Intrusion Detection via Monitor Co-Processor for Runtime Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Low-level execution environments such as the kernel, hypervisor, or firmware in a computing system are vulnerable to malicious alterations that compromise system confidentiality, integrity, or availability, and existing security measures like cryptographic signatures and measurements are insufficient to detect such intrusions at runtime.
Innovation Solution
An intrusion detection system (IDS) is implemented using a monitor co-processor that monitors the integrity of low-level environments like SMM through a low-latency communication channel with a controlled access memory structure, ensuring data integrity, chronological order, and exclusive access, and employs instrumentation to gather control flow information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic signatures and measurements are used to protect low-level execution environments, then system integrity is improved, but detection capability at runtime deteriorates
Solution Approach 1:
The patent introduces a monitor co-processor as an intermediary component that independently verifies the behavior of the low-level execution environment. This mediator can detect intrusions by monitoring control flow and data flow without interfering with the normal operation protected by cryptographic signatures, thus resolving the contradiction between maintaining integrity and enabling detection.
Solution Approach 2:
The system implements feedback mechanisms where the monitor co-processor continuously observes the execution environment and provides detection feedback. The monitor can detect deviations from expected behavior and trigger appropriate responses, enabling runtime detection while the cryptographic signatures maintain baseline integrity.
2Reliability
If a monitor co-processor is introduced to detect intrusions, then detection reliability is improved, but device complexity increases
Solution Approach 1:
The patent segments the monitoring function from the main processor by introducing a dedicated monitor co-processor. This segmentation allows the monitoring functionality to be implemented as a separate, specialized component with simplified architecture, reducing the overall system complexity while improving detection reliability.
Solution Approach 2:
The monitor co-processor is designed to autonomously perform intrusion detection tasks without requiring complex coordination with other system components. It independently accesses control flow information and makes detection decisions, reducing the complexity of integration while maintaining high detection reliability.
3Measurement precision
If instrumentation is used to gather control flow information, then measurement precision is improved, but performance degradation increases
Solution Approach 1:
The system creates copies of control flow information through instrumentation points rather than directly intercepting and analyzing every instruction execution. These copies provide sufficient precision for intrusion detection while minimizing the performance overhead associated with comprehensive monitoring.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An intrusion detection system, comprising a monitor to process messages received from a target over a low-latency communication link comprising a controlled access memory structure logically positioned between the target and the monitor using point-to-point interconnects, the controlled access memory structure to receive a message from the target indicating that the target has entered a controlled mode of operation.