Boot driver verification

1. A system, comprising:

a secure hash calculation engine comprising a physical processor, the secure hash calculation engine to intercept a pre-boot driver after the pre-boot driver is loaded and compute a secure hash for the pre-boot driver before the pre-boot driver is executed and prior to loading an operating system;

wherein the pre-boot driver is executed when the computed secure hash matches a hash on a whitelist;

wherein, when the computed secure hash does not match any hash on a whitelist, the matching being performed by a processor, the system executes a local security protocol, the local security protocol comprising:

not executing the loaded pre-boot driver;

downloading a new version of the pre-boot driver when the computer secure hash does not match a hash on the whitelist, but skipping downloading of the new version of the pre-boot driver when the secure hash matches a hash on the whitelist; and

updating the whitelist; and

wherein the local security protocol is executed while executing a Basic Input/Output System (BIOS) prior to loading an operating system.

2. The system of claim 1 , wherein the whitelist is locally stored.

3. The system of claim 1 , wherein the whitelist is remotely stored.

4. The system of claim 2 , wherein the locally stored whitelist is a copy of a remotely stored whitelist.

5. The system of claim 2 , further comprising periodically updating the locally stored whitelist.

6. The system of claim 1 , wherein the secure hash calculation engine is further to intercept an image of an operating system (OS) kernel.

7. A method, comprising:

intercepting, by a physical processor, a pre-boot driver before the pre-boot driver is executed;

computing, by the processor, prior to loading an operating system, a secure hash for the pre-boot driver;

executing, by the processor, the pre-boot driver when the computed secure hash matches a hash on a whitelist;

not executing, by the processor, the pre-boot driver when the computed secure hash does not match any hash on a whitelist, and, instead, determining whether to download a new version of the pre-boot driver comprising downloading a new version of the pre-boot driver and updating the whitelist when the computed secure hash does not match a hash on the whitelist and skipping download of the new version of the pre-boot driver otherwise; and

verifying, by the processor using secure hash matching to the whitelist, an Operating System (OS) image;

wherein the method is performed while executing a Basic Input/Output System (BIOS) prior to loading an operating system.

8. The method of claim 7 , further comprising:

forwarding, by the processor, the computed secure hash to a remote server; and

receiving, from the remote server, a verification result comprising the comparison of the computed secure hash with a hash from a whitelist.

9. The method of claim 7 , wherein the whitelist is stored locally.

10. The method of claim 9 , further comprising downloading, by the processor, the whitelist from a remote server.

11. The method of claim 7 , further comprising verifying, by the processor, images of an Operating System (OS) loader and an OS kernel.

12. The method of claim 7 , further comprising:

computing, by a processor, a sector secure hash for a sector of a mass storage device comprising early Operating System (OS) code;

comparing, by the processor, the sector secure hash with a stored secure hash for the sector; and

halting, by the processor, an early OS load process based on the sector secure hash and the stored secure hash not being equal.

13. The method of claim 10 , further comprising updating, by the processor, the whitelist.

14. A non-transitory computer readable storage device (CRSD) storing code, that when executed, causes a processor while executing a Basic Input/Output System (BIOS) prior to loading an operating system to:

intercept a pre-boot driver before the driver is executed;

compute, a hash value for the pre-boot driver;

execute the pre-boot driver when the computed hash matches a hash from a whitelist; and

execute a local security protocol when the computed hash does not match any hash on a whitelist;

wherein the local security protocol contains rules for handling pre-boot drivers when the computed hash does not match any hash on a whitelist, the matching being performed by a processor, the local security protocol comprising:

not executing the loaded pre-boot driver; and

determining whether to download a new version of the pre-boot driver comprising downloading a new version of the pre-boot driver and updating the whitelist when the computed secure hash does not match a hash on the whitelist, and skipping download of the new version of the pre-boot driver when the computed secure hash matches a hash on the whitelist.

15. The CRSD of claim 14 , wherein the whitelist is local.

16. The CRSD of claim 14 , wherein the code causes the processor to:

send the computed hash to a remote server to compare the computed hash with hashes on a remote whitelist; and

receive a result from the remote server.

17. The CRSD of claim 14 , wherein the security protocol does not allow the pre-boot driver to be executed when the computed hash does not match any hash on the whitelist.