Cyber Security Boot Status Markers
AssigneeCrowdStrike, Inc.
InventorsGarrett Moore, Blair C. Foster, JR.
Life of this patent
Estimating the term…
Abstract
Boot status markers record historical boot processes performed by a computer system. Each time the computer system boots, an operating system performs a boot process and interfaces with an antimalware driver. The antimalware driver determines the boot status markers that were set during previous boot processes. The antimalware driver may then classify other drivers based on the boot status markers set during the previous boot processes. The antimalware driver may then report driver classifications to the operating system. The operating system may then block, or allow, the drivers based on the driver classifications.
Claims20
A method that classifies a boot-start driver, comprising:
- determining, by an antimalware driver during a current boot process associated with an operating system, a boot status marker set during a previous boot process;
- determining, by the antimalware driver during the current boot process, a driver classification associated with the boot-start driver, the driver classification based on the boot status marker set during the previous boot process;
- and
- reporting, by the antimalware driver during the current boot process, the driver classification to the operating system.
A computer system that evaluates a boot-start driver, comprising:
- a central processing unit;
- and
- a memory device storing instructions that, when executed by the central processing unit, perform operations, the operations comprising:
- executing an antimalware driver during an Early Launch AntiMalware (ELAM) feature associated with a current boot process by an operating system;
- determining, during the ELAM feature associated with the current boot process, a boot status marker set during a previous boot process;
- and
- blocking or allowing an initialization of the boot-start driver during the current boot process based on the boot status marker set during the previous boot process.
A memory device storing instructions that, when executed by a central processing unit, perform operations that evaluate a boot-start driver, the operations comprising:
- executing an antimalware driver during an Early Launch AntiMalware (ELAM) feature associated with a current boot process by an operating system;
- reading, during the ELAM feature associated with the current boot process, a Unified Extensible Firmware Interface (UEFI) registry storing a boot status marker set by the antimalware driver during a previous boot process by the operating system;
- and
- blocking or allowing an initialization of the boot-start driver during the current boot process based on the boot status marker read from the UEFI registry.
Dependencies are inferred from the claim text.