Memory Integrity Monitoring via Embedded Hash Reconstruction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software-based integrity monitoring solutions for runtime systems face significant CPU performance overhead, leading to reduced practicability and increased chances of undetected malicious changes, especially with newer memory types like NVM and SCM, which are computationally expensive and power-intensive.
Innovation Solution
A hardware and software co-design solution using programmable memory side accelerators embedded in memory controllers for real-time integrity checking, enabling distributed and parallel accumulation of hashes to reduce CPU overhead and enhance monitoring efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based integrity monitoring is used to detect unauthorized changes, then security monitoring capability is improved, but CPU performance overhead increases significantly
Solution Approach 1:
The patent divides the integrity monitoring function into separate hardware modules (integrity monitor modules) embedded within memory controllers, separating it from the main CPU execution path. This segmentation allows the CPU to continue normal operations while dedicated hardware handles integrity checking in parallel, thus maintaining monitoring capability without sacrificing CPU performance.
Solution Approach 2:
The patent introduces integrity monitor modules as intermediary components between the CPU and memory systems. These modules act as mediators that perform integrity checking on memory operations without requiring CPU intervention, thereby protecting system integrity while keeping the CPU free for productive work.
2Speed
If integrity checking frequency is increased to detect changes timely, then detection speed is improved, but system overhead increases
Solution Approach 1:
The patent implements continuous integrity monitoring through hardware modules that operate in parallel with normal system execution. The integrity check occurs continuously without suspending or slowing down system operations, maintaining both high detection speed and minimal overhead by making the monitoring action continuous and non-intrusive.
Solution Approach 2:
The integrity monitor modules perform integrity checking proactively as part of the memory access pipeline before potential security breaches can execute malicious code. This preliminary action detects unauthorized changes immediately when they occur, maintaining high detection speed while avoiding the overhead of post-event analysis.
3Measurement precision
If data is copied between memory and CPU for integrity checking, then monitoring accuracy is improved, but power consumption and computational cost increase
Solution Approach 1:
The integrity monitor modules are embedded directly within the memory controller, allowing them to perform integrity checking on data locally as it passes through the memory interface. This self-service approach enables accurate monitoring without requiring data to be copied to the CPU, thereby maintaining monitoring precision while significantly reducing power consumption and computational overhead.
Solution Approach 2:
The patent merges the integrity monitoring function with the memory controller hardware, combining data movement and integrity checking into a single integrated operation. This merging eliminates the need for separate data copying operations, maintaining accurate monitoring while reducing power consumption by performing both functions in parallel within the same hardware pathway.
Data Source
AI summary
In one example in accordance with the present disclosure, a system comprises a first memory module and a first memory integrity monitoring processor, embedded to the first memory module, to receive a second hash corresponding to a second memory module. The second hash includes a second sequence number for reconstruction of a final hash value and the second hash is not sequentially a first number in a sequence for reconstruction of the final hash value. The first processor may receive a third hash corresponding to a third memory module. The third hash includes a third sequence number for reconstruction of the final hash value and the third hash is received after the second hash. The first processor may determine if the second hash can be combined with the third hash, combine the second hash and third hash into a partial hash reconstruct the final hash value using the partial hash.