Computer code integrity check

Abstract

An apparatus having a firmware memory storing firmware, a cache memory loading at least a portion of the firmware for execution by a processor, and a firmware check engine having defined syndrome storage locations and iterating over cache line entries associated with firmware stored in the cache memory to: select a cache line entry; verify that an address mapped in the cache line entry maps to an address in the firmware memory, and when the cache line entry is locked and the address mapped in the cache line entry maps to an address in the firmware memory, compare the contents of the cache line entry to the contents of a corresponding address in the firmware stored in the firmware memory, and generate an integrity result indicating whether the integrity of the apparatus has been compromised. The abstract is not meant to be limiting.

Description

Technical Field

[0001] The present invention relates generally to checking the integrity of computer code and, particularly but not exclusively, to checking the integrity of computer firmware code. Background Art

[0002] BACKGROUND OF THE INVENTION Systems for checking the integrity of computer code, in particular systems for checking the integrity of computer system software at the time of system initialization, are known. Summary of the invention

[0003] In certain embodiments, the present invention seeks to provide an improved system and method for checking the integrity of computer code generally, and particularly, but not exclusively, for checking the integrity of computer firmware code.

[0004] Therefore, according to an exemplary embodiment of the present invention, there is provided an apparatus comprising: a firmware memory configured to store firmware; a cache memory configured to load at least a portion of the firmware from the firmware memory for execution by a processor; and a firmware check engine configured to access the cache memory and the firmware memory, the firmware check engine having a defined syndrome storage location storing a known initial value, the firmware check engine further configured to iteratively perform the following operations on a plurality of cache line entries associated with the at least a portion of the firmware stored in the cache memory: A) selecting a cache line entry from the plurality of cache line entries; B) verifying whether an address mapped in the cache line entry maps to an address in the firmware memory and generating a firmware mapping result; and C) when the cache line entry is locked and the firmware mapping result indicates that the address mapped in the cache line entry maps to an address in the firmware memory, comparing the contents of the cache line entry with the contents of a corresponding address in the firmware stored in the firmware memory and generating an integrity result indicating whether the integrity of the apparatus is compromised.

[0005] Furthermore, according to an exemplary embodiment of the present invention, when the content of the cache line entry does not match the content of the corresponding address of the firmware stored in the firmware memory, the integrity result indicates that the integrity of the device has been compromised.

[0006] Still further according to an exemplary embodiment of the present invention, the firmware check engine is further configured to: D) calculate a syndrome value using the integrity result and store the syndrome value in the defined syndrome storage location in the internal storage device in the firmware check engine when at least one of the following is true: the integrity result indicates that the content of the cache line does not match the corresponding address in the firmware stored in the firmware memory; a "dirty" cache indication is set in the cache line entry; and the first result indicates that the firmware address in the cache line entry is not mapped to an address in the firmware memory.

[0007] Additionally, in accordance with an exemplary embodiment of the present invention, the firmware inspection engine is configured to operate during execution of instructions by the processor.

[0008] Furthermore, according to an exemplary embodiment of the present invention, the firmware memory includes a runtime read-only firmware memory.

[0009] Furthermore, in accordance with an exemplary embodiment of the present invention, the defined syndrome storage location comprises a secure location, the contents of which are not modifiable by software running in the processor.

[0010] Still further in accordance with an exemplary embodiment of the present invention, the operation iteratively performed on the plurality of cache line entries is performed on all cache line entries associated with the at least a portion of the firmware stored in the cache memory.

[0011] Additionally, according to an exemplary embodiment of the present invention, operations iteratively performed on a plurality of cache line entries are performed in a random or pseudo-random order.

[0012] Furthermore, according to an exemplary embodiment of the present invention, the syndrome value includes a CRC value.

[0013] Further in accordance with an exemplary embodiment of the present invention, the syndrome value comprises a hash value.

[0014] Still according to an exemplary embodiment of the present invention, the known initial value is zero.

[0015] Additionally, according to an exemplary embodiment of the present invention, the device further comprises a communication interface operably associated with the firmware inspection engine, the communication interface being configured to send a message to a destination external to the device, the message indicating whether the device is in a compromised state.

[0016] Furthermore, according to an exemplary embodiment of the present invention, the communication interface is configured to send the message to a destination external to the device only upon receiving an indication from the firmware checking engine that the syndrome value is different from the known initial value.

[0017] Furthermore, according to an exemplary embodiment of the present invention, the destination external to the apparatus includes a preconfigured destination.

[0018] Further in accordance with an exemplary embodiment of the present invention, the destination includes one or more of: a host computer; a baseboard management controller; and an external root of trust.

[0019] Still according to an exemplary embodiment of the present invention, the communication interface includes a PCIe interface.

[0020] Additionally, according to an exemplary embodiment of the present invention, the communication interface includes a network communication interface.

[0021] Furthermore, according to an exemplary embodiment of the present invention, the message includes an encrypted message.

[0022] Furthermore, according to an exemplary embodiment of the present invention, the encrypted message is encrypted using one of: symmetric encryption; and asymmetric encryption.

[0023] Still in accordance with an exemplary embodiment of the present invention, the message comprises a signed message.

[0024] Additionally, according to an exemplary embodiment of the present invention, the cache memory is external to the device.

[0025] Furthermore, according to an exemplary embodiment of the present invention, the apparatus includes the cache memory.

[0026] According to another exemplary embodiment of the present invention, a method is also provided, the method comprising: providing a firmware memory configured to store firmware; providing a cache memory configured to load at least a portion of the firmware from the firmware memory for execution by a processor; and providing a firmware check engine configured to access the cache memory and the firmware memory, the firmware check engine having a defined syndrome storage location storing a known initial value; and the firmware check engine iteratively performs the following operations on a plurality of cache line entries associated with the at least a portion of the firmware stored in the cache memory: A) selecting a cache line entry from the plurality of cache line entries; B) verifying whether an address mapped in the cache line entry is mapped to an address in the firmware memory, and generating a firmware mapping result; and C) when the cache line entry is locked and the firmware mapping result indicates that the address mapped in the cache line entry is mapped to an address in the firmware memory, comparing the content of the cache line entry with the content of a corresponding address in the firmware stored in the firmware memory, and generating an integrity result indicating whether the integrity of the device is compromised. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The present invention will be more fully understood and appreciated from the following detailed description in conjunction with the accompanying drawings, in which:

[0028] Figure 1 is a simplified block diagram of a system for checking the integrity of computer code, constructed and operative in accordance with an exemplary embodiment of the present invention;

[0029] Figure 2 yes Figure 1 A simplified block diagram illustration of an exemplary embodiment of a portion of a system of; and

[0030] Figure 3 yes Figure 1 A simplified flow chart of an exemplary method of operation of a portion of a system. DETAILED DESCRIPTION

[0031] The following summary provides a general, non-limiting introduction to certain exemplary embodiments of the invention.

[0032] The inventors of the present invention believe that known systems for checking the integrity of computer system code are generally used to check the integrity of computer system code at the time of system startup, and such systems cannot effectively detect the possibility that computer system code that passes the integrity check at the time of system startup is later damaged. Generally speaking, important computer system code that should not be subject to unauthorized changes is stored in a flash firmware storage memory and is read into a cache memory at the time of system startup (initialization). Methods for checking the integrity of code in a flash firmware storage memory at the time of system startup are known (the details of which are not part of the scope of the exemplary embodiments of the present invention). For example, a secret key can be used to sign the firmware (or its hash) using an asymmetric cryptographic signature algorithm; at the time of system startup, a public key can be used to check the signature to ensure the integrity of the firmware.

[0033] As a non-limiting example, post-system boot firmware corruption may occur if software running on the computer system successfully alters cache contents in an unauthorized manner. In certain exemplary embodiments of the present invention, as described below, a system and method are provided for detecting such corruption and preventing attempts to operate a computer system whose system code has been corrupted.

[0034] Now to Figure 1 Reference is made to what is a simplified block diagram of a system for checking the integrity of computer code, constructed and operative in accordance with an exemplary embodiment of the present invention.

[0035] In certain exemplary embodiments, Figure 1The system includes a system on a chip (SOC) 100, which may include or may be included in, for example, a network switch, a networking interface controller (NIC), or another suitable system. Figure 1 A number of other components in the system are shown as being included in SOC 100; alternatively, at least some of those components need not be included in SOC 100. The example of SOC 100 is a non-limiting example; although in some exemplary embodiments, a system on a chip such as SOC 100 may be used, it should be understood that SOC 100 need not be used to implement Figure 1 system.

[0036] As specific non-limiting examples, SOC 100 may include: an application-specific integrated circuit (ASIC); a field-programmable gate array (FPGA); or an appropriate plurality of digital and / or analog elements associated with operations, such as one or more processors, memories, one or more network interfaces, one or more elements implementing security features, one or more control modules, and the like.

[0037] Figure 1 The SOC 100 includes a processor (also referred to herein as an "embedded CPU") 110 that is operable to execute instructions (also referred to herein as "code") stored in a cache memory 120. The processor 110 is also operable to execute instructions stored in one or more other memories (not shown).

[0038] Typically, at the start-up time of the SOC 100, the cache memory 120 is loaded from the firmware storage device (also referred to herein as "flash memory" or "firmware memory") 130 via the flash controller 140. Typically, the firmware memory is read-only (or at least read-only at runtime, also referred to herein as "runtime read-only"). The firmware memory 130 may be configured as follows: Figure 1 , or may alternatively be inside the SOC 100. As described above, at boot time, a method (the details of which are not part of the scope of the exemplary embodiments of the present invention) may be used to check the integrity of the code stored in the firmware memory 130 at the time of system boot. For example, the firmware (or its hash) stored in the firmware memory 130 may be signed using an asymmetric cryptographic signature algorithm using a secret key; at system boot time, the signature may be checked using a public key to ensure the integrity of the firmware.

[0039] Figure 1 The SOC 100 also includes a firmware inspection engine (also referred to herein as a "crawler") 150, which is described in more detail below. Figure 1The SOC 100 may also include:

[0040] 1) A security notification message generator 160 in communication with the firmware inspection engine 150 and a host interface 170 (which may include any suitable host interface, such as, by way of non-limiting example, a PCIe interface). As described in more detail below, the security notification message generator 160 is operable to generate a message and send the generated message to a host (not shown) via the host interface 170. Figure 1 Similarly, the security notification message generator 160 is operable to send or also send the generated message to an external baseboard management controller (BMC) (not shown) and / or an external root of trust (roots of trust are well known in the field of hardware security; the external root of trust can, for example, take action to indicate that the SOC 100 has been compromised) via a sideband interface (not shown); and

[0041] 2) A security notification packet generator 180 in communication with the firmware inspection engine 150 and a network interface 190 (which may include any suitable network interface, such as, by way of non-limiting example, any suitable Internet network interface). As described in more detail below, the security notification packet generator 180 is operable to generate one or more packets and send the generated (one or more) packets to a network (not shown) via the network interface 190. Figure 1 ) for delivery to a network location.

[0042] In an exemplary embodiment, the security notification message generator 160 and / or the security notification packet generator 180 are one-time configurable after a device reset. Once configured by the secure boot code that starts running after a device-level reset, the security notification message generator 160 and / or the security notification packet generator 180 cannot be disabled and reconfigured until the next device-level reset, thus ensuring that once a security risk is identified, a corresponding message will be generated and the settings cannot be tampered with.

[0043] Now briefly describe Figure 1 Operation of the device. Figure 1 The description of the operation of the device is exemplary and not meant to be limiting.

[0044] As described above, at the start-up time of the SOC 100, the firmware is loaded from the firmware storage device 130 to the cache memory 120; at this time, the integrity of the loaded firmware is checked using the conventional method described above.

[0045] When the embedded processor 110 is operating, the firmware check engine 150 is operable to check the cache memory 120 to determine whether the integrity of the firmware stored in the cache memory 120 is still intact, or conversely, whether the firmware stored in the cache memory 120 has been tampered with or otherwise corrupted (become lacking integrity). Details of an exemplary method used by the firmware check engine 150 are described in more detail below.

[0046] Typically, but not necessarily, firmware checking engine 150 will check all locations in cache memory 120 in order to eliminate the possibility of even minor changes to the firmware stored in cache memory 120 after the firmware has been loaded from firmware storage 130. In addition, it may be desirable for firmware checking engine 150 to check locations in cache memory 120 in a random or pseudo-random order in order to overcome "clever" changes to the firmware stored in cache memory 120 that are designed to prevent linear checking.

[0047] If the firmware inspection engine 150 determines that the firmware stored in the cache memory 120 lacks integrity, the firmware inspection engine 150 may instruct one or both of the security notification message generator 160 and the security notification packet generator 180, respectively, to generate a message or packet indicating that the SOC 100 cannot be relied upon due to the lack of integrity of the firmware stored in the cache memory 120. The security notification message generator 160 may then send the generated message to a host computer (not shown) via the host interface 170, which may then take any appropriate action based on the SOC 100 cannot be relied upon. Similarly, the security notification packet generator 180 may then send the generated packet (or multiple generated packets) to an appropriate one or more network destinations (not shown) via the network interface 190, which may then take any appropriate action based on the SOC 100 cannot be relied upon.

[0048] Non-limiting examples of appropriate actions immediately above include: the host computer disabling a connection between the SOC 100 and the host computer (such as, for example, a PCIe connection); the host computer resetting the SOC 100; the host computer powering off the SOC 100; and the network destination indicating that the SOC 100 and / or its host computer is no longer relied upon and that the legitimacy of messages sent therefrom is therefore questionable.

[0049] It should be understood that in certain exemplary embodiments of the present invention, in addition to sending messages indicating a lack of integrity of the firmware, the security notification message generator 160 and / or the security notification packet generator 180 may be operable to send other messages to ensure that the communications of the security notification message generator 160 and / or the security notification packet generator 180 and its corresponding destination are operable and not tampered with by an attacker. These messages may then be used by the host, BMC, and / or remote network destination to track the functional connectivity between the SOC 100 and the corresponding destination.

[0050] Now in addition Figure 2 For reference, Figure 2 yes Figure 1 A simplified block diagram of an exemplary embodiment of a portion of a system. Specifically, Figure 2 In the exemplary embodiment, the Figure 1 The cache memory 120 and the firmware inspection engine 150 are depicted Figure 1 Other components of the system. Figure 2 Depicted in Figure 1 The components in Figure 2 The same reference numerals are given in the figures.

[0051] Unless otherwise described herein, in an exemplary embodiment, the firmware inspection engine 150 and its elements may be implemented, for example, in “on-chip” programmable logic, “hardwired” logic, one-time programmable logic, FPGA, etc., with non-volatile storage (not shown) in the SOC 100.

[0052] As is known in the art, cache memory 120 includes a plurality of cache lines 210. Each of the plurality of cache lines 210 includes:

[0053] 1. Dirty indication 220. Dirty indication 220 indicates whether a particular cache line has been changed, such as by a write to it by CPU 110, since its source (in Figure 1 and Figure 2 In the case of a system where the source is firmware memory 130) reads the line.

[0054] 2. Lock indication 225. The lock indication indicates whether a particular cache line is "locked" and its contents cannot be replaced.

[0055] 3. Mapping address 230, which indicates the address to which a particular cache line is mapped. Figure 1 and Figure 2In a system, the address is typically (but not necessarily) an address in firmware storage device 130, because cache 120 is generally intended to store data from addresses in firmware storage device 130, and it is understood that cache 120 can also store data from other locations.

[0056] 4. Data field 240, which includes data corresponding to mapping address 230. Mapping address 230 may be an address in flash memory 130. In general, data field 240 may include data originating from a write operation of CPU 110. Figure 1 and Figure 2 In the case of the exemplary embodiment, when the mapping address 230 maps to firmware stored in the flash memory 130, the data field 240 should only include content from the firmware storage device.

[0057] Figure 2 The firmware inspection engine 150 may include control logic 250. In an exemplary embodiment, the control logic 250 includes programmable logic circuits (although alternatively, the control logic 250 may include "hardwired" logic). The control logic 250 is in operative communication with the CPU 110 via an internal bus 255 and is configured to control the operation of the firmware inspection engine 150. In an exemplary embodiment of the present invention, the control logic 250 is configured by the processor 110 via the internal bus 255 as part of system startup.

[0058] Control logic 250 and Figure 1 The safety notification packet generator 180 and the safety notification message generator 160 are in operable communication.

[0059] The firmware inspection engine 150 may also include:

[0060] The syndrome calculator 260, which in an exemplary embodiment may be implemented, for example, in "on-chip" programmable logic, "hardwired" logic, one-time programmable logic, FPGA, etc., with non-volatile storage (not shown) in the SOC 100. For each cache line in the plurality of cache lines 210 that are checked as described below, the syndrome calculator 260 may calculate a syndrome update as a syndrome value; the syndrome is designed so that the syndrome value is zero when no problem is found in any of the plurality of cache lines 210. The syndrome update calculation is described in more detail below. In an exemplary embodiment, the syndrome value is stored in a firmware attestation measurement storage 320, which typically includes a memory such as a suitable register (described below and also referred to herein as a "defined syndrome storage location"). Generally speaking, the attestation measurement storage 320 is not accessible to software running on the CPU 110 that is external to the firmware inspection engine 150.

[0061] Address mapping checker 270. The address mapping checker includes a memory interface that receives a mapping address 230 of a given cache line 210 of the cache 120 and passes the mapping address 230 to the control logic 250. If the control logic 250 determines through checking the mapping address 230 that the mapping address 230 maps to a firmware address (also referred to herein as a "firmware mapping") and the dirty indication 220 of the cache line is not "dirty", then the given cache line 210 "passes the address mapping test"; otherwise, the given cache line 210 "fails the address mapping test", which is an indication of lack of integrity.

[0062] In an exemplary embodiment, the update of the syndrome calculation may be based (for a given cache line 210) on a comparison between the data stored in the cache line 210 and the corresponding data in the corresponding location in the flash memory 130 (typically occurring in the return data comparator 290, as described below). If a given cache line 210 does not produce a "firmware mapped" result, the data is not checked and is not included in the update of the syndrome calculation. Any non-zero result of the syndrome update value calculation indicates an integrity problem, and therefore, in an exemplary embodiment, the non-zero result is used to update the syndrome value stored in the firmware attestation measurement result storage 320 (described below). For example, for any given cache line 210, the actual calculation of the syndrome update may be based on any suitable hash function or any suitable CRC function.

[0063] A cache memory scanner 280 that selects lines of cache lines 210 for inspection ("scanning"). Cache lines 210 may be selected in a random or pseudo-random order in order to overcome "clever" changes to the firmware stored in cache memory 120 that are designed to prevent linear inspection of cache lines. However, it should be understood that cache lines 210 may alternatively be inspected linearly (such as, for example, sequentially in a forward direction; sequentially in a backward direction; etc.); or non-linearly but not randomly or pseudo-randomly. It will be appreciated that, in an exemplary embodiment of the present invention, each selected row of the plurality of cache lines 210 is processed as an atomic operation (within a single clock cycle) such that the data stored in the selected cache line, the mapping address of the selected cache line, and the dirty indication of the selected cache line are all sampled simultaneously, thereby ensuring the correct interpretation of the cache contents in a particular cache line 210; this allows the firmware check engine 150 to process the cache line contents of the selected cache line at a lower speed after reading (sampling) the selected row.

[0064] Return data comparator 290. For each cache line in cache line 210 selected by cache memory scanner 280:

[0065] - The data field of the selected row 210 is read into the return data comparator 290; if required (when the selected row 210 maps to the firmware storage 130), the data of the corresponding entry in the firmware storage (flash memory) 130 is read into the return data comparator 290 via the flash controller 140; when data comparison is required, the two data values ​​are compared; and the result of the comparison is sent to the control logic 250. If the two data values ​​are not equal, this is an indication of lack of integrity.

[0066] A dirty indication of the selected cache line 210 is returned to the control logic 250; if the dirty indication indicates that the selected line 210 was "dirty" when it produced a "firmware mapped" result, this is an indication of lack of integrity, which is noted and handled in the control logic 250.

[0067] A flash access initiator 300 operates to access the flash memory 130. The flash access initiator 300 is controlled by the control logic 250. When comparing the contents in the firmware storage device (flash memory) 130 with the cache line data 240, the flash access initiator 300 initiates a read request to the flash controller 140 to read the corresponding firmware data corresponding to the mapping address 230 in the cache line 210.

[0068] Attestation key storage 310. The attestation key storage stores a key, which may be a private key for any suitable asymmetric encryption or signature algorithm (as known in the art) or may be a key for any suitable symmetric encryption or attestation algorithm (as known in the art). The results of the firmware checking process stored in the firmware attestation measurement result storage 320 may be encrypted and / or signed prior to being sent as part of a message via the message generator 160 or as part of a packet via the packet generator 180 or supplied to the CPU 110 via the internal bus 255 to assure the recipient of the message / packet that the contents of the message / packet are authentic.

[0069] Now to Figure 3 For reference, Figure 3 yes Figure 1 A simplified flow chart of an exemplary method of operation of a portion of the system, Figure 3 The method of is largely self-explanatory in view of the foregoing, which is performed by firmware inspection engine 150 in an exemplary embodiment. Figure 3 The method comprises the following steps:

[0070] In the firmware inspection engine, the operations indicated in the following steps are iteratively performed on multiple cache line entries associated with at least a portion of the firmware stored in the cache memory (step 350). As described above, these steps are usually, but not necessarily, performed on all cache line entries.

[0071] A) Selecting a cache line entry from a plurality of cache line entries (step 355, performed in the exemplary embodiment by cache memory scanner 280). As described above, the selection may be made in a random or pseudo-random order; the selection may be made linearly; or the selection may be made in a non-linear but not random or pseudo-random order.

[0072] B) checking whether the address mapped in the cache line entry points to a firmware address (in an exemplary embodiment, the address in the cache line entry is checked by address mapping checker 270); generating a result (also referred to herein as a "firmware mapping result"). If the first result indicates that the address mapped into the cache line entry does not point to a firmware address, then the particular cache line entry is not of interest.

[0073] C) A check is performed as to whether a "dirty" cache indication is set in the cache line entry (in the exemplary embodiment, by control logic 250).

[0074] D) If the cache line entry produces a "firmware mapped" result and is locked, the contents of the cache line entry are compared with the contents of the corresponding address in the firmware stored in the firmware memory, and a result (also referred to herein as the "second result") is produced. It will be appreciated that a given cache line entry that maps to the firmware memory will generally be locked when it reflects the contents from the firmware, which should remain in the cache memory. If the cache line entry is not locked, then that particular cache line entry is not of interest for this step.

[0075] E) If at least one of the following is true, then a syndrome value is calculated as described above and stored in a defined location, such as, for example, in internal storage of the firmware checking engine (such as, in a specific example, in firmware attestation measurement storage 320 as described above):

[0076] - the contents of the cache line do not match the contents of the corresponding address in the firmware stored in the firmware memory; thus, the indication of compromise is an indication that the integrity of the firmware and thus the integrity of the SOC has been compromised;

[0077] - a "dirty" indication is set in the cache line entry, which produces a "firmware map"; and

[0078] - The first result indicates that the firmware address in the cache line entry does not map to a firmware address in the firmware memory.

[0079] Step C and step E may be optional.

[0080] It will be appreciated that, if desired, the software components of the present invention may be implemented in ROM (read only memory) form. If desired, the software components may generally be implemented in hardware using conventional techniques. It will also be appreciated that the software components may be instantiated, for example, as a computer program product or on a tangible medium. In some cases, it is possible to instantiate the software components as signals that may be interpreted by an appropriate computer, although such instances may be excluded in certain embodiments of the present invention.

[0081] It will be appreciated that, for clarity, various features of the invention described in the context of separate embodiments may also be provided in combination in a single embodiment. Conversely, for brevity, various features of the invention described in the context of a single embodiment may also be provided separately or in any suitable sub-combination.

[0082] It will be appreciated by those skilled in the art that the present invention is not limited to what has been particularly shown and described hereinabove. Rather, the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A device comprising: a firmware memory configured to store firmware; a cache memory configured to load at least a portion of the firmware from the firmware memory for execution by a processor; as well as a firmware check engine configured to access the cache memory and the firmware memory, the firmware check engine having a defined syndrome storage location storing a known initial value, the firmware check engine further configured to iteratively perform the following operations on a plurality of cache line entries associated with the at least a portion of the firmware stored in the cache memory: A) selecting a cache line entry from the plurality of cache line entries; B) verifying whether the address mapped in the cache line entry is mapped to an address in the firmware memory, and generating a firmware mapping result; as well as C) when the cache line entry is locked and the firmware mapping result indicates that the address mapped in the cache line entry maps to an address in the firmware memory, compare the contents of the cache line entry with the contents of a corresponding address in the firmware stored in the firmware memory and generate an integrity result indicating whether the integrity of the device has been compromised.

2. The device of claim 1, wherein the integrity result indicates that the integrity of the device has been compromised when the content of the cache line entry does not match the content of the corresponding address of the firmware stored in the firmware memory.

3. The apparatus of claim 1, wherein the firmware inspection engine is further configured to: D) calculating a syndrome value using the integrity result and storing the syndrome value in the defined syndrome storage location in internal storage in the firmware checking engine when at least one of the following is true: The integrity result indicates that the contents of the cache line do not match the corresponding address in the firmware stored in the firmware memory; a "dirty" cache indication is set in the cache line entry; and a first result indicates that the firmware address in the cache line entry does not map to an address in the firmware memory. 4 . The apparatus of claim 1 , wherein the firmware inspection engine is configured to operate during execution of instructions by the processor.

5. The apparatus of claim 1, wherein the operations iteratively performed on the plurality of cache line entries are performed in a random or pseudo-random order.

6. The apparatus of claim 3, further comprising a communication interface operably associated with the firmware inspection engine, the communication interface configured to send a message to a destination external to the apparatus, the message indicating whether the apparatus is in a compromised state.

7. The apparatus of claim 6, wherein the communication interface is configured to send the message to a destination external to the apparatus only upon receiving an indication from the firmware checking engine that the syndrome value is different from the known initial value.

8. The apparatus of claim 7, wherein the destination external to the apparatus comprises a preconfigured destination.

9. The apparatus of claim 7, wherein the destination external to the apparatus comprises one or more of: a host computer; a baseboard management controller; and an external root of trust.

10. The apparatus of claim 6, wherein the message comprises an encrypted message.

11. The apparatus of claim 10, wherein the encrypted message is encrypted using one of: symmetric encryption; and asymmetric encryption.

12. The apparatus of claim 7, wherein the message comprises a signed message.

13. The device of claim 1, wherein the cache memory is external to the device.

14. The apparatus of claim 1, wherein the apparatus comprises the cache memory.

15. A method comprising: providing a firmware memory configured to store firmware; providing a cache memory configured to load at least a portion of the firmware from the firmware memory for execution by a processor; as well as providing a firmware check engine configured to access the cache memory and the firmware memory, the firmware check engine having a defined syndrome storage location storing a known initial value; as well as The firmware inspection engine iteratively performs the following operations on a plurality of cache line entries associated with the at least a portion of the firmware stored in the cache memory: A) selecting a cache line entry from the plurality of cache line entries; B) verifying whether the address mapped in the cache line entry is mapped to an address in the firmware memory, and generating a firmware mapping result; as well as C) when the cache line entry is locked and the firmware mapping result indicates that the address mapped in the cache line entry maps to an address in the firmware memory, compare the contents of the cache line entry with the contents of a corresponding address in the firmware stored in the firmware memory, and generate an integrity result indicating whether the integrity of at least a portion of the firmware loaded in the cache memory is compromised.

Images