Computer pre-boot security verification, enforcement, and remediation
View Patent ↗Various embodiments herein each include at least one of systems, methods, and software for computer pre-boot security verification. Some embodiments are implemented during a boot sequence of a computer that controls Self-Service Terminal (SST) operation before a main Operating System (OS) of the computer is loaded. One such embodiment in the form of a method includes starting a pre-boot OS upon start of a computer that controls operation of an SST and identifying any variances between a current state of the computer and data representative of a reference state within a computing environment of the pre-boot OS. This example method further includes performing at least one remedial action when any variance is identified and launching a main OS and stopping and unloading the pre-boot OS when no variance is identified.
1. A method comprising:
starting a pre-boot Operating System (OS) upon start of a computer that controls operation of a Self-Service Terminal (SST);
identifying any variances between a current state of the computer and data representative of a reference state within a computing environment of the pre-boot OS, the variances identified based at least in part upon current computer configuration settings and properties including a plurality of configuration settings and properties of a platform layer system, the main operating system, data stored by the computer, devices connected to the computer, a firewall, and a threat detection program;
performing at least one remedial action when any variance is identified, the at least one remedial action including:
identifying a remedial data processing action to resolve an identified variance, the remedial data processing action identified based on the identified variance;
performing the remedial data processing action;
re-identifying any variances between the current computer state and the data representative of the reference state;
performing at least one remedial action when the verification program identifies the same or a different variance between the current computer state and the reference state; and
launching the main OS and stopping and unloading the pre-boot OS when the verification program does not re-identify variance between the current computer state and the reference state; and
launching a main OS and stopping and unloading the pre-boot OS when no variance is identified.
2. The method of claim 1 , wherein:
the data representative of the reference state includes data representative of expected configuration settings and properties including a plurality of platform layer system, main operating system, stored data, device, firewall, and threat detection program configuration settings and properties; and
identifying any variances between the current computer state and the reference state includes comparing the current computer configuration settings and properties and the data representative of the reference state.
3. The method of claim 2 , wherein at least a portion of the data representative of the reference state is retrieved over a network via a network interface device of the computer.
4. A method comprising:
launching, on a computing device of a Self-Service Terminal (SST), a pre-boot Operating System (OS) from a platform layer system prior to launching of a main operating system of the SST that controls operation of the SST when active to conduct transactions, and
launching a verification program within the pre-boot OS, the verification program executable to perform data processing activities comprising:
identifying any variances between a current SST computing device state and data representative of a reference state, the variances identified based at least in part upon current SST configuration settings and properties including a plurality of configuration settings and properties of a platform layer system, the main operating system, data stored by the SST, devices connected to the SST, a firewall, and a threat detection program;
performing at least one remedial action when the verification program identifies variance between the current SST computing device state and the reference state and returning to the identifying; and
launching the main OS and stopping and unloading the pre-boot OS when the verification program does not identify variance between the current SST computing device state and the reference state.
5. The method of claim 4 , wherein:
the data representative of the reference state includes data representative of expected configuration settings and properties including a plurality of platform layer system, main operating system, stored data, devices connected to the SST computing device, firewall, and threat detection program configuration settings and properties; and
the verification program identifies variances between the current SST computing device state and the data representative of the reference state by comparing the current SST configuration settings and properties and the data representative of the reference state.
6. The method of claim 5 , wherein the data representative of the reference state is retrieved over a network via a network interface device of the SST computing device.
7. The method of claim 4 , wherein the at least one remedial action includes preventing the SST from being enabled for conducting transactions.
8. The method of claim 7 , wherein the at least one remedial action further includes transmitting a notification of the identified variance between the current SST computing device state and the reference state to a notification repository.
9. The method of claim 4 , wherein the at least one remedial action includes:
identifying a remedial data processing action to resolve the variance, the remedial data processing action identified based on an identified variance;
performing the remedial data processing action;
re-identifying any variances between the current SST computing device state and the data representative of the reference state;
performing at least one remedial action when the verification program identifies the same or a different variance between the current SST computing device state and the reference state; and
launching the main OS and stopping and unloading the pre-boot OS when the verification program does not re-identify variance between the current SST computing device state and the reference state.
10. The method of claim 4 , wherein the computer platform layer system is a Basic Input/Output System (BIOS).
11. The method of claim 4 , wherein the computer platform layer system is a Unified Extensible Firmware Interface (UEFI).
12. The method of claim 4 , wherein the SST is an Automated Teller Machine (ATM).
13. A Self-Service Terminal (SST) comprising:
a computer that controls operation of the SST, the computer including a motherboard with at least one processor and at least one memory device thereon, the at least one memory device storing a platform layer system, a pre-boot Operating System (OS), a main OS, a variance identification program, at least one SST controlling program, and configuration settings thereof, the platform layer system executable according to the configuration settings by the at least one processor to control booting of the computer and to launch the pre-boot Operating System (OS) on the computer prior to a launching of the main OS and the at least one SST controlling program that executes therein; and
the variance identification program executable by the at least one processor to perform data processing activities comprising:
identifying any variances between a current state of the computer and data representative of a reference state, the variances identified based at least in part upon current computer configuration settings and properties including a plurality of configuration settings and properties of a platform layer system, the main operating system, data stored by the computer, devices connected to the computer, a firewall, and a threat detection program;
performing at least one remedial action when any variance is identified and restarting the data processing activities; and
launching the main OS and stopping and unloading the pre-boot OS when no variance is identified.
14. The SST of claim 13 , wherein:
the data representative of the reference state includes data representative of expected configuration settings and properties including a plurality of platform layer system, main operating system, stored data, device, firewall, and threat detection program configuration settings and properties; and
identifying any variances between the current computer state and the reference state includes comparing the current computer configuration settings and properties and the data representative of the reference state.
15. The SST of claim 14 , wherein:
the computer further includes a network interface device; and
at least a portion of the data representative of the reference state is retrieved over a network via the network interface device.
16. The SST of claim 13 , wherein the at least one remedial action includes:
identifying a remedial data processing action to resolve an identified variance, the remedial data processing action identified based on the identified variance;
performing the remedial data processing action;
re-identifying any variances between the current computer state and the data representative of the reference state;
performing at least one remedial action when the verification program identifies the same or a different variance between the current computer state and the reference state; and
launching the main OS and stopping and unloading the pre-boot OS when the verification program does not re-identify variance between the current computer state and the reference state.
17. The SST of claim 13 , wherein the platform layer system is a Basic Input/Output System (BIOS).