Rootkit-resistant storage disks
AssigneeThe Penn State Research Foundation
InventorsKevin R. Butler, Stephen E. McLaughlin, Patrick D. McDaniel
Life of this patent
Estimating the term…
Abstract
Rootkit-resistant disks (RRD) label all immutable system binaries and configuration files at installation time. During normal operation, the disk controller inspects all write operations received from the host operating system and denies those made for labeled blocks. To upgrade, the host is booted into a safe state and system blocks can only be modified if a security token is attached to the disk controller. By enforcing immutability at the disk controller, a compromised operating system is prevented from infecting its on-disk image.
Claims12
In a computer system wherein a host processor communicates with a storage device operated by a storage-device controller, a method of protecting the storage device against rootkit exploitation, comprising the steps of:
- physically installing a token in the storage device during the installation of an operating system on the host processor or during a system upgrade, such that regions of the storage device are labeled as immutable by the token;
- and
- removing the token following the installation or upgrade, such that any attempted modification of an immutable region during normal operation of the host processor is blocked by the storage device controller.
A system for protecting a storage device operated by a controller in communication with a host processor against rootkit exploitation, the system comprising:
- an input on the storage device for receiving a token used to label particular data stored on the storage device as write-protected;
- and
- whereby the controller is operative to monitor write operations within the storage device received from the host processor and deny write operations targeting the data identified as write-protected.
Dependencies are inferred from the claim text.