Memory integrity monitoring

Patent metadata

Field	Value
Publication number	US-10248814-B2
Application number	US-201715415450-A
Country	US
Kind code	B2
Filing date	Jan 25, 2017
Priority date	Jan 25, 2017
Publication date	Apr 2, 2019
Grant date	Apr 2, 2019

Abstract

In one example in accordance with the present disclosure, a system comprises a first memory module and a first memory integrity monitoring processor, embedded to the first memory module, to receive a second hash corresponding to a second memory module. The second hash includes a second sequence number for reconstruction of a final hash value and the second hash is not sequentially a first number in a sequence for reconstruction of the final hash value. The first processor may receive a third hash corresponding to a third memory module. The third hash includes a third sequence number for reconstruction of the final hash value and the third hash is received after the second hash. The first processor may determine if the second hash can be combined with the third hash, combine the second hash and third hash into a partial hash reconstruct the final hash value using the partial hash.

First claim

The invention claimed is:

1. A system comprising:
a first memory module; and
a first memory integrity monitoring processor embedded to the first memory module, the first memory integrity monitoring processor to:
receive, from a second memory integrity monitoring processor coupled to a second memory module, a second hash corresponding to a second memory region of the second memory module, wherein the second hash includes a second sequence number for reconstruction of a final hash value and the second hash is not sequentially a first number in a sequence for reconstruction of the final hash value;
receive, from a third memory integrity monitoring processor coupled to a third memory integrity monitoring processor, a third hash corresponding to a third memory region of the third memory module, wherein the third hash includes a third sequence number for reconstruction of the final hash value ;
determine, based on the second and third sequence numbers, if the second hash can be combined with the third hash;
combine the second hash and third hash into a partial hash; and
reconstruct the final hash value using the partial hash.

2. The system of claim 1 wherein in the sequence is an order for accurately reconstructing the final hash value.

3. The system of claim 1 wherein the second sequence number denotes a location of the second hash in the sequence.

4. The system of claim 1 wherein the first processor is further to:
determine based on the second and third sequence numbers, if the second partial hash can be combined with any additional partial hashes.

5. The system of claim 1 wherein the processor is further to:
further determine whether the second hash can be combined with the third hash while maintaining the sequence for reconstruction.

6. The system of claim 1 wherein the third sequence number for reconstruction is either immediately sequentially before the second sequence number for reconstruction or immediately sequentially after the second sequence number for reconstruction.

7. The system of claim 1 wherein the second and third memory module store system software data structures that are supposed to be unchanged at runtime.

8. The system of claim 1 wherein the first memory integrity monitoring processor hashes data stored on the first memory module to create a first hash corresponding to a first region of the first memory module and the second hardware processor hashes data stored on the second memory module to create the second hash.

9. A first memory module comprising:
an embedded memory integrity monitoring processor to:
hash a data structure, stored on the first memory module, to create a first hash with a first sequence number for reconstruction of a final hash value, the first hash corresponding to a first memory region of the first memory module;
receive a plurality of hashes from a plurality of respective memory modules, each hash corresponding to a memory region of the respective memory module and each hash having a respective sequence number for reconstruction of the final hash value;
determine, for each hash value received, if the hash value can be combined with the first hash or another previously received hash;
combine at least two hashes into a partial hash, wherein the partial hash does not include the first sequential number of the reconstruction sequence; and
reconstruct the final hash value using the partial hash.

10. The first memory module of claim 9 , wherein a memory region accessed by system software is spread over multiple memory modules including the first memory module and the respective memory modules.

11. The first memory module of claim 9 , wherein the embedded processor performs the determination step as each hash value is received.

12. The first memory module of claim 9 , wherein the order that the hashes are received in does not match the reconstruction sequence ordering number for reconstruction of the value.

13. The first memory module of claim 9 , wherein in the reconstruction sequence is an order for accurately reconstructing the final hash value.

14. The first memory module of claim 9 , the embedded memory integrity monitoring processor further to
compare the final hash value to a digest hash value located at a predefined memory region; and
raise an interrupt if the final hash value does not match the digest hash value.

15. A method comprising:
receiving, from a first hardware processor coupled to a first memory module, a first hash with a first sequence number for reconstruction of a final hash value, wherein the fist hash includes a first sequence number for reconstruction of a final hash value and the first hash is not sequentially a first number in a sequence for reconstruction of the final hash value;
receiving, from a second processor coupled to a second memory module, a second hash with a second sequence number for reconstruction of the final hash value wherein the second hash includes a second sequence number for reconstruction of the final hash value and the second hash is received after the first hash;
determining, based on the first and second sequence numbers, if the first hash can be combined with the second hash;
combining the first hash and second hash into a partial hash; and
reconstructing the final hash value using the partial hash.

16. The method of claim 15 comprising:
determining based on the sequence numbers, if the first partial hash can be combined with any additional partial hashes.

17. The method of claim 15 comprising:
determining whether the first hash can be combined with the second hash while maintaining the sequence for reconstruction.

18. The method of claim 15 , comprising:
comparing the final hash value to a digest hash value located at a predefined memory region; and
raising an interrupt if the final hash value does not match the digest hash value.

19. The method of claim 15 wherein a memory region accessed by system software is spread over multiple memory modules including the first memory module and the second memory modules.

20. The method of claim 15 wherein the first sequence number denotes a location of the first hash in the sequence.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Ndu Geoffrey
• Shaw Adrian
• Monahan Brian Quentin

Classifications

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F21/64 Primary

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title