Methods and apparatus for a safe and secure software update solution against attacks from malicious or unauthorized programs to update protected secondary storage
AssigneeIntel Corporation
InventorsKarthikeyan Vaidyanathan, Akshay R. Kadam, Royce Fernald
Life of this patent
Estimating the term…
Abstract
Described herein are articles, systems, and methods for using a storage controller to protect secure data blocks through the enforcement of a read only policy. In some embodiments, the articles use a combination of hardware protections and software protections (e.g., virtualization) to protect a system against attack from malware while such secure data is updated. Also described are systems and methods for securely updating data blocks secured in this fashion, and detecting and preventing the corruption of data stored on secondary storage media using a disk eventing mechanism.
Claims20
A system, comprising
- a processor;
- a memory having antivirus agent (AVA) instructions stored thereon, said AVA instructions to be executed by said processor;
- a secondary storage medium comprising at least one logical block address (LBA) protected by a read only policy, said secondary storage medium further comprising a storage controller configured to output at least one disk event to said AVA instructions when a write operation targets at least one of said LBA;
- and
- said AVA instructions cause the processor to affirm or deny said write operation;
- wherein:
- when said processor denies said write operation, said storage controller denies the write operation before said write operation is committed to said at least one LBA;
- and
- when said host processor affirms said write operation, said storage controller commits said write operation to said at least one LBA.
A method, comprising:
- monitoring write operations with a processor, at least one of said write operations targeting at least one logical block address (LBA) of a secondary storage medium, the at least one LBA protected by a read only policy;
- outputting disk events in response to said write operations;
- evaluating said disk events stored in a host memory;
- and
- affirming or denying said write operations with said processor based on said evaluating.
An article comprising a tangible storage medium having disk eventing filter instructions (DEFI) and antivirus agent (AVA) instructions stored thereon which when executed by a processor result in the following operations comprising:
- intercepting and inspecting write operations targeting at least one logical block address (LBA) of a secondary storage medium;
- outputting disk events correlating to said write operations to said AVA instructions;
- evaluating said disk events with said AVA instructions;
- and
- affirming or denying said write operations based on said evaluating.
Dependencies are inferred from the claim text.