Kernel Self-Measurement for Integrity Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Runtime integrity software in computing devices is exposed to risks as it executes in the same space as the components it monitors, making it vulnerable to malicious programs.
Innovation Solution
A method where a kernel measures its own specified kernel space at initialization or boot, writes the baseline measurement to a register, and uses this to continuously monitor for integrity by comparing subsequent measurements, involving a split kernel OS or driver to identify and measure the kernel space, and utilizing a Trusted Platform Module (TPM) to store and verify these measurements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If runtime integrity software executes in the same space as the components it monitors, then it can directly access and monitor system components, but it becomes vulnerable to malicious programs
Solution Approach 1:
The system divides the monitoring function into two separate execution environments: a trusted execution environment (TEE) for the integrity monitoring software and a normal execution environment for the monitored components. This segmentation isolates the monitoring software from potential malicious programs, allowing it to maintain reliable monitoring capabilities while being protected from attacks.
Solution Approach 2:
The patent introduces a trusted execution environment as an intermediary layer between the integrity monitoring software and the system components. This TEE acts as a secure mediator that allows the monitoring software to access and verify component integrity without being directly exposed to malicious programs in the normal execution environment.
2Reliability
If the kernel measures its own kernel space at initialization, then it establishes a baseline for integrity verification, but it requires additional measurement and verification mechanisms
Solution Approach 1:
The patent combines the integrity measurement function with the existing kernel initialization process. The kernel measures its own kernel space during initialization, merging the measurement functionality into the boot sequence rather than adding a separate measurement system. This reduces overall system complexity while establishing the integrity baseline.
Solution Approach 2:
The kernel performs self-measurement of its own kernel space at initialization. The kernel contains built-in functionality to measure itself and store the measurement in a protected location (such as a TPM or secure storage). This self-service approach eliminates the need for external measurement mechanisms, reducing system complexity.
Data Source
AI summary
A method comprising: generating, with a device, a nonce; writing, with the device, the nonce to a memory location accessible to a kernel; initializing the kernel; in response to an end of initialization, measuring a specified kernel space to produce a first result; writing the first result to a register of a second device; writing a location and size of the specified kernel space to a buffer; measuring the buffer; writing a result of buffer measurement to a second register of the second device; requesting a quote from the second device, the quote to include the nonce, the contents of the register, and the contents of the second register; and passing the quote to the device.