System, method, and computer program product for mounting an image of a computer system in a pre-boot environment for validating the computer system
View Patent ↗A system, method, and computer program product are provided for mounting an image of a computer system in a pre-boot environment for validating the computer system. In use, an image of a computer system is mounted in a pre-boot environment of the computer system, where the image includes a file system structure and initialization data of the computer system. Furthermore, at least one task is performed on the mounted image for validating the computer system.
1. A non-transitory computer readable medium comprising instructions stored thereon to cause one or more processors to:
mount an image of a computer system in a pre-boot environment of the computer system, the mounted image including a file system structure and initialization data of the computer system;
initiate persistent components in the pre-boot environment;
monitor a security system of the computer system during execution of an operating system of the computer system, utilizing the persistent components, to ensure that the security system executes as expected;
identify a first set of components of the computer system registered to be automatically loaded;
identify a second set of components of the computer system registered to be loaded during a boot-up stage of the computer system that is predetermined to be early; and
perform, in the pre-boot environment, at least one task on at least one component in the first or second set of components of the mounted image by the security system to validate the computer system,
wherein the persistent components span execution in the pre-boot environment and the operating system of the computer system.
2. The non-transitory computer readable medium of claim 1 , wherein the file system structure includes a directory and the initialization data includes a registry.
3. The non-transitory computer readable medium of claim 1 , wherein the pre-boot environment includes an environment existing in the computer system prior to execution of the operating system of the computer system.
4. The non-transitory computer readable medium of claim 1 , further comprising instructions to cause the one or more processors to provide the pre-boot environment via virtualization.
5. The non-transitory computer readable medium of claim 1 , further comprising instructions to cause the one or more processors to provide the pre-boot environment via a disk-based bootstrap.
6. The non-transitory computer readable medium of claim 1 , further comprising instructions to cause the one or more processors to provide the pre-boot environment via a chipset extension.
7. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause the one or more processors to perform the at least one task on at least one component of the mounted image for validating the computer system comprise instructions to cause the one or more processors to determine whether each component in the first set of components and the second set of components is trusted.
8. The non-transitory computer readable medium of claim 7 , wherein the instructions to cause the one or more processors to determine whether each component in the first set of components and the second set of components is trusted comprise instructions to cause the one or more processors to scan each component in the first set of components and the second set of components against known unwanted components.
9. The non-transitory computer readable medium of claim 7 , wherein the instructions to cause the one or more processors to determine whether each component in the first set of components and the second set of components is trusted comprise instructions to cause the one or more processors to verify a digital signature associated with each component in the first set of components and the second set of components.
10. The non-transitory computer readable medium of claim 7 , wherein the instructions to cause the one or more processors to determine whether each component in the first set of components and the second set of components is trusted comprise instructions to cause the one or more processors to evaluate a behavioral analysis of a history of the each component, the history including at least one of an installation of the each component, an origin of the each component, and a modification of the each component by another component.
11. The non-transitory computer readable medium of claim 7 , further comprising instructions to cause the one or more processors to perform an action on those components in the first set of components and the second set of components that are untrusted.
12. The non-transitory computer readable medium of claim 11 , wherein the instructions to cause the one or more processors to perform the action on those components in the first set of components and the second set of components that are untrusted comprise instructions to cause the one or more processors to:
determine at least one component of those components in the first set of components and the second set of components that are untrusted that is capable of being rescheduled; and
reschedule an initiation of the at least one component.
13. The non-transitory computer readable medium of claim 12 , wherein the instructions to cause the one or more processors to reschedule the initiation are performed after loading the security system on the computer system.
14. The non-transitory computer readable medium of claim 12 , wherein the instructions to cause the one or more processors to reschedule the initiation are performed on-demand by the security system of the computer system.
15. The non-transitory computer readable medium of claim 11 , wherein the instructions to cause the one or more processors to perform the action on those components in the first set of components and the second set of components that are untrusted comprise instructions to cause the one or more processors to substitute at least one component of those components with another component.
16. The non-transitory computer readable medium of claim 7 , further comprising instructions to cause the one or more processors to select between aborting a load of the computer system and allowing operation of the computer system in a limited operating mode after it is determined that at least one component in the first set of components and the second set of components is untrusted.
17. A method, comprising:
mounting an image of a computer system in a pre-boot environment of the computer system, the mounted image including a file system structure and initialization data of the computer system;
initiating persistent components in the pre-boot environment;
monitoring a security system of the computer system during execution of an operating system of the computer system, utilizing the persistent components, to ensure that the security system executes as expected;
identifying a first set of components of the computer system registered to be automatically loaded;
identifying a second set of components of the computer system registered to be loaded during a boot-up stage of the computer system that is predetermined to be early; and
performing, in the pre-boot environment, at least one task on at least one component in the first or second set of components of the mounted image by the security system to validate the computer system,
wherein the persistent components span execution in the pre-boot environment and the operating system of the computer system.
18. The method of claim 17 , wherein the act of performing, in the pre-boot environment, at least one task on at least one component of the mounted image by the security system to validate the computer system comprises determining whether the at least one component of the mounted image is trusted.
19. The method of claim 18 , further comprising performing an action on the at least one component after it is determined that the at least one component is untrusted.
20. The method of claim 19 , wherein the act of performing the action on the at least one component comprises rescheduling an initiation of the at least one component in response to a determination that the at least one component is capable of being rescheduled.
21. A computer system, comprising:
a memory; and
a processor communicatively coupled to the memory, the processor adapted to execute program code stored in the memory to:
mount an image of the computer system in a pre-boot environment of the computer system, the mounted image including a file system structure and initialization data of the computer system;
initiate persistent components in the pre-boot environment;
monitor a security system of the computer system during execution of an operating system of the computer system, utilizing the persistent components, to ensure that the security system executes as expected;
identify a first set of components of the computer system registered to be automatically loaded;
identify a second set of components of the computer system registered to be loaded during a boot-up stage of the computer system that is predetermined to be early; and
perform, in the pre-boot environment, at least one task on at least one component in the first or second set of components of the mounted image by the security system to validate the computer system,
wherein the persistent components span execution in the pre-boot environment and the operating system of the computer system.