Memory Integrity Checking via Hypervisor and Media Controller
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing operating systems lack robust mechanisms to ensure the integrity of loaded computer program code, particularly in the presence of unauthorized changes or malware, especially when the loader and page translation mechanisms are subverted, and hypervisors introduce additional challenges.
Innovation Solution
A memory integrity checking apparatus and method that utilizes active media controllers embedded in the memory subsystem to perform synchronous and asynchronous verification, eliminating the need to trust the OS, and ensuring secure and robust integrity checking of computer program code by autonomously checking memory ranges and using associative hashes to identify unauthorized signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the OS loader and page translation mechanisms are used to check integrity, then the checking process is integrated into the existing system, but the reliability is compromised when these mechanisms are subverted by malware or rootkits
Solution Approach 1:
The patent introduces a hypervisor as an intermediary layer between the hardware and the operating system. The hypervisor creates a virtualized environment where the OS and its loader mechanisms run in a virtual machine, while the integrity checking logic resides in the hypervisor layer. This mediator allows the system to use the familiar OS loader for integrity checking while preventing malware from subverting the checking process, as the hypervisor can monitor and control the virtualized environment.
Solution Approach 2:
The patent segments the system into distinct layers: the hardware layer, the hypervisor layer, and the virtualized OS layer. By separating the integrity checking functionality into the hypervisor layer, the system achieves reliability without requiring the entire system architecture to be complex. The segmentation allows the OS to remain relatively simple while the hypervisor handles the security-critical functions.
2Reliability
If continuous integrity checking is performed to detect unauthorized changes, then the reliability improves, but the performance loss increases due to the overhead of continuous verification
Solution Approach 1:
The patent implements periodic integrity checking rather than continuous checking. The hypervisor performs integrity verification at scheduled intervals or at specific events (such as when code is loaded or modified), rather than constantly monitoring every memory access. This periodic approach maintains reliability by detecting unauthorized changes while reducing the performance overhead compared to continuous verification.
Solution Approach 2:
The patent enables the system to perform self-verification through cryptographic hash functions. The integrity checking mechanism uses hash values stored in read-only memory to verify the integrity of code in memory, allowing the system to check its own integrity without requiring external intervention. This self-service approach improves reliability while minimizing performance impact by using efficient cryptographic algorithms.
3Reliability
If the loader checks every piece of code against virus signatures, then the security improves, but the productivity decreases due to the time required for scanning
Solution Approach 1:
The patent performs preliminary integrity verification during the code loading process itself. The hypervisor verifies the integrity of code as it is being loaded into memory, using cryptographic hash functions comparing against stored values. This preliminary action ensures security against malware without requiring a separate scanning step, as the verification is integrated into the loading process and fails fast if integrity is compromised.
Solution Approach 2:
The patent replaces traditional mechanical virus signature scanning with cryptographic hash-based verification. Instead of comparing code bytes against virus signature databases (a mechanical process), the system uses mathematical hash functions to verify integrity. This substitution dramatically improves productivity by reducing the verification time from potentially minutes to milliseconds, while maintaining or improving security reliability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to an example, memory integrity checking may include receiving computer program code, and using a loader to load the computer program code in memory. Memory integrity checking may further include verifying the integrity of the computer program code by selectively implementing synchronous verification and/or asynchronous verification. The synchronous verification may be based on loader security features associated with the loading of the computer program code. Further, the asynchronous verification may be based on a media controller associated with the memory containing the computer program code.