integrity measurement is equal to the silver measurement; and permitting, by the processor, continued unhindered use of the further electronic device. ### Claim 9 (depends on 1) The method of claim 1, wherein the firmware integrity measurements and the further firmware integrity measurement are based on either: the firmware version and a date of the firmware version; a time of the firmware version; or one or more volumes of the firmware. ### Claim 10 (depends on 1) The method of claim 1, wherein the firmware is either: a BIOS (Basic Input/Output System), or a UEFI (Unified Extensible Firmware Interface). ### Claim 11 (depends on 1) The method of claim 1, further comprising storing, by the server, a result of the comparing step in a database. ### Claim 12 (depends on 1) The method of claim 1, wherein the first threshold number is equal to the second threshold number. ### Claim 13 (depends on 1) The method of claim 1, wherein the first threshold number is greater than the second threshold number, the method further comprising: permitting, by the server, continued unhindered use of those of the electronic devices that have a firmware integrity measurement equal to the silver measurement; and taking, by the server, a security action with respect to those of the electronic devices that have a firmware integrity measurement different from the silver measurement. ### Claim 14 (depends on 1) The method of claim 1, wherein the firmware integrity measurements and the further firmware integrity measurement are each performed by an application running in volatile memory. ### Claim 15 (depends on 14) The method of claim 14, wherein each application is maintained to be present and functional by an operating system agent running under an operating system of a different one of the electronic devices or the further electronic device. ### Claim 16 (depends on 15) The method of claim 15, wherein each operating system agent is maintained to be present and functional by a persistent agent present in non-volatile memory of a different one of the electronic devices or the further electronic device. ### Claim 17 A system for checking firmware integrity of electronic devices comprising: a server; a processor in the server; and a non-transient computer readable memory in the server that stores instructions, which, when executed by the processor, cause the server to: (a) receive from each of a first threshold number of electronic devices, an identically performed firmware integrity measurement, wherein said devices have an identical make, an identical model and a firmware with an identical version number; (b) determine that at least a second threshold number of the received firmware integrity measurements are identical; (c) define one of said identical firmware integrity measurements to be a silver measurement; (d) receive, from a further electronic device having the identical make, identical model and identical firmware version, a further identically performed firmware integrity measurement, wherein the firmware integrity measurements and the further firmware integrity measurement are based on measurement of firmware instructions and not on measurement of firmware data or firmware settings, wherein the firmware integrity measurements and the further firmware integrity measurement are hashes; (e) compare the further firmware integrity measurement with the silver measurement; and (f) repeat (d) and (e) periodically, randomly, from time to time or on every boot of the further electronic device; and (q) when the further firmware integrity measurement is different from the silver measurement, generate an alert, display a pop-up message on the further electronic device, the server or a web front-end connected to the server, lock the further electronic device or permit restricted use of the further electronic device. ### Claim 18 (depends on 17) The system of claim 17, further comprising in each of the electronic devices: a firmware integrity measurement application running in volatile memory; an operating system agent running under an operating system of the electronic device and configured to maintain the firmware integrity measurement application present and functional in the electronic device; and a persistent agent in non-volatile memory of the electronic device configured to maintain the operating system agent present and functional in the electronic device. ### Claim 19 A non-transient computer readable medium that stores instructions, which, when executed by a processor, cause the processor to: (a) receive from each of a first threshold number of electronic devices, an identically performed firmware integrity measurement, wherein said devices have an identical make, an identical model and a firmware with an identical version number; (b) determine that at least a second threshold number of the received firmware integrity measurements are identical; (c) define one of said identical firmware integrity measurements to be a silver measurement; (d) receive, from a further electronic device having the identical make, identical model and identical firmware version, a further identically performed firmware integrity measurement, wherein the firmware integrity measurements and the further firmware integrity measurement are based on measurement of firmware instructions and not on measurement of firmware data or firmware settings, wherein the firmware integrity measurements and the further firmware integrity measurement are hashes; (e) compare the further firmware integrity measurement with the silver measurement; and (f) repeat (d) and (e) periodically, randomly, from time to time or on every boot of the further electronic device; and (g) when the further firmware integrity measurement is different from the silver measurement, generate an alert, display a pop-up message on the further electronic device, the server or a web front-end connected to the server, lock the further electronic device or permit restricted use of the further electronic device.