Runtime Integrity Chain Verification for Function Pointer Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious attacks on computer systems, such as rootkits and stealth memory attacks, modify low-level system components like Interrupt Dispatch Tables and function pointers to evade detection by security software, making it difficult for existing security methods to detect and prevent such threats.
Innovation Solution
Implementing a run-time integrity monitoring system using an isolated execution environment, like a service processor or virtual machine monitor, that verifies the correctness of function pointers and execution paths by comparing in-memory values with expected values from integrity manifests, generating faults and taking remedial action if discrepancies are found.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing security methods monitor only static executable code, then detection simplicity is maintained, but detection capability against runtime modifications is insufficient
Solution Approach 1:
The patent transitions from static code monitoring to dynamic runtime monitoring of function pointers. The system actively tracks modifications to function pointers during program execution, enabling detection of stealth attacks that modify code behavior at runtime rather than analyzing only static executable code.
Solution Approach 2:
The patent implements a monitoring mechanism that continuously observes function pointer values and compares them against expected values. When a modification is detected, the system generates an indication of potential malicious activity, creating a feedback loop that enables real-time detection and response to integrity violations.
2Object-affected harmful factors
If function pointers are modified at runtime to point to attacker's code, then attack stealth is achieved, but system integrity is compromised
Solution Approach 1:
The patent establishes expected values for function pointers before program execution begins. These expected values are stored and used as reference points during runtime monitoring, allowing the system to detect any deviations from the intended execution path before malicious code can fully compromise the system.
Solution Approach 2:
The patent replaces traditional mechanical integrity checking methods with a software-based runtime monitoring system. Instead of relying on hardware-level protections or static analysis, the system uses software agents to dynamically track and verify function pointer integrity during program execution.
3Device complexity
If integrity checkers monitor only interrupt service routine and DPC executable code, then monitoring scope is limited, but detection completeness is insufficient
Solution Approach 1:
The patent extends the monitoring capability from specific interrupt service routines and DPCs to a universal mechanism that monitors all function pointers throughout the system. This multi-functional approach allows the same monitoring infrastructure to detect integrity violations in diverse contexts including interrupt handlers, process code, and library functions.
Data Source
AI summary
A runtime integrity check may be implemented for a chain or execution path. When the chain or execution path calls other functions, the correctness of an entity called from the execution path is verified. As a result, attacks by malicious software that attempt to circumvent interrupt handlers can be combated.