Runtime Checksum Verification for Block Device Images
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for verifying data integrity in block devices are inadequate for accommodating file-based updates, as they rely on deterministic block-by-block changes, which are not applicable in non-deterministic file-based update scenarios, rendering pre-computed checksums obsolete.
Innovation Solution
A method involving a secure execution environment that monitors changes to data blocks, generates hashes for updated blocks, and verifies cryptographic signatures to ensure data integrity, even in the absence of a secure marker, allowing for efficient verification during file-based updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If pre-computed known good checksum values are used for data integrity verification, then verification efficiency is improved, but the method becomes incompatible with non-deterministic file-based updates
Solution Approach 1:
The patent divides the block device into multiple data blocks and computes individual checksums for each block separately. Instead of computing a single checksum for the entire block device, the system maintains a checksum for each individual data block, allowing selective verification and updating of specific blocks without requiring complete re-verification of the entire device.
Solution Approach 2:
The patent implements a hierarchical checksum structure where individual data block checksums are nested within a root checksum. The root checksum is computed based on the checksums of all data blocks, creating a nested verification system. This allows efficient verification by checking the root checksum while maintaining the ability to verify individual blocks when needed.
2Reliability
If deterministic block-by-block update method is used, then data integrity verification feasibility is maintained, but update flexibility and runtime adaptability are reduced
Solution Approach 1:
The patent introduces a dynamic verification system that adapts to different update scenarios. The system can operate in different modes: full verification when needed, selective verification of specific blocks, or incremental verification after updates. This dynamic approach allows the system to maintain reliability while adapting to various update patterns including non-deterministic file-based updates.
Solution Approach 2:
The patent changes the verification parameters from a static pre-computed checksum to a dynamic checksum system that can be regenerated. Instead of relying on fixed pre-computed values, the system computes checksums on-demand based on current block contents, allowing verification to adapt to any update pattern while maintaining reliability.
3Adaptability or versatility
If file-based update method is used, then runtime update flexibility is improved, but data integrity verification becomes infeasible with pre-computed checksums
Solution Approach 1:
The patent performs preliminary checksum computation for each data block before updates occur. By pre-computing and storing individual block checksums along with their metadata (including block identifiers and version information), the system prepares verification data in advance that can be used to verify integrity after file-based updates, maintaining reliability while allowing update flexibility.
Solution Approach 2:
The patent introduces an intermediary checksum structure that mediates between the file system and the block device. This intermediary layer maintains a mapping between files and data blocks, and stores checksums for each block. When file-based updates occur, this intermediary structure allows the system to identify which blocks changed and verify their integrity without requiring verification of the entire block device.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method for verifying data integrity of a block device is provided. The method includes providing a secure world execution environment configured to monitor changes to data blocks of a block device, within the secure world execution environment, generating a hash for changed data blocks of the block device, and within the secure world execution environment, verifying and generating a cryptographic signature.