# US 2016/0253501 A1 · Method for Detecting a Unified Extensible Firmware Interface Protocol Reload Attack and System Therefor > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0253501 A1 - Document ID: US20160253501A1 - Status: Published application - Kind: A1 - Application number: 14/632,429 - Filed: 2015-02-26 - Published: 2016-09-01 - Earliest claimed: 2015-02-26 - Assignees: Dell Products L.P. - Applicants: Dell Products, LP - Inventors: Allen C. Wynn - Web page: https://patentgrep.com/patent/US20160253501A1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 8/61: Installation - G06F 21/554: {involving event detection and direct action} - G06F 21/575: {Secure boot} - G06F 9/4411: {Configuring for operating with peripheral devices; Loading of device drivers} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An installation notification routine is initialized at a driver, the routine maintaining a count of installation notifications corresponding to a first global unique identifier (GUID) received at the driver. The driver registers for protocol installation notification corresponding to the first GUID. Malicious activity is identified in response to receiving more than one installation notification at the installation notification routine. ## Claims ### Claim 1 A method comprising: initializing an installation notification routine at a driver at a data processing device, the routine maintaining a count of installation notifications corresponding to a first global unique identifier (GUID) received at the driver; registering for protocol installation notification during initialization of the driver, the protocol corresponding to the first GUID; and identifying malicious activity in response to receiving more than one installation notification at the installation notification routine. ### Claim 2 (depends on 1) The method of claim 1, further comprising installing a protocol corresponding to the first GUID. ### Claim 3 (depends on 2) The method of claim 2, further comprising reloading the protocol in response to the identifying. ### Claim 4 (depends on 2) The method of claim 2, further comprising receiving a first installation notification in response to installing the protocol. ### Claim 5 (depends on 2) The method of claim 2, further comprising receiving a second installation notification in response to installing the protocol. ### Claim 6 (depends on 1) The method of claim 1, wherein initializing the installation notification routine further comprises initializing the count to zero, and incrementing the count in response to receiving each protocol installation notification corresponding to the first GUID. ### Claim 7 (depends on 1) The method of claim 1, further comprising generating an inquiry to determine whether a protocol associated with the first GUID is installed. ### Claim 8 (depends on 1) The method of claim 1, further comprising halting a boot sequence at an information handling system in response to the identifying. ### Claim 9 An information handling system comprising: a processor; and a memory device for storing instructions, the instructions to: initialize an installation notification routine at a driver, the routine maintaining a count of installation notifications corresponding to a first global unique identifier (GUID) received at the driver; register for protocol installation notification during initialization of the driver, the protocol corresponding to the first GUID; and identify malicious activity in response to receiving more than one installation notification at the installation notification routine. ### Claim 10 (depends on 9) The system of claim 9, further comprising instructions to install a protocol corresponding to the first GUID. ### Claim 11 (depends on 10) The system of claim 10, further comprising instructions to reload the protocol in response to the identifying. ### Claim 12 (depends on 10) The system of claim 10, further comprising instructions to receive a first installation notification in response to installing the protocol. ### Claim 13 (depends on 10) The system of claim 10, further comprising instructions to receive a second installation notification in response to installing the protocol. ### Claim 14 (depends on 9) The system of claim 9, wherein initializing the installation notification routine further comprises initializing the count to zero, and incrementing the count in response to receiving each protocol installation notification corresponding to the first GUID. ### Claim 15 (depends on 9) The system of claim 9, further comprising instructions to generate an inquiry to determine whether a protocol associated with the first GUID is installed. ### Claim 16 (depends on 9) The system of claim 9, further comprising instructions to halt a boot sequence at the information handling system in response to the identifying. ### Claim 17 A non-transitory data storage medium storing instructions executable by a processor to cause the processor to: initialize an installation notification routine at a driver, the routine maintaining a count of installation notifications corresponding to a first global unique identifier (GUID) received at the driver; register for protocol installation notification during initialization of the driver, the protocol corresponding to the first GUID; and identify malicious activity in response to receiving more than one installation notification at the installation notification routine. ### Claim 18 (depends on 17) The storage medium of claim 17, further comprising instructions to install a protocol corresponding to the first GUID. ### Claim 19 (depends on 18) The storage medium of claim 18, further comprising instructions to receive a first installation notification in response to installing the protocol. ### Claim 20 (depends on 17) The storage medium of claim 17, further comprising instructions to halt a boot sequence at the information handling system in response to the identifying.