Checksum Verification Using Program Counter and Data Pointer Registers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques face challenges in verifying whether a computational entity is running a known process and no other processes, as malware can intentionally provide incorrect responses, making it difficult to determine if a system is free from malware.
Innovation Solution
A checksum process that includes a main loop and payload, using the program counter and data pointer as inputs, and employing a non-linear accumulator to detect modifications and ensure only the legitimate process is executing, while amplifying delays in malicious scenarios through cache management and unpredictable execution flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional verification methods are used to determine whether a process is running, then the verification process can be performed, but malware can intentionally provide incorrect responses to cause false positives
Solution Approach 1:
The verification process utilizes the program counter and data pointer registers that are inherently part of the executing process itself. These registers naturally reflect the actual execution state without requiring external intervention, making it difficult for malware to provide false information about the process state.
Solution Approach 2:
The patent replaces traditional software-based verification methods with hardware-level register inspection. By directly reading the program counter and data pointer values from CPU registers, the system obtains authentic execution state information that cannot be easily spoofed by malware running at the software level.
2Reliability
If a checksum verification process is implemented to detect malware, then malware detection capability is improved, but the verification time increases
Solution Approach 1:
The patent extracts only the critical verification elements (program counter and data pointer values) from the complete process state. By focusing verification on these specific registers that directly indicate execution flow and data access patterns, the system achieves effective malware detection without the computational overhead of verifying the entire process state.
Solution Approach 2:
The verification process performs a focused inspection of key registers rather than a complete analysis of all process components. This partial verification approach provides sufficient malware detection capability while significantly reducing the time required compared to comprehensive process verification.
3Measurement precision
If the verification system checks all process components to ensure accuracy, then verification precision is improved, but the complexity of the verification system increases
Solution Approach 1:
The patent extracts and focuses verification efforts on the program counter and data pointer registers, which are the most critical indicators of process execution state. This selective approach maintains high verification precision by monitoring the key elements that reveal whether the legitimate process is actually executing, while avoiding the complexity of comprehensive process analysis.
Data Source
AI summary
Rapid verification of executing processes includes receiving a seed from a verification unit. A checksum is generated at least in part by using a processor. The processor is coupled to a hierarchical memory, the hierarchical memory comprising an instruction cache, a data cache, and a shared memory accessible by both the instruction cache and the data cache. The shared memory is configured to store an executing program. A size of at least one of the instruction cache and the data cache is insufficient to store the entire executing program. The checksum is transmitted to the verification unit.