Storage drive based antimalware methods and apparatuses
An anti-malware approach uses a storage drive with the capability to lock selected memory areas. Platform assets such as OS objects are stored in the locked areas and thus, unauthorized changes to them may not be made by an anti-malware entity.
1. A platform comprising:
a processor;
an operating system (OS) to be executed by the processor, and
a storage drive having memory blocks and lock logic to lock locked blocks comprising a group of the memory blocks, the operating system having a storage management agent that in cooperation with the lock logic, controls access to the locked blocks, the locked blocks including anti-malware application assets, wherein a qualified user associated with the anti-malware application has access to modify the anti-malware application in the locked blocks; and
a quarantine module in the storage drive for storing writes to the locked blocks in a quarantine memory section with writing to the locked blocks, wherein during boot up operations, a determination is made as to whether to apply the writes in the quarantine memory section to the locked blocks.
2. The platform of claim 1 , in which the storage drive is set up when the platform is known to be clean.
3. The platform of claim 1 , in which the lock logic is configured by authenticating to the qualified user.
4. The platform of claim 3 , in which the OS includes a storage configuration agent (SCA) that when executed in a provisioning stage determines logical block addresses (LBAs) for the locked blocks including locked blocks to store the anti-malware application assets.
5. The platform of claim 1 , wherein the OS comprises a pre-boot authentication agent to authenticate a platform user to access the storage drive for platform operation but not to be able to unlock the locked blocks.
6. The platform of claim 1 , wherein the quarantine module identifies platform asset change requests from an unauthorized user and store the change request in a quarantine region of the storage drive.
7. The platform of claim 6 , in which the quarantine module returns a palatable message to the OS even though a change request is not to be implemented.