System and method for providing a secured operating system execution environment

摘要

In one embodiment, a system for launching a security architecture includes an electronic device comprising a processor and one or more operating systems, a security agent, and a launching module. The launching module comprises a boot manager and a secured launching agent. The boot manager is configured to boot the secured launching agent before booting the operating systems, and the secured launching agent is configured to load a security agent. The security agent is configured to execute at a level below all operating systems of the electronic device, intercept a request to access a resource of the electronic device, the request originating from the operational level of one of one or more operating systems of the electronic device, and determine if a request is indicative of malware. In some embodiments, the secured launching agent may be configured to determine whether the security agent is infected with malware prior to loading the security agent.

主权项

1. A system, comprising:
an electronic device comprising a processor and one or more operating systems; a security agent configured to:
execute at a higher priority than all operating systems of the electronic device;intercept, at a higher priority than all operating systems of the electronic device, a request to access a resource of the electronic device, the resource including one or more files associated with the security agent;determine, at a higher priority than all operating systems of the electronic device, whether the request is indicative of malware, including:
utilizing a disk mapping bitmap containing metadata corresponding to the one or more files associated with the security agent to determine that the request is for the one or more files associated with the security agent, the metadata specifying a plurality of sectors on a storage device where each of the one or more files are stored;determining that the requestor is unauthorized; andbased upon a determination that the request is for the sectors on the storage device specified in the disk mapping bitmap and upon a determination that the requestor is unauthorized, determining that the request is indicative of malware and denying the request;and a launching module comprising:
a secured launching agent configured to launch the security agent; anda boot manager configured to boot the secured launching agent before booting the one or more operating systems.