Platform based verification of contents of input-output devices

[0001] Input-output devices such as universal serial bus (USB) flash drives, compact disk read-only memory (CD-ROM), pen drives are, unfortunately, being used as a common medium to spread malware/worms/viruses over enterprise networks and internet based networks. For example, common viruses such as “Ravmon”, “Orkut is banned”, “New Folder.exe” are spreading through USB drives. Most of the Anti-virus programs available in the market place are unable to detect them and even if the viruses are detected, the anti-virus programs are unable to delete the infected files. The anti-virus programs may only quarantine the infected files.

[0008] The following description describes embodiments of a platform based verification of the contents of the I/O devices. In the following description, numerous specific details such as logic implementations, resource partitioning, or sharing, or duplication implementations, types and interrelationships of system components, and logic partitioning or integration choices are set forth in order to provide a more thorough understanding of the present invention. It will be appreciated, however, by one skilled in the art that the invention may be practiced without such specific details. In other instances, control structures, gate level circuits, and full software instruction sequences have not been shown in detail in order not to obscure the invention. Those of ordinary skill in the art, with the included descriptions, will be able to implement appropriate functionality without undue experimentation.

[0009] References in the specification to “one embodiment”, “an embodiment”, “an example embodiment”, indicate that the embodiment described may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to affect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

[0010] Embodiments of the invention may be implemented in hardware, firmware, software, or any combination thereof. Embodiments of the invention may also be implemented as instructions stored on a machine-readable medium, which may be read and executed by one or more processors. A machine-readable medium may include any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computing device).

[0011] For example, a machine-readable medium may include read only memory (ROM); random access memory (RAM); magnetic disk storage media; optical storage media; flash memory devices; electrical, optical, acoustical or other similar signals. Further, firmware, software, routines, and instructions may be described herein as performing certain actions. However, it should be appreciated that such descriptions are merely for convenience and that such actions in fact result from computing devices, processors, controllers, and other devices executing the firmware, software, routines, and instructions.

[0012] In one embodiment, the platform 100 may comprise applications 110, a host operating system (OS) 120, a platform hardware 150, and I/O devices 190. In one embodiment, the applications 110 may comprise one or more applications supported by the host OS 120 and the platform hardware 150.

[0013] In one embodiment, the platform hardware 150 may comprise one or more processing cores, chipset, memory, and such other similar hardware components. In one embodiment, the platform hardware 150 may support components such as a firmware, manageability engine (ME) and virtualizer engine (VE). In one embodiment, the platform hardware 150 may verify the contents of the I/O device 190-N even before the contents are exposed to the host OS 120 in response to receiving an interrupt from an I/O device 190-N. In one embodiment, the OS independent hardware based verification process may avoid the platform 100 from being infected by the malware or virus. In one embodiment, the verification of the contents of the I/O devices may be applicable to legacy I/O devices and the verification process may also provide better user experience.

[0014] An embodiment of the operation of the platform 100, which may verify the contents of the I/O device before the contents are exposed to the host OS 120 is illustrated in flow-chart of FIG. 2.

[0015] In block 210, the platform hardware 150 may receive an interrupt from an I/O device such as the I/O device 190-N and control passes to block 250 in response to receiving the interrupt. In one embodiment, the interrupt may be generated in response to an input-output device 190-N such as a USB drive or a pen drive plugged into the platform 100.

[0016] In block 250, the platform hardware 150 may verify the contents of the I/O device 190-N even before the contents of the I/O device 190-N are exposed to the host OS 120. In one embodiment, the platform hardware 150 may detect infected portions of the contents of the I/O device 190-N if the contents comprise infected portions.

[0017] In block 280, the platform hardware 150 may alert a user or delete the infected portions of the contents of the I/O device 190-N, if any, even before the infected portions affect the platform 100.

[0018] An embodiment of a platform architecture 300 comprising hardware or firmware components that enable verification of the contents of an I/O device before the contents are exposed to the host OS is illustrated in FIG. 3. In one embodiment, the host OS 120 may support a local AV agent 315 and a host interface 316. In one embodiment, the platform hardware 150 may include a central processing unit 320 and chipset 325, which may support a platform control hub (PCH) 330. In other embodiment, the chipset 325 may support a local AV interface 315 in which case the host OS 120 may not comprise the local AV interface 315.

[0019] In one embodiment, the CPU 320 may support the host OS 120. In one embodiment, the platform controller hub PCH 330 may comprise a manageability engine ME 340, a virtualizer engine VE 350, and an I/O controller 360.

[0020] In one embodiment, the I/O controller 360 may receive an interrupt signal after the I/O device 190-N is coupled to the platform 300. In one embodiment, the I/O controller 360 may provide interrupt information to the virtualizer engine VE 350. In one embodiment, the I/O controller 360 may receive an interrupt from a USB based I/O device and may provide the interrupt information based on, for example, extended host command interface (EHCI) standards.

[0021] In one embodiment, the virtualizer engine VE 350 may comprise a virtualizer engine (VE) controller 354 and a virtualizer engine (VE) interface 355. In one embodiment, the VE interface 355 may support exchange of information between the VE 350 and the I/O controller 360. In one embodiment, the VE interface 355 may receive an interrupt signal from the I/O controller 360 and may pass information of the interrupt signal to the VE controller 354. In one embodiment, the VE interface 355 may receive scanning request from the VE controller 354 in response to sending the interrupt signal and may forward the scanning request to the ME 340. In one embodiment, the VE interface 355 may use interfaces such as manageability engine command interface (MECI) to support MECI connection to the ME 340 and an extended host command interface (EHCI) to support EHCI connection to the I/O controller 360.

[0022] In one embodiment, the VE controller 354 may support drivers that allow the VE controller 354 to generate the scanning request for initiating a hardware based scanning of the contents of the I/O device 190-N. In one embodiment, the VE controller 354 may generate a hardware based scanning request based on the interruption signal received from the VE interface 355. In one embodiment, the scanning request may allow a user of the platform to provide inputs on whether the scanning of the contents of the I/O device 190-N is to be performed. In one embodiment, the VE controller 354 may send the scanning request to the VE interface 355.

[0023] In one embodiment, the manageability engine ME 340 may comprise ME interface 341, ME controller 342, compression block 343, file system block 345, and out-of-band (OOB) 348. In one embodiment, the ME interface 341 may support exchange of information with the VE 350 and the local AV agent 315, which may be provisioned either in a host OS 120 or within the platform hardware 130. In one embodiment, the ME interface 341 may receive scanning request and forward the scanning request to the ME controller 342. In one embodiment, the ME interface 341 may receive contents of the I/O device 190-N after the ME controller 342 issues a command to retrieve the contents and may pass the contents to the ME controller 342. In one embodiment, the ME interface 341 may support interfaces such as manageability engine command interface (MECI) to support a MECI connection to the VE 350 and host embedded control interface (HECI) to support a HECI connection to the host OS 120. In one embodiment, the ME interface 341 may also support proprietary protocols to support communication between the local AV agent 315 and the ME 340 if the local AV agent 315 is provisioned within the platform hardware 130.

[0024] In one embodiment, the ME controller 342 may forward the scanning request to a user via user interface UI 305. In one embodiment, the ME controller 342 may use UI 305 to receive user inputs such as a grant signal for verification of the contents of the I/O device 190-N from a user in response to the scanning request. In one embodiment, the ME controller 342 may retrieve contents of the I/O device 190-N for verification based on the user input. In one embodiment, the ME controller 342 may use EHCI driver supported by the VE controller 354 to retrieve the contents of the USB type I/O device 190-N. In one embodiment, the ME controller 342 may store the contents of the I/O device 190-N in a file system block 345. In one embodiment, the file system block 345 may support file allocation table (FAT-32) format and the contents of the I/O device 190-N may be stored on a per-file basis. In one embodiment, the ME controller 342 may generate hash of each file of the I/O device 190-N.

[0025] In one embodiment, ME controller 342 may send the contents of the I/O device 190-N to the local AV agent 315 or to a remote console 390 for verification. In one embodiment, the ME controller 342 may send the hash values to the local AV agent 315 if the ME controller 342 uses the local AV agent 315 for verification of the contents of the I/O device 190-N. While using remote verification process, in one embodiment, the ME controller 342 may compress the contents of the I/O device 190-N using the compression block 343 to conserve network bandwidth. In one embodiment, the compression block 343 may use compression algorithms such as Lempel-ziv LZ1, LZ2 algorithms or any other lossy or lossless algorithms, for example. In one embodiment, the ME controller 342 may send the compressed contents to the out-of-band communication block OOB 348 via the ME interface 341. In one embodiment, the OOB 348 may use out-of-band signaling mechanism to send the compressed contents to the AV application/service 395 supported by the remote console 390.

[0026] In one embodiment, the ME controller 342 may receive the results of verification and may alert the user if the verification results indicate presence of infected portions in the contents of the I/O device 190-N. In one embodiment, the ME controller 342 may receive a log of the infected portions of the contents from one of the local AV agent 315 or AV application/service 395. In one embodiment, the ME controller 342 may initiate deletion process in which the infected portions of the contents of the I/O device 190-N may be deleted. In one embodiment, the ME controller 342 may provide the information of the infected portions the user or host OS 120.

[0027] In one embodiment, the host OS 120 may support a local anti-virus (AV) agent 315 and a host interface 316. In one embodiment, the host interface 316 may support, for example, HECI interface to provide a HECI connection to the platform hardware 130. In one embodiment, the local AV agent 315 may receive contents of the I/O device 190-N from the platform controller hub PCH 330 over the HECI connection and may process the contents of the I/O device 190-N to detect presence of infected portions. In one embodiment, the local AV agent 315 may detect presence of viruses, malware, or worms (infected portions) in the contents and may provide such information of the infected portions to the ME 340 over HECI connection. In one embodiment, the local AV agent 135 may scan the contents and provide results to PCH 330 before the PCH 330 may expose the I/O device 190-N such as a USB device to host OS 120 for auto-play.

[0028] In other embodiment, the local AV agent 315 may be supported by a chipset provisioned within the platform hardware 130. In such a case, the local AV agent 315 may receive the contents of the I/O device 190-N over proprietary communication medium and detect the presence of infected portions. In one embodiment, the local AV agent 315 may detect presence of viruses, malware, or worms (infected portions) in the contents and may provide such information of the infected portions to the ME 340 over proprietary connection. In one embodiment, the local AV agent 135 supported by the PCH 330 may scan the contents and provide results to ME 340. In one embodiment, such an approach may avoid transfer of contents of the I/O device 190-N over the HECI connection.

[0029] In one embodiment, the remote console 390 may comprise AV application/services 395, which may uncompress the compressed contents before performing a anti-virus scan. In one embodiment, the AV application/services 395 may verify the contents and send a log of the infected portions to the ME 340 if the AV applications/services 395 detect presence of the infected portions.

[0030] A flow-chart illustrating the operation of the platform components of FIG. 3 to verify the contents of the I/O device 190-N before the contents are exposed to the host OS 120 is illustrated in flow-chart of FIG. 4.

[0031] In block 410, the I/O controller 360 may receive an interrupt from an I/O device such as the I/O device 190-N and may pass the interrupt signal to the VE 350.

[0032] In block 420, the VE controller 354 may send a request to the host OS 120 or a user using UI 305 for a hardware based scanning of the contents of the I/O device 190-N. In block 430, the ME controller 342 may retrieve the contents of the I/O device 190-N using a driver supported by the VE controller 354 if the user selects to scan the contents of the I/O device 190-N.

[0033] In block 450, the ME controller 342 may send the contents of the I/O device 190-N to the local AV agent 315 or the AV application/service 395 of the remote console 390.

[0034] In block 460, the local AV agent 315 or the AV application/service 395 may verify the contents of the I/O device 190-N for presence of infected portions. In one embodiment, the local AV agent 315 or the AV application/service 395 may generate information (or a log), which may comprise indications of the infected portions of the contents of I/O device 190-N.

[0035] In block 470, the local AV agent 315 or the AV application/service 395 may provide information (or a log) to the ME 340.

[0036] In block 480, the ME controller 342 may alert the user and then delete the infected portions even before the infected portions are exposed to the operating system. In one embodiment, the ME controller 342 may delete the infected portions after receiving the information, which may indicate the presence of infected portions in the contents of the I/O device 190-N.

[0037] Referring to FIG. 5, a computer system 500 may include a general purpose processor 502 including a single instruction multiple data (SIMD) processor and a graphics processor unit (GPU) 505. The processor 502, in one embodiment, may perform enhancement operations in addition to performing various other tasks or store a sequence of instructions, to provide enhancement operations in a machine readable storage medium 525. However, the sequence of instructions may also be stored in the memory 520 or in any other suitable storage medium.

[0038] While a separate graphics processor unit 505 is depicted in FIG. 5, in some embodiments, the graphics processor unit 505 may be used to perform enhancement operations, as another example. The processor 502 that operates the computer system 500 may be one or more processor cores coupled to logic 530. The logic 530 may be coupled to one or more I/O devices 560, which may provide interface the computer system 500. The logic 530, for example, could be chipset logic in one embodiment. The logic 530 is coupled to the memory 520, which can be any kind of storage, including optical, magnetic, or semiconductor storage. The graphics processor unit 505 is coupled through a frame buffer 510 to a display 540.

[0039] The logic 530 may support manageability engine ME 532 and virtualizer engine VE 536. In one embodiment, the ME 532 may be similar to the ME 342 described with reference to FIG. 3 above and VE 536 may be similar to the VE 354 described with reference to FIG. 3 above. In one embodiment the logic 530 may receive an interrupt from an I/O device such as the I/O device 550-2 and initiate the VE 536. In one embodiment, the interrupt may be generated in response to an I/O device 550-2 such as a USB drive or a pen drive plugged into the computer system 500.

[0040] In one embodiment, the ME 532 and VE 536 may cause the contents of the I/O device 550-2 to be verified even before the contents of the I/O device 550-2 are exposed to the host OS 503 supported by the processor 502. In one embodiment, the local AV agent 504 or an agent supported by the remote console 580 may detect infected portion of the contents if the contents are infected. In one embodiment, the agent of the remote console 580 may be used by sending the contents to the agent using the network 570. In one embodiment, the computer system 500 may be coupled to the network 570 using the network interface 560. In one embodiment, the ME 532 may alert a user or delete the infected portions of the contents of the I/O device 550-2 after detecting any infected portion in the contents.

[0041] Certain features of the invention have been described with reference to example embodiments. However, the description is not intended to be construed in a limiting sense. Various modifications of the example embodiments, as well as other embodiments of the invention, which are apparent to persons skilled in the art to which the invention pertains are deemed to lie within the spirit and scope of the invention.