Networked workstation intrusion detection system
AssigneeNovell, Inc.
InventorJonathan Trostle
Life of this patent
Estimating the term…
Abstract
During pre-boot (i.e., the period of time prior to initiating operation of the workstation operating system), a networked workstation performs an intrusion detection hashing function on selected workstation executable program(s). A computed hash value calculated by the hashing operation is compared against a trusted hash value that is downloaded from a server in order to detect illicit (i.e., authorized) changes to the selected workstation executable programs.
Claims16
A method of detecting illicit changes to an executable program in a networked computer workstation prior to execution of an operating system by the workstation, the method comprising the steps of:
- receiving a trusted hash value that is expected to be generated by hashing selected executable programs resident in the workstation if the selected executable programs have not been unauthorizedly changed;
- receiving a list of the selected executable programs resident in the workstation;
- hashing the selected executable programs resident in the workstation to calculate a computed hash value;
- and
- comparing said computed hash value to said trusted hash value in order to detect illicit changes to the selected executable programs;
- wherein the computed hash value is a fixed size numerical value, and the selected executable programs comprise program instructions for being executed by the networked computer workstation.
A network computer workstation which checks for illicit changes to executable programs in the workstation prior to execution of an operating system by the workstation, the workstation comprising:
- means for receiving a trusted hash value and for receiving a list of selected executable programs resident in the workstation;
- means for hashing the selected executable programs resident in the workstation to calculate a computed hash value;
- means for comparing said computed hash value to said trusted hash value in order to detect illicit changes to the selected executable programs;
- wherein the selected executable programs comprise program instructions for being executed by the workstation, and each of the computed hash value and the trusted hash value is a respective fixed size numerical value.
A method for detecting illicit changes to executable programs in a workstation of a networked client/server computer system following a reset of the workstation and prior to execution of an operating system by the workstation, the method comprising the steps of:
- receiving at the workstation a plurality of preboot executable software modules;
- receiving at the workstation a trusted hash value;
- receiving at the workstation information indicative of a selected executable program resident in the workstation;
- executing said plurality of preboot executable software modules which includes the steps of:
- (1) hashing the selected executable program resident in the workstation to calculate a computed hash value;
- and
- (2) comparing said computed hash value to said trusted hash value in order to detect illicit changes to the selected executable program;
- wherein the selected executable program comprises program instruction for being executed by the workstation, and the trusted hash and computed hash values are fixed size numerical values.
Dependencies are inferred from the claim text.