Runtime Integrity Checker With Masked Memory Region Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing runtime integrity check systems require the host processor to define memory locations for testing, which can be inefficient and may not allow selective testing of specific areas or bits within memory locations, leading to increased bandwidth usage and potential data corruption due to untrusted user applications or internal programming bugs.
Innovation Solution
A runtime integrity checker with a mask unit that selectively defines which storage locations and bits to test by using a mask to identify static and dynamic data, allowing for parallel operation with existing hardware processes and reducing bandwidth requirements by skipping unimplemented regions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the host processor defines all memory locations for testing, then comprehensive integrity checking is achieved, but bandwidth usage increases and processing efficiency decreases
Solution Approach 1:
The memory space is segmented into implemented and unimplemented regions. The integrity checker is configured to monitor only the implemented regions where actual data resides, while skipping unimplemented regions. This segmentation allows comprehensive checking of relevant areas without wasting bandwidth on nonexistent memory locations.
Solution Approach 2:
Different monitoring strategies are applied to different memory regions based on their characteristics. Implemented regions receive integrity checking while unimplemented regions are skipped. This local differentiation optimizes bandwidth usage by applying monitoring only where necessary rather than uniformly across all address space.
2Reliability
If all memory locations are tested, then complete security assurance is provided, but processing speed decreases due to extensive monitoring
Solution Approach 1:
The monitoring process is segmented to operate on only the implemented memory regions rather than the entire address space. This reduces the total number of locations requiring monitoring, thereby improving processing speed while maintaining security assurance for all actual data storage locations.
Solution Approach 2:
Instead of monitoring the complete address space (excessive action), the system monitors only the implemented regions where data actually exists (partial action). This partial monitoring is sufficient to provide complete security assurance for all stored data while significantly reducing processing overhead.
3Measurement precision
If the integrity checker monitors all address ranges, then no data corruption is missed, but bandwidth requirements increase
Solution Approach 1:
The address range is segmented into implemented and unimplemented portions. The integrity checker processes only the implemented segments containing actual data, ensuring complete corruption detection for all stored information while avoiding unnecessary bandwidth consumption on unimplemented regions that contain no data.
Solution Approach 2:
The monitoring intensity is adjusted locally based on region characteristics. Implemented regions receive full integrity checking to ensure no corruption is missed, while unimplemented regions are skipped entirely. This local quality approach maintains measurement precision for actual data while reducing overall bandwidth requirements.
Data Source
AI summary
An electronic device has a runtime integrity checker for monitoring contents of storage locations in an address range. The runtime integrity checker has a location selector for selecting the storage locations by generating addresses within the address range for locations to be checked, an interface unit coupled to the location selector for receiving the addresses for accessing the locations to be checked via a bus interface, and a processor coupled to the interface unit for retrieving the contents from the locations to be checked. A mask unit is provided for processing a mask for defining the locations to be checked based on bits in the mask. The hardware enables selective monitoring of non contiguous storage locations or data areas.