Continuous Monitoring for Detecting Firmware Threats
AssigneeReFirm Labs, Inc.
InventorsPeter P. Eacmen, III, Terry J. Dunlap, JR.
Life of this patent
Estimating the term…
Abstract
Continuous monitoring for detecting firmware threats is provided herein. An example system includes a processing pipeline that receives a firmware image from an entity, an extractor that receives the firmware image through the processing pipeline, the extractor being configured to determine and extract files within the firmware image, a task queue that receives the extracted files and one or more analyzers that: obtain the files from the task queue; and perform at least one type of vulnerability analysis on the files. The system includes a database that stores a log of the at least one type of vulnerability analysis, the log being associated with any of the firmware image and a device identifier of the device.
Claims19
A system, comprising:
- a processing pipeline that receives a firmware image from an entity, the firmware image being indicative of firmware installed on a device of the entity;
- an extractor that receives the firmware image through the processing pipeline, the extractor being configured to determine and extract files within the firmware image;
- a task queue that receives the extracted files;
- one or more analyzers that:
- obtain the files from the task queue;
- and
- perform at least one type of vulnerability analysis on the files;
- and
- a database that stores a log of the at least one type of vulnerability analysis, the log being associated with any of the firmware image and a device identifier of the device.
A method, comprising:
- receiving a firmware image from an entity, the firmware image being a copy of that which is installed on a device of the entity;
- placing the a firmware image in a processing pipeline;
- determining and extracting files within the firmware image using an extractor;
- placing the extracted files in a task queue;
- launching one or more analyzers to:
- obtain the files from the task queue;
- perform a vulnerability analysis on the files;
- and
- wherein the one or more analyzers are selected based on the extracted files and their associated file types;
- and
- storing the firmware image and a log of the vulnerability analysis in a database, the log being associated with any of the firmware image and a device identifier of the device.
Dependencies are inferred from the claim text.