Method and system for protecting a computer system during boot operation

1. A method for protecting a computer system in a computer network during boot operation of an operating system of the computer system, the method comprising:

(1) compiling a security profile of the computer system into a compiled security profile for inspecting packets transmitted to or from the computer system;

(2) storing the compiled security profile to a non-transitory computer readable persistent storage medium accessible to a network driver of the operating system during an early stage of the boot operation of the operating system when kernel mode services are available and before user mode services are initialized; and

(3) by the network driver of the operating system, loading the compiled security profile from the non-transitory computer readable persistent storage medium into a memory of the computer system during the early stage of the boot operation of the operating system for inspecting packets transmitted to or from the computer system via the computer network based on the compiled security profile during the early stage of the boot operation of the operating system.

2. The method of claim 1 , wherein the compiled security profile comprises one or more packet inspection rules for analyzing structure of the transmitted packets.

3. The method of claim 2 , further comprising:

(4) by the network driver, inspecting packets transmitted to and from the computer system during the early stage of the boot operation by using the one or more inspection rules, including analyzing structure of the transmitted packets.

4. The method of claim 2 wherein the one or more packet inspection rules comprises rule data which applies to one or more network interfaces of the computer system.

5. The method of claim 2 wherein the one or more packet inspection rules comprises rule data which applies to one or more network addresses of the computer network.

6. The method of claim 1 , wherein the step (1) comprises compiling the security profile into the compiled security profile, which is a binary format.

7. The method of claim 6 , wherein the step of compiling the security profile into the binary format comprises compiling the security profile into a contiguous binary format.

8. The method of claim 6 , wherein the step of compiling the security profile into the binary format comprises compiling the security profile into one or more tables.

9. The method as described in claim 8 , wherein compiling the security profile into one or more tables comprises compiling the security profile into an index table comprising size and location of other tables, a filter table comprising packet inspection rules, and an address table comprising one or more network addresses of the computer network.

10. The method as described in claim 9 , wherein compiling the security profile into one or more tables further comprises compiling the security profile into an interface table comprising addresses of one or more network interfaces of the computer network.

11. The method as described in claim 1 wherein the step (3) further comprises inspecting packets while the operating system is being booted.

12. The method of claim 1 , wherein the early stage of the boot operation comprises the kernel mode services when the network driver of the operating system becomes available.

13. A method for inspecting a data packet transmitted to or from a computer system in a computer network during boot operation of an operating system of the computer system, the method comprising:

(1) compiling a security profile of the computer system into a compiled security profile, the security profile comprising one or more packet inspection rules;

(2) storing the compiled security profile to a non-transitory computer readable persistent storage medium accessible to a network driver of the operating system during an early stage of the boot operation of the operating system when kernel mode services are available and before user mode services are initialized;

(3) by the network driver of the operating system, loading the compiled security profile from the non-transitory computer readable persistent storage medium into a memory of the computer system during the early stage of the boot operation of the operating system; and

(4) by the network driver of the operating system, inspecting the data packet during the early stage of the boot operation of the operating system by comparing at least a portion of the data packet with at least a portion of the compiled security profile.

14. The method of claim 13 wherein the one or more packet inspection rules comprises rule data which applies to one or more network interfaces of the computer system.

15. The method of claim 13 wherein the one or more packet inspection rules comprises rule data which applies to one or more network addresses of the computer network.

16. The method of claim 13 , wherein the step (1) comprises compiling the security profile into the compiled security profile, which is a binary format.

17. The method of claim 13 , wherein the step of compiling the security profile into the binary format comprises compiling the security profile into a contiguous binary format.

18. The method of claim 16 , wherein the step of compiling the security profile into the binary format comprises compiling the security profile into one or more tables.

19. The method as described in claim 13 wherein the step (4) comprises inspecting packets while the operating system is being booted.

20. A system for protecting a computer system in a computer network during boot operation of an operating system of the computer system, the system comprising:

a processor, and a non-transitory computer readable storage medium, comprising computer readable instructions stored thereon for execution by the processor, causing the processor:

(1) to compile a security profile of the computer system into a compiled security profile for inspecting packets transmitted to or from the computer system;

(1) (2) to store the compiled security profile to a non-transitory computer readable persistent storage medium accessible to a network driver of the operating system during an early stage of the boot operation of the operating system when kernel mode services are available and before user mode services are initialized; and

(3) by the network driver of the operating system, to load the compiled security profile from the persistent storage medium into a memory of the computer system during the early stage of the boot operation of the operating system for inspecting packets, transmitted to or from the computer system by the computer network, according to the compiled security profile during the early stage of the boot operation of the operating system.

21. The system according to claim 20 wherein the compiled security profile comprises one or more packet inspection rules in a binary format for comparing at least a portion of a packet with at least a portion of the compiled security profile.

22. The system according to claim 21 wherein the one or more inspection rules comprises rule data which applies to one or more network interfaces of the computer system, or one or more network addresses of the computer network.

23. The system as described in claim 20 wherein the network driver is a kernel network driver of the operating system.

24. The system of claim 15 , wherein the early stage of the boot operation comprises the kernel mode services when the network driver of the operating system becomes available.

25. A boot protection apparatus for protecting a computer system in a computer network during boot operation of an operating system of the computer system, the boot protection apparatus comprising:

a non-transitory computer readable storage medium, comprising computer readable instructions stored thereon for execution by a processor, forming:

a network driver of the operating system, comprising:

(i) a boot module for loading a compiled security profile stored in a persistent storage medium and comprising packet inspection rules into a memory of the computer system during an early stage of the boot operation of an operating system of the computer system when kernel mode services are available and before user mode services are initialized, and;

(ii) a packet module for inspecting packets transmitted to or from the computer system by the computer network during the early stage of the boot operation of the operating system according to the inspection rules.

26. The boot protection apparatus of claim 25 wherein the network driver comprises an NDIS (Network Driver Interface Specification) intermediate driver.

27. The boot protection apparatus as described in claim 25 wherein the packet module is configured to inspect packets transmitted to or from a kernel driver of the operating system that is undergoing the boot operation.

28. The boot protection apparatus of claim 25 , wherein the early stage of the boot operation comprises the kernel mode services when the network driver of the operating system becomes available.

29. A non-transitory computer readable storage medium comprising computer code instructions stored thereon for execution by a processor, causing the processor to:

(1) compile a security profile of the computer system into a compiled security profile for inspecting packets transmitted to or from the computer system;

(2) store the compiled security profile to a computer readable persistent storage medium accessible to a network driver of an operating system of the computer system during an early stage of the boot operation of the operating system when kernel mode services are available and before user mode services are initialized; and

(3) by the network driver of the operating system, loading the compiled security profile from the computer readable persistent storage medium into a memory of the computer system during the early stage of the boot operation of the operating system for inspecting packets transmitted to or from the computer system via the computer network based on the compiled security profile during the early stage of the boot operation of the operating system.