Dynamic Code Verification via Hash Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting and eliminating malicious or faulty code are typically reactive and rely on up-to-date virus definitions, which can be late in identifying threats, and do not guarantee the validity of currently executing code, especially on architectures without hardware support for access control bits.
Innovation Solution
A dynamic verification system that uses a verification engine to compare the identifying value of a memory block containing an instruction with reference values from a white list or black list, allowing or blocking execution based on validation conditions, and can operate on various hardware architectures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional reactive detection methods are used, then virus definitions can be updated to identify known threats, but detection is too late as viruses may infect millions of computers before being identified
Solution Approach 1:
The system performs preliminary verification of code integrity by computing hash values of code pages before execution. This proactive approach ensures that only verified, unmodified code is executed, preventing viral infection from spreading while maintaining timely detection capability.
2Reliability
If hardware access control bits are used for isolation, then execution of code on given memory pages can be prevented, but malicious code in boot loader or operating system components can affect these bits and defeat the security
Solution Approach 1:
The system introduces an intermediary verification layer that computes and checks hash values of code pages. This intermediary mechanism provides security without relying on hardware access control bits, making it architecture-independent and resistant to attacks that target hardware security features.
3Reliability
If cryptographic techniques are used for boot-time verification, then validity of code can be attested before execution, but validity of currently executing code is not guaranteed as code may be compromised after boot
Solution Approach 1:
The system continuously verifies code integrity throughout execution by checking hash values of code pages before each execution. This continuous verification ensures that code remains unmodified throughout its entire execution lifecycle, not just at boot time, maintaining security against runtime compromises.
4Reliability
If virtual machine introspection is used for run-time verification, then code sections can be scanned and hashed to verify integrity, but the system does not ensure that code currently being executed is safe as buffer overflow exploits can jump to new memory regions
Solution Approach 1:
The system implements a universal verification mechanism that works across different hardware architectures without requiring virtualization. By computing hash values of code pages and comparing them against expected values, the system verifies integrity of currently executing code regardless of memory architecture or virtualization status.
Data Source
AI summary
Computer-executable instructions in a computer are verified dynamically, after they have been identified for submission for execution, but before they are actually executed. In particular, for at least one current instruction that has been identified for submission to the processor for execution, an identifying value, for example, a hash value, is determined for a current memory block that contains the current instruction. The identifying value of the current memory block is then compared with a set of reference values. If the identifying value satisfies a validation condition, then execution of the current instruction by the processor is allowed. If the validation condition is not satisfied, then a response is generated: In the common case, execution of the current instruction is not allowed, or some other predetermined measure is taken.