Application Self-Integrity Checks for Run-Time Memory Tampering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing code-signing and code signature verification techniques in computing devices are inadequate for detecting changes to program code or data in memory after execution, particularly in non-error-checked RAM environments, which are common in information handling systems (IHSs) that operate for extended periods.

Innovation Solution

A framework that allows applications to perform self-integrity checks in memory, detecting run-time malicious tampering or corruption without OS assistance, and can be used alongside traditional code-signing methods, ensuring OS-agnostic operation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional code-signing and signature verification techniques are used, then initial code integrity can be verified, but run-time memory corruption or tampering cannot be detected

Engineering Contradiction:

Improvecode integrity verificationVSAvoidundetected memory corruption

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by embedding integrity checking mechanisms (hash functions, checksums) directly into the application code during compilation. These mechanisms are pre-prepared and automatically executed during runtime to detect memory corruption before it causes system failure, rather than waiting for post-mortem analysis.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements continuous integrity verification through runtime checks that continuously monitor memory regions for corruption. Unlike traditional code-signing that only verifies at load time, this approach maintains continuous surveillance of critical data structures and code segments throughout the application's execution lifecycle.

Inventive Principle:

Principle #20Continuity of useful action

2Reliability

If error-checked RAM (ECC) is used to detect memory corruption, then memory reliability improves, but system cost and complexity increase

Engineering Contradiction:

Improvememory corruption detectionVSAvoidhardware requirements

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent replaces the mechanical/hardware-based ECC memory system with a software-based integrity verification mechanism. Instead of using specialized hardware circuits to detect and correct memory errors, the system uses software-implemented hash functions and checksums that run on standard non-ECC RAM, achieving similar reliability without the hardware complexity.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The application performs self-integrity verification without requiring external hardware assistance. The embedded checking mechanisms allow the application to autonomously detect and report memory corruption, eliminating the need for costly ECC memory hardware while maintaining detection capabilities.

Inventive Principle:

Principle #25Self-service

3Reliability

If runtime integrity checks are implemented, then detection of malicious tampering improves, but processing overhead increases

Engineering Contradiction:

Improvetampering detectionVSAvoidexecution speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent applies local quality by selectively instrumenting only critical code segments and data structures with integrity checking mechanisms, rather than checking every byte of memory. This targeted approach focuses verification resources on high-value targets such as authentication routines, cryptographic operations, and critical data structures, minimizing overhead while maintaining security.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The implementation uses partial action by performing integrity checks at strategically selected points in the execution flow rather than continuously monitoring all operations. This allows the system to achieve adequate detection coverage with reduced processing overhead, balancing security requirements with performance constraints.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12505256B2Method and system for detecting a change in memory

Publication Date: 2025.12.23 DELL PROD LP

AI summary

A method for managing an application includes: analyzing an unsigned executable file to at least infer relocation information for calculating a proper location for a symbol and generate an integrity signature for non-changing parts of the unsigned executable file; signing the unsigned executable file to obtain a signed executable file, in which the unsigned executable file is signed by adding the integrity signature into a read-only data block; and presenting the signed executable file to an administrator as the application in order to initiate deployment of the application to a database that provides computer-implemented services to a user, in which, before the user is allowed to use the application, the application checks an integrity of the application by invoking the integrity signature and without requiring an assistance from an operating system, in which the application checks the integrity at least when the application being executed in memory.