Authentication of device configurations for authenticated devices
Validation of a firmware image on a client device is disclosed. Information corresponding to one or more addresses of an image stored on a client device is periodically requested via an application program interface (API) configured to provide access to the image on the client device. The requested information from the image on the client device is compared with the image stored on the server image with stored validation information corresponding to a valid version of the image. An indication is generated if the information from the image on the client device does not match the stored validation information.
1 . A method comprising:
periodically requesting, with a validation server that is part of an endpoint protection platform, information corresponding to one or more addresses in an image stored on a client device having an endpoint security agent via an application program interface (API) configured to provide access to the image on the client device, wherein the validation server provides a set of new addresses in the image for each new inquiry;
receiving, with the validation server, the requested information from the client device via the API;
comparing the requested information from the image on the client device with stored validation information corresponding to a valid version of the image;
generating an indication that the image on the client device has been modified if the information from the image on the client device does not match the stored validation information.
2 . The method of claim 1 wherein the information from the image on the client device comprises a hash of data from one or more specified addresses within the image on the client device.
3 . The method of claim 1 wherein the periodic requesting is part of a validation or verification process not related to the image stored on the client device.
4 . The method of claim 1 wherein the image corresponds to firmware on the client device.
5 . The method of claim 1 , wherein the API is implemented as a function call in an endpoint operating system through a representational state transfer (RESTful) API call.
6 . The method of claim 1 , wherein the API is implemented as a function in the image stored on the client device.
7 . The method of claim 1 , wherein the API is implemented as a function in a Basic Input/Output System (BIOS) of the client device.
8 . The method of claim 1 , wherein the API is implemented as a function in a hypervisor running on the client device.
9 . A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, are configurable to cause the one or more processors to:
periodically request, with a validation server that is part of an endpoint protection platform, information corresponding to one or more addresses in an image stored on a client device having an endpoint security agent via an application program interface (API) configured to provide access to the image on the client device, wherein the validation server provides a set of new addresses in the image for each new inquiry;
receive, with the validation server, the requested information from the client device via the API;
compare the requested information from the image on the client device with stored validation information corresponding to a valid version of the image;
generate an indication that the image on the client device has been modified if the information from the image on the client device does not match the stored validation information.
10 . The non-transitory computer-readable medium of claim 9 wherein the information from the image on the client device comprises a hash of data from one or more specified addresses within the image on the client device.
11 . The non-transitory computer-readable medium of claim 9 wherein the periodic requesting is part of a validation or verification process not related to the image stored on the client device.
12 . The non-transitory computer-readable medium of claim 9 wherein the image corresponds to firmware on the client device.
13 . The non-transitory computer-readable medium of claim 9 wherein the API is implemented as a function call in an endpoint operating system through a representational state transfer (RESTful) API call.
14 . The non-transitory computer-readable medium of claim 9 wherein the API is implemented as a function in the image stored on the client device.
15 . The non-transitory computer-readable medium of claim 9 wherein the API is implemented as a function in a Basic Input/Output System (BIOS) of the client device.
16 . The non-transitory computer-readable medium of claim 9 wherein the API is implemented as a function in a hypervisor running on the client device.
17 . A computing device comprising:
a memory system; and
a processor coupled with the memory system, the processor configurable to:
periodically request, with a validation server that is part of an endpoint protection platform, information corresponding to one or more addresses in an image stored on a client device having an endpoint security agent via an application program interface (API) configured to provide access to the image on the client device, wherein the validation server provides a set of new addresses in the image for each new inquiry;
receive, with the validation server, the requested information from the client device via the API;
compare the requested information from the image on the client device with stored validation information corresponding to a valid version of the image;
generate an indication that the image on the client device has been modified if the information from the image on the client device does not match the stored validation information.
18 . The computing device of claim 17 wherein the API is implemented as a function call in an endpoint operating system through a representational state transfer (RESTful) API call.
19 . The computing device of claim 17 wherein the API is implemented as a function in the image stored on the client device.
20 . The computing device of claim 17 wherein the API is implemented as a function in a hypervisor running on the client device.