Continuous Cryptographic Telemetry & Autonomous Compliance Artifact Generation
Two-Layer Firmware and OS Detection Architecture with PQC-Sealed Multi-Framework Compliance Output · Patent Pending
A UEFI DXE driver establishes cryptographic baselines inside firmware before the OS loads. A Rust OS-layer agent receives those baselines via a UEFI variable channel, ingests continuous OS telemetry, and seals every event atomically to a PQC-signed audit chain simultaneously mapped to multiple compliance frameworks. The output is not a report. It is a cryptographically sealed compliance artifact any assessor can independently verify.
Two-layer architecture
Firmware-resident baseline
UEFI DXE driver establishes cryptographic baselines before the OS loads. Baselines are inaccessible to any OS-layer attacker. SMM handler monitors interrupt frequency from inside System Management Mode.
PQC-sealed continuous chain
Every detection event — firmware or OS layer — is sealed in a single atomic transaction: hash-chained, Ed25519 + ML-DSA-87 signed, and mapped to multiple compliance frameworks simultaneously.
Autonomous compliance artifacts
SSP, POA&M, SPRS score, and attestation documents generated autonomously from accumulated sealed evidence. No questionnaires. No consultants. No stale binders.
What makes this distinct from prior art
Prior art (Eclypsium, firmware scanners): Collect firmware data from the OS layer. Transmit to remote server. Produce vulnerability reports. Output is proprietary, not independently verifiable. No compliance document generation. Episodic scanning, not continuous.
This patent: Detection originates from inside UEFI DXE before the OS loads. Cross-layer evidence channel uses UEFI runtime variable — no network, no OS service. Output is PQC-sealed compliance artifacts verifiable by any party with the public key.
The atomic transaction — hash-chain + dual PQC signature + multi-framework compliance mapping in a single operation — is novel. No prior platform performs these steps atomically.
Autonomous generation of SSP, POA&M, and attestation documents directly from the two-layer sealed evidence stream, without human attestation, is novel.
What Patent #09 covers
- UEFI DXE firmware-resident baseline establishment
- SMM handler monitoring from inside System Management Mode
- UEFI runtime variable as cross-layer evidence channel
- 500ms OS-layer polling of firmware detection events
- Atomic hash-chain + dual PQC signature per event
- Multi-framework compliance mapping in single transaction
- Autonomous SSP generation from sealed evidence
- Autonomous POA&M from real detected gaps
- SPRS score from actual coverage, not self-attestation
- Independent verification endpoint — no provider access needed
Patent Pending. Priority date September 8–9, 2026. © 2026 Darrell Rhodes d/b/a MDRwatchdog.
Common questions
What makes this patent different from Eclypsium and other firmware security platforms?+
Eclypsium and similar platforms collect firmware data from the OS layer and transmit it to a remote server for vulnerability scanning. This patent covers a fundamentally different architecture and output. Detection originates from inside the UEFI DXE phase before the OS loads. Every detection event is sealed atomically into a PQC-signed hash chain simultaneously mapped to multiple compliance frameworks. The output is not a vulnerability report — it is a cryptographically sealed compliance artifact any assessor can independently verify.
What is the two-layer detection architecture?+
The first layer is a UEFI DXE driver that runs inside firmware before the OS loads. It establishes cryptographic baselines of firmware state — memory checksums, ACPI table hashes, UEFI variable contents, CPUID hypervisor state, and SMI timing. The second layer is a Rust OS-layer security agent that reads detection events from the DXE layer via a UEFI runtime variable channel, continuously ingests OS-layer telemetry, and seals every event to a PQC-signed audit chain.
What is a compliance artifact and how is it generated autonomously?+
A compliance artifact is a formal compliance document — a System Security Plan, Plan of Action and Milestones, SPRS scorecard, Proof-of-Control™ certificate, or cyber insurance attestation. This patent covers generating these documents autonomously from accumulated sealed audit evidence, without human attestation, from a continuous telemetry pipeline spanning both the firmware and OS detection layers.
What compliance frameworks does this cover?+
The architecture maps each detection event simultaneously to CMMC Level 2, NIST SP 800-171, SOC 2 Trust Services Criteria, HIPAA Security Rule, ISO/IEC 27001, and NYDFS Part 500 at the time of ingestion. Multi-framework mapping in a single atomic transaction is a specific novel element of this claim.
How is the cross-layer evidence channel novel?+
The UEFI DXE driver writes forensic evidence to a named UEFI runtime variable. The OS-layer Rust agent polls that variable on a 500ms interval via the Windows firmware variable API. On detection, the agent reads the payload, seals it to the PQC audit chain, then clears the variable. This one-way firmware-to-OS evidence channel using a UEFI runtime variable as transport is novel.
What is the priority date for Patent #09?+
The priority date is established by public disclosure on September 8-9, 2026, by the underlying UEFI DXE driver and Rust agent source code in the MDRwatchdog repository, and by the PQC-sealed audit ledger (Block #1, 24,432 records, sealed September 7, 2026).
Related patents and features
Plain-language answers to the questions buyers ask most — readiness and evidence, not certification or legal advice.
The only platform where firmware-layer detection becomes compliance evidence.
MDRwatchdog Patent #09 covers the full pipeline from UEFI DXE baseline to autonomous compliance artifact generation. Book a 15-minute review.
Schedule your 15-minute review