Memory integrity checking

Patent metadata

Field	Value
Publication number	US-2016232379-A1
Application number	US-201315021022-A
Country	US
Kind code	A1
Filing date	Oct 31, 2013
Priority date	Oct 31, 2013
Publication date	Aug 11, 2016
Grant date	—

Abstract

According to an example, memory integrity checking may include receiving computer program code, and using a loader to load the computer program code in memory. Memory integrity checking may further include verifying the integrity of the computer program code by selectively implementing synchronous verification and/or asynchronous verification. The synchronous verification may be based on loader security features associated with the loading of the computer program code. Further, the asynchronous verification may be based on a media controller associated with the memory containing the computer program code.

First claim

What is claimed is:

1 . A non-transitory computer readable medium having stored thereon machine readable instructions to provide memory integrity checking, the machine readable instructions, when executed, cause at least one processor to:
receive computer program code; use a loader to load the computer program code in memory; and verify the integrity of the computer program code by selectively implementing at least one of synchronous verification and asynchronous verification, wherein the synchronous verification is based on loader security features associated with the loading of the computer program code, and the asynchronous verification is based on a media controller associated with the memory containing the computer program code.

2 . The non-transitory computer readable medium of claim 1 , wherein to implement the synchronous verification, the machine readable instructions, when executed, further cause the at least one processor to:
compute a hash associated with the computer program code; and use the computed hash to update a hash of memory pages that are associated with the computer program code and are loaded in the memory.

3 . The non-transitory computer readable medium of claim 2 , wherein to implement the synchronous verification, the machine readable instructions, when executed, further cause the at least one processor to:
send pairs including the computed hash and associated range for the memory pages to a memory controller; and instruct the memory controller to detect a change in the computed hash related to the associated range for the memory pages.

4 . The non-transitory computer readable medium of claim 1 , wherein to implement the synchronous verification, the machine readable instructions, when executed, further cause the at least one processor to:
determine when an operating system (OS) has replaced a safe memory page associated with the computer program code; and in response to a determination that the OS has replaced the safe memory page associated with the computer program code, instruct the media controller to stop checking a memory page range associated with the replaced safe memory page, and to remove a previous hash associated with the replaced safe memory page.

5 . The non-transitory computer readable medium of claim 1 , wherein to implement the asynchronous verification, the machine readable instructions, when executed, further cause the at least one processor to:
use the media controller associated with the memory to identify an unauthorized signature associated with the computer program code.

6 . The non-transitory computer readable medium of claim 5 , wherein to use the media controller associated with the memory to identify an unauthorized signature associated with the computer program code, the machine readable instructions, when executed, further cause the at least one processor to:
compare a signature associated with the computer program code to an unauthorized signature list.

7 . The non-transitory computer readable medium of claim 5 , wherein to use the media controller associated with the memory to identify an unauthorized signature associated with the computer program code, the machine readable instructions, when executed, further cause the at least one processor to:
account for a plurality of interleaved memory chips and non-contiguous memory pages associated with the computer program code.

8 . The non-transitory computer readable medium of claim 7 , wherein to account for a plurality of interleaved memory chips and non-contiguous memory pages associated with the computer program code, the machine readable instructions, when executed, further cause the at least one processor to:
use associative hashing to compute independent hashes of the non-contiguous memory pages associated with the computer program code.

9 . The non-transitory computer readable medium of claim 1 , wherein to implement the asynchronous verification, the machine readable instructions, when executed, further cause the at least one processor to:
use the asynchronous verification for kernel integrity protection by:
determine a plurality of authorized kernel function pointers;
use the authorized kernel function pointers to generate an authorized list of values that the authorized kernel function pointers point to;
send the authorized list of values to the media controller; and
use the media controller to determine that contents of memory address of pointers for a kernel contain a value matching the authorized list of values.

10 . A memory integrity checking apparatus comprising:
a loader to receive and load computer program code to memory, the loader including security features to implement synchronous verification to evaluate the integrity of the computer program code to be stored in the memory; and a media controller corresponding to a memory controller, the media controller included in the memory to address a memory page, the media controller further implementing asynchronous verification to evaluate the integrity of the computer program code when stored in the memory.

11 . The memory integrity checking apparatus of claim 10 , wherein the media controller includes a plurality of active media controllers that are associated with a plurality of active memory controllers.

12 . The memory integrity checking apparatus of claim 10 , wherein the media controller further implements the asynchronous verification by:
receiving, at the media controller, information related to locations of a range of addresses related to the computer program code to be stored in the memory, from an operating system (OS).

13 . A method for memory integrity checking, the method comprising:
receiving computer program code; using a loader to load the computer program code in memory; and verifying the integrity of the computer program code by selectively implementing at least one of synchronous verification and asynchronous verification, wherein the synchronous verification is based on loader security features associated with the loader, and the asynchronous verification is based on a media controller associated with the memory.

14 . The method of claim 13 , wherein implementing the synchronous verification further comprises:
evaluating a signature associated with the computer program code.

15 . The method of claim 13 , wherein implementing the synchronous verification further comprises:
computing a hash associated with the computer program code; and comparing the hash to an authorized signature list.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Edwards Nigel
• Dalton Chris
• Faraboschi Paolo

Classifications

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F12/1416

  by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights (G06F12/1458 takes precedence) · CPC title

• G06F21/64 Primary

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title