System and method for firmware based anti-malware security
View Patent ↗A system for securing an electronic device includes a non-volatile memory, a processor coupled to the non-volatile memory, a resource of the electronic device, firmware residing in the non-volatile memory and executed by the processor, and a firmware security agent residing in the firmware. The firmware is communicatively coupled to the resource of an electronic device. The firmware security agent is configured to, at a level below all of the operating systems of the electronic device accessing the resource, intercept a request for the resource and determine whether the request is indicative of malware.
1. A system, comprising:
a non-transitory memory;
a processor coupled to the non-transitory memory;
firmware in the non-transitory memory including instructions, the instructions, when loaded and executed by the processor, configure the processor to:
intercept, from the firmware and at a higher priority than all operating systems of an electronic device, a request from an operating system of the electronic device to access a processing resource resident on the electronic device, wherein:
the firmware is communicatively coupled to the processing resource; and
the operating system is resident on the electronic device;
determine whether the request is indicative of malware; and
allow or deny the request to access the resource based upon whether the request is indicative of malware.
2. The system of claim 1 , wherein the firmware further includes instructions to cause the processor to:
receive information from the firmware identifying the request; and
access one or more security rules to determine whether the information indicates malware.
3. The system of claim 1 , wherein the firmware further includes instructions to cause the processor to receive security rules from a protection server to be used to determine whether to intercept the request for the processing resource.
4. The system of claim 1 , wherein the firmware further includes instructions to cause the processor to:
send information about a observed behavior on the electronic device associated with the request to a protection server; and
receive an indication of whether the observed behavior indicates malware.
5. The system of claim 1 , wherein the firmware resides in a controller of a peripheral of the electronic device.
6. The system of claim 1 , wherein the firmware executes within a bare metal layer of the electronic device.
7. The system of claim 1 , wherein the firmware further includes instructions to cause the processor to notify a security application in the operating system with information identifying elements in the operating system that made the request of the processing resource.
8. At least one non-transitory medium, comprising instructions, wherein:
the instructions, when loaded and executed by a processor, configure the processor to execute firmware;
the firmware is communicatively coupled to a processing resource resident on an electronic device;
the firmware is configured to intercept, from the firmware and at a higher priority than all operating systems of the electronic device, a request from an operating system resident on the electronic device to access the processing resource;
determine whether the request is indicative of malware; and
allow or deny the request to access the resource based upon whether the request is indicative of malware.
9. The medium of claim 8 , wherein the firmware is further configured to:
receive information from the firmware identifying the request; and
access one or more security rules to determine whether the information indicates malware.
10. The medium of claim 8 , wherein the firmware is further configured to receive security rules from a protection server to be used to determine whether to intercept the request for the processing resource.
11. The medium of claim 8 , wherein the firmware is further configured to:
send information about a observed behavior on the electronic device associated with the request to a protection server; and
receive an indication of whether the observed behavior indicates malware.
12. The medium of claim 8 , wherein the firmware is configured to execute in a controller of a peripheral of the electronic device.
13. The medium of claim 8 , wherein the firmware is configured to execute within a bare metal layer of the electronic device.
14. The medium of claim 8 , wherein the firmware is further configured to notify a security application in the operating system with information identifying elements in the operating system that made the request of the processing resource.
15. A method for electronic security, comprising, from firmware communicatively coupled to a processing resource resident on an electronic device:
intercepting, at a higher priority than all operating systems of the electronic device, a request from an operating system resident on the electronic device to access the processing resource;
determining whether the request is indicative of malware; and
allowing or denying the request to access the resource based upon whether the request is indicative of malware.
16. The method of claim 15 , further comprising:
receiving information from the firmware identifying the request; and
accessing one or more security rules to determine whether the information indicates malware.
17. The method of claim 15 , further comprising receiving security rules from a protection server to be used to determine whether to intercept the request for the processing resource.
18. The method of claim 15 , further comprising:
sending information about a observed behavior on the electronic device associated with the request to a protection server; and
receiving an indication of whether the observed behavior indicates malware.
19. The method of claim 15 , wherein the firmware executes in a controller of a peripheral of the electronic device.
20. The method of claim 15 , wherein the firmware executes within a bare metal layer of the electronic device.
21. The method of claim 15 , further comprising notifying a security application in the operating system with information identifying elements in the operating system that made the request of the processing resource.