Secure storage tracking for anti-virus speed-up
View Patent ↗A computer system includes a security subsystem which is able to trustfully track which files or storage areas of a storage device have been altered since a last virus scan. The trusted information can then be used to accelerate scans for undesirable code or data such as viruses and invalid or corrupt registry entries. In the case of viruses, files or storage areas which have been altered are scanned against a super-set of virus definitions. Unaltered files or storage areas are scanned against a subset of virus definitions.
1. A method comprising:
storing trusted variables that pertain to prior scans for identifiers of undesirable code in a secure memory of a security subsystem, the secure memory being inaccessible to code executed by an operating system, the trusted variables comprising:
a directory of files written to since a last scan; and
a directory of files that have not been written to since the last scan; and
accelerating a scan for identifiers of undesirable code by utilizing the trusted variables to reduce a number of files to be scanned and/or reduce a number of undesirable code identifiers used for scanning;
wherein files written to since the last scan are scanned against all known identifiers of undesirable code; and
wherein files that have not been written to since the last scan are scanned only against newly introduced identifiers of undesirable code.
2. The method according to claim 1 , wherein the trusted variables further comprise a trusted scan timestamp; and
wherein the newly introduced identifiers of undesirable code are determined relative to the trusted scan timestamp stored in the secure memory.
3. The method according to claim 1 , wherein the files that have been written to since the last scan reside in a read/write area of a storage device; and
wherein the files that have not been written to since the last scan reside in a first area of a storage device; and
wherein the files in the first area are bypassed in a subsequent scan in response to a determination that:
the first area has not been written to since a prior scan; and
the files in the first area have been scanned in a prior scan against all known identifiers of undesirable code;
the files in the first area that are bypassed resulting in a bypassed area.
4. The method according to claim 3 , further comprising:
requesting from the security subsystem a trusted scan timestamp of when the last scan was executed and which is trusted by virtue of the secure memory; and
scanning the bypassed area against a newly introduced identifier which is associated with malicious code known to have come into existence on a new identifier date, wherein the scanning of the bypassed area occurs in response to a determination that a new identifier timestamp, which is related to the new identifier date, is earlier than the trusted scan timestamp; and wherein the bypassed area is not scanned for other known identifiers of malicious code that were included in the last scan.
5. The method according to claim 3 , wherein the first area is securely configurable between a normal read-only state and a writeable state, the configuration being under the control of the security system.
6. The method according to claim 5 , further comprising:
upon successfully scanning the files in the read/write area, activating and authenticating a first security measure of the security system to configure the first area to the writeable state, wherein the authentication executes out of the secure memory;
writing the successfully scanned files in the read/write area to the first area; and
configuring the first area to a read-only state after the writing of successfully scanned files.
7. The method according to claim 6 , wherein the authentication for the first security measure is an authentication selected from the group consisting of a password, a digital signature, and a biometric.
8. The method according to claim 7 , wherein the read/write area and first area are subdivided logically and are located on a single storage device.
9. The method according to claim 7 , wherein the read/write area and first area are subdivided physically.
10. The method according to claim 9 , wherein the physically subdivided areas are respectively contiguous areas on the storage device.
11. The method according to claim 6 , wherein the authentication of the first security measure is executed under control of a virtual machine monitor.
12. The method according to claim 1 , wherein the newly introduced identifiers of undesirable code and the all known identifiers of undesirable code comprise identifiers of malicious code.
13. The method according to claim 12 , wherein the identifiers of malicious code are selected from the group consisting of a signature, a code fragment, a data fragment, a hash, and a registry entry in a registry of the operating system.
14. The method according to claim 1 , wherein the security subsystem is implemented in hardware such that the secure memory is additionally inaccessible to a main processor that executes the operating system, wherein the hardware is physically located at a location selected from the group consisting of a storage controller, and a storage device cable.
15. A method comprising:
storing trusted variables that pertain to prior scans for identifiers of undesirable code in a secure memory of a security subsystem, the secure memory being inaccessible to code executed by an operating system, the trusted variables comprising:
a trusted scan timestamp; and
accelerating a scan for identifiers of undesirable code by utilizing the trusted variables to reduce a number of files to be scanned and/or reduce a number of undesirable code identifiers used for scanning;
wherein files that have not been written to since the last scan are scanned only against newly introduced identifiers of undesirable code; and
wherein the newly introduced identifiers of undesirable code are determined relative to the trusted scan timestamp stored in the secure memory.
16. An apparatus comprising:
a processor; and
a main memory that stores code which is executed under an operating system by the processor;
a security subsystem having a secure memory which is inaccessible to the code which is executed under the operating system by said processor, the secure memory storing trusted variables that pertain to prior scans for undesirable code, the trusted variables comprising:
a directory of files of a storage device written to since a last scan; and
a directory of files of the storage device that have not been written to since the last scan;
wherein the storage device is operatively coupled to said processor and said security subsystem and is subdivided into a first area and a read/write area, the first area being securely configurable under the control of said security system between a normal read-only state and a writeable state;
wherein the security system is configured to accelerate a scan for identifiers of undesirable code by utilizing the trusted variables to reduce a number of files to be scanned and/or to reduce a number of identifiers of undesirable code to be used for scanning;
wherein files written to since the last scan are stored in the read/write area, whereby the files written to since the last scan are scanned against all known identifiers of undesirable code; and
wherein files that have not been written to since a last scan are stored in the first area, whereby the files that have not been written to since the last scan are scanned only against newly introduced identifiers of undesirable code.
17. The apparatus according to claim 16 , wherein said security subsystem is configured to invoke an authentication procedure in response to a provided request to configure the first area to the writeable state to write files from the read/write area to the first area after the files in the read/write area have been successfully scanned for all known identifiers; and
wherein the authentication executes out of the secure memory.
18. The apparatus according to claim 17 , wherein said security system is implemented as a virtual machine monitor.
19. The apparatus according to claim 17 , wherein the security system is implemented in hardware such that the secure memory is additionally inaccessible to said processor and wherein the hardware is physically located at a location selected from the group consisting of a storage controller, and a storage device cable.
20. The apparatus according to claim 17 , wherein the first area and read/write area are subdivided logically and are located on a single storage device.
21. The apparatus according to claim 17 , wherein the first area and read/write area are subdivided physically.
22. The apparatus according to claim 21 , wherein the physically subdivided areas are respectively contiguous areas on the storage device.
23. A method comprising:
subdividing a storage device into a first area and a read/write area, the first area being securely configurable between a normal read-only access mode and a writeable access mode, wherein the storage device imposes a security measure in response to an attempt to configure the mode of access to the first area;
caching accesses to the storage device by:
directing read accesses to the read/write area if the data being accessed is in the read/write area;
directing read accesses to the first area if the data being accessed is missing from the read/write area;
directing write accesses to the read/write area;
storing trusted variables that pertain to prior scans for identifiers of undesirable code in a secure memory of a security subsystem, the secure memory being inaccessible to code executed by an operating system, the trusted variables comprising:
a trusted scan timestamp;
accelerating a scan for identifiers of undesirable code by utilizing the trusted variables to reduce a number of files to be scanned and/or reduce a number of identifiers of undesirable code used for scanning, wherein the accelerating further comprises:
scanning files in the read/write area for all known identifiers of undesirable code; and
scanning files in the first area only for newly introduced identifiers of undesirable code, wherein the newly introduced identifiers of undesirable code are determined relative to the trusted scan timestamp;
upon successfully scanning the files in the read/write area, activating a first security measure on the storage device to configure the first area in the writeable access mode;
writing successfully scanned files in the read/write area to the first area; and
activating a second security measure on the storage device to configure the first area in the read-only access mode.
24. A method comprising:
subdividing a storage device into a first area and a read/write area, the first area being securely configurable between a normal read-only access mode and a writeable access mode, wherein the storage device imposes a security measure in response to an attempt to configure the mode of access to the first area;
caching accesses to the storage device by:
directing read accesses to the read/write area if the data being accessed is in the read/write area;
directing read accesses to the first area if the data being accessed is missing from the read/write area;
directing write accesses to the read/write area;
storing trusted variables that pertain to prior scans for identifiers of undesirable code in a secure memory of a security subsystem, the secure memory being inaccessible to code executed by an operating system, the trusted variables comprising:
a directory of files in the read/write area; and
a directory of files in the first area;
accelerating a scan for identifiers of undesirable code by utilizing the trusted variables to reduce a number of files to be scanned and/or reduce a number of identifiers of undesirable code used for scanning, wherein the accelerating further comprises:
scanning files in the read/write area for all known identifiers of undesirable code; and
scanning files in the first area only for newly introduced identifiers of undesirable code;
upon successfully scanning the files in the read/write area, activating a first security measure on the storage device to configure the first area in the writeable access mode;
writing successfully scanned files in the read/write area to the first area;
activating a second security measure on the storage device to configure the first area in the read-only access mode; and
deleting the successfully scanned files from the read/write area.
25. The method according to claim 24 , wherein the trusted variables further comprise a trusted scan timestamp; and
wherein the newly introduced identifiers of undesirable code are determined relative to the trusted scan timestamp stored in the secure memory.
26. A product comprising:
a tangible computer usable medium having computer readable program code stored therein, the computer readable program code in said product being effective to:
subdivide a storage device into a first area and a read/write area, the first area being securely configurable between a normal read-only access mode and a writeable access mode, wherein the storage device imposes a security measure in response to an attempt to configure the mode of access to the first area;
cache accesses to the storage device by:
directing read accesses to the read/write area if the data being accessed is in the read/write area;
directing read accesses to the first area if the data being accessed is missing from the read/write area;
directing write accesses to the read/write area;
store trusted variables that pertain to prior scans for identifiers of undesirable code in a secure memory of the security system, the secure memory being inaccessible to code executed by an operating system, the trusted variables comprising:
a directory of files in the read/write area; and
a directory of files in the first area;
accelerate a scan for identifiers of undesirable code by utilizing the trusted variables to reduce a number of files to be scanned and/or reduce a number of identifiers of undesirable code used for scanning, wherein the scan is accelerated via:
scanning files in the read/write area for all known identifiers of undesirable code; and
scanning files in the first area only for newly introduced identifiers of undesirable code;
upon successfully scanning the files in the read/write area, activate a first security measure on the storage device to configure the first area in the writeable access mode;
write successfully scanned files in the read/write area to the first area;
activate a second security measure on the storage device to configure the first area in the read-only access mode; and
delete the successfully scanned files from the read/write area.
27. A product comprising:
a tangible computer usable medium having computer readable program code stored therein, the computer readable program code in said product being effective to:
store trusted variables that pertain to prior scans for identifiers of undesirable code in a secure memory of a security system, the trusted variables comprising:
a directory of files written to since a last scan; and
a directory of files that have not been written to since the last scan; and
accelerate a scan for identifiers of undesirable code by utilizing the trusted variables to reduce a number of files to be scanned and/or reduce a number of identifiers of undesirable code used for scanning;
wherein files written to since the last scan are scanned against all known identifiers of undesirable code; and
wherein files that have not been written to since a last scan are scanned only against newly introduced identifiers of undesirable code;
wherein the computer readable program code is unable to directly access the secure memory.
28. The product according to claim 27 , wherein the trusted variables further comprise a trusted scan timestamp; and
wherein the newly introduced identifiers of undesirable code are determined relative to the trusted scan timestamp stored in the secure memory.
29. The product according to claim 27 , wherein the files that have been written to since the last scan are stored in a read/write area of a storage device; and
wherein the files that have not been written to since the last scan are stored in a first area of a storage device; and
wherein files in the first area are bypassed in a subsequent scan in response to a determination that:
the first area has not been written to since a prior scan; and
the files in the first area have been scanned in a prior scan against all known identifiers of undesirable code;
the files in the first area that are bypassed resulting in a bypassed area.
30. The product according to claim 29 , wherein the first area is securely configurable between a normal read-only state and a writeable state, the configuration being under the control of the security system.
31. The product according to claim 30 , wherein the code is further effective to:
upon successfully scanning the files in the read/write area, activate and authenticate a first security measure of the security system to configure the first area to the writeable state, wherein the authentication executes out of the secure memory;
write the successfully scanned files in the read/write area to the first area; and
configure the first area to a read-only state after writing of successfully scanned files.
32. The product according to claim 31 , wherein the authentication for the first security measure is an authentication selected from the group consisting of a password, a digital signature, and a biometric.
33. The product according to claim 27 , wherein the code is further effective to:
request from the security subsystem a trusted scan timestamp of when the last scan was executed and which is trusted by virtue of the secure memory; and
scan the bypassed area against a newly introduced identifier which is associated with malicious code known to have come into existence on a new identifier date, wherein the scan of the bypassed area occurs in response to a determination that a new identifier timestamp, which is related to the new identifier date, is earlier than the trusted scan timestamp; and wherein the bypassed area is not scanned for other known identifiers of malicious code that were included in the last scan of the bypassed area.
34. A product comprising:
a tangible computer usable medium having computer readable program code stored therein, the computer readable program code in said product being effective to:
store trusted variables that pertain to prior scans for identifiers of undesirable code in a secure memory of a security subsystem, the secure memory being inaccessible to code executed by an operating system, the trusted variables comprising:
a trusted scan timestamp; and
accelerate a scan for identifiers of undesirable code by utilizing the trusted variables to reduce a number of files to be scanned and/or reduce a number of undesirable code identifiers used for scanning;
wherein files that have not been written to since the last scan are scanned only against newly introduced identifiers of undesirable code; and
wherein the newly introduced identifiers of undesirable code are determined relative to the trusted scan timestamp stored in the secure memory.
35. An apparatus comprising:
a processor; and
a main memory that stores code which is executed under an operating system by the processor;
a security subsystem having a secure memory which is inaccessible to the code which is executed under the operating system by said processor, the secure memory storing trusted variables that pertain to prior scans for undesirable code, the trusted variables comprising:
a trusted scan timestamp;
wherein the storage device is operatively coupled to said processor and said security subsystem and is subdivided into a first area and a read/write area, the first area being securely configurable under the control of said security system between a normal read-only state and a writeable state;
wherein the security system is configured to accelerate a scan for identifiers of undesirable code by utilizing the trusted variables to reduce a number of files to be scanned and/or to reduce a number of identifiers of undesirable code to be used for scanning;
wherein files written to since the last scan are stored in the read/write area, whereby the files written to since the last scan are scanned against all known identifiers of undesirable code; and
wherein files that have not been written to since a last scan are stored in the first area, whereby the files that have not been written to since the last scan are scanned only against newly introduced identifiers of undesirable code as determined by referencing the trusted variables.
36. A method comprising:
storing at least one trusted variable that pertains to a prior scan for identifiers of undesirable code in a secure memory of a security subsystem, the secure memory being inaccessible to code executed by an operating system, the at least one trusted variable comprising:
a trusted scan timestamp;
accelerating a scan for identifiers of undesirable code by utilizing the at least one trusted variable to reduce a number of files to be scanned and/or reduce a number of undesirable code identifiers used for scanning;
wherein files that have not been written to since the last scan are scanned only against newly introduced identifiers of undesirable code; and
wherein the newly introduced identifiers of undesirable code are determined relative to the trusted scan timestamp stored in the secure memory.