Operating system-independent integrity verification

Patent metadata

Field	Value
Publication number	US-10073966-B2
Application number	US-201313872865-A
Country	US
Kind code	B2
Filing date	Apr 29, 2013
Priority date	Apr 29, 2013
Publication date	Sep 11, 2018
Grant date	Sep 11, 2018

Abstract

An integrity verification subsystem can verify the integrity of software and firmware modules on a computing device at load time and/or at run time, independently of any operating systems that may be installed on the computing device. Some versions of the integrity verification subsystem can operate in physical and/or virtualized system environments, including virtualized mobile device architectures.

First claim

The invention claimed is:

1. An operating system-independent integrity verification subsystem for a computing device, embodied in one or more non-transitory machine-accessible storage media, the integrity verification subsystem configured to verify the integrity of a current version of a software module on the computing device by, in response to a load-time or a run-time event triggering integrity verification of the current version of the software module, in an execution environment that exists independently of any operating systems running on the computing device:
communicating with a block storage subsystem of the computing device, the block storage subsystem embodied in one or more machine accessible storage media, the block storage subsystem having read access to persistent storage, the integrity verification subsystem not having read access to the persistent storage, the block storage subsystem computing, in an execution environment that exists independently of any operating systems running on the computing device, a current hash value for a block of the current version of the software module as the block is loaded from the persistent storage into volatile memory on the computing device, the block comprising a portion of the current version of the software module stored in the persistent storage, the block storage subsystem accessing a trusted hash value, the trusted hash value being computed from a block of a trusted version of the software module that corresponds to the block of the current version of the software module;
obtaining the current hash value and the trusted hash value from the block storage subsystem;
comparing the current hash value to the trusted hash value; and
evaluating the integrity of the current version of the software module based on the comparison of the current hash value to the trusted hash value.

2. The integrity verification subsystem of claim 1 , configured to obtain the current hash value as a result of the block storage subsystem executing a secure hash algorithm on the block of the current version of the software module.

3. The integrity verification subsystem of claim 2 , configured to verify the trusted hash value by verifying a digital signature associated with the trusted hash value.

4. The integrity verification subsystem of claim 3 , configured to obtain a security key from a data storage location that is accessible by the execution environment but not accessible by any operating systems on the computing device, and use the security key to verify the digital signature.

5. The integrity verification subsystem of claim 1 , configured to, in response to determining that the integrity evaluation is successful, execute the current version of the software module.

6. The integrity verification subsystem of claim 1 , configured to, in response to determining that the integrity evaluation is not successful, determine whether to execute the current version of the software module based on a security policy associated with the computing device.

7. The integrity verification subsystem of claim 1 , configured to send data relating to the integrity evaluation to a software module management service.

8. The integrity verification subsystem of claim 7 , configured to initiate execution of the current version of the software module in response to approval of the integrity evaluation by the software module management service.

9. The integrity verification subsystem of claim 1 , wherein the computing device is a virtualized mobile computing device, the execution environment is created by a virtualization service on the mobile computing device, and the integrity verification subsystem is configured to communicate with the virtualization service to determine whether the event triggering integrity verification of the current version of the software module has occurred.

10. A method for verifying the integrity of a current version of a software module on a virtualized mobile computing device independently of any operating systems on the mobile computing device, the method comprising, with an integrity verification subsystem of the mobile computing device:
with a virtualization service running on the mobile computing device, detecting a load-time or run-time event triggering an integrity check of the current version of the software module;
communicating with a block storage subsystem of the computing device, the block storage subsystem embodied in one or more machine accessible storage media, the block storage subsystem having read access to data storage, the integrity verification subsystem not having read access to the data storage;
in response to the load-time or run-time triggering event, obtaining a current integrity value from the block storage subsystem;
comparing the current integrity parameter associated with the current version of the software module to a trusted integrity parameter associated with a trusted version of the software module, the current integrity parameter being derived by the block storage subsystem from a block of the current version of the software module, the block comprising a portion of the current version of the software module stored in the data storage, the trusted integrity parameter being derived by the block storage subsystem from the trusted version of the software module, the data storage comprising the trusted integrity parameter being accessible by the block storage subsystem but not accessible by any operating systems on the mobile computing device or by the integrity verification subsystem; and
evaluating the integrity of the current version of the software module based on the comparison of the current integrity parameter to the trusted integrity parameter.

11. The method of claim 10 , comprising, during a pre-load phase of the operation of the mobile computing device, performing integrity verification on the virtualization service.

12. The method of claim 11 , comprising obtaining the trusted integrity parameter through communication with the integrity-verified virtualization service.

13. The method of claim 12 , comprising obtaining the current integrity parameter through communication with the integrity-verified virtualization service.

14. The method of claim 10 , comprising accessing a security key on the mobile computing device and using the security key to verify the trusted integrity parameter.

15. The method of claim 11 , comprising verifying the trusted integrity parameter by verifying a digital signature associated with the trusted integrity parameter using the security key.

16. The method of claim 10 , wherein the software module is an operating system and the method comprises, in response to determining that the integrity evaluation is successful, loading the current version of the operating system.

17. The method of claim 10 , comprising, in response to the integrity evaluation, communicating with a mobile device management service to determine whether to execute the current version of the software module.

18. A mobile computing device, comprising: a processor; and
non-transitory machine accessible storage media having embodied therein an operating system-independent virtualization service, a block storage subsystem communicatively coupled to the virtualization service, and an integrity verification subsystem communicatively coupled to the virtualization service, the integrity verification subsystem configured to, in an automated fashion, selectively communicate with the block storage subsystem to perform block-based hash verification to verify the integrity of a plurality of different softw

Assignees

• Stanford Res Inst Int

Inventors

• Oberg Scott
• Lockett Christopher S
• Forsberg Sean
• Saidi Hassen
• Casper Jeffrey E

Classifications

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title