Runtime Integrity Verification Manageability Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures for processor-based systems are inadequate in providing runtime integrity verification, particularly for System Management Mode (SMM) and BIOS components, making them vulnerable to attacks like Time Of Check (TOCTOU) and code injection, especially against malicious rootkits that can be difficult to detect.
Innovation Solution
Implementing a processor-based system with a manageability engine and chipset that generates and securely stores integrity information for code blocks and system management memory, periodically re-validates this information during runtime, and sends remote alerts if validation fails, using a hardware-based approach to ensure the integrity of firmware and BIOS components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If software-based security measures are used for integrity verification, then ease of implementation is improved, but security reliability and isolation are worsened
Solution Approach 1:
The patent introduces a dedicated manageability engine as an intermediary hardware component between the processor and memory systems. This engine specifically handles integrity verification tasks, acting as a mediator that isolates security-critical operations from the main processor. The manageability engine contains a validation module that independently verifies code integrity using stored hash values, preventing direct access and potential tampering by malicious software while maintaining systematic security management.
Solution Approach 2:
The patent segments the system into distinct functional modules: a manageability engine separate from the main processor, a validation module within the engine, and a code storage area. This segmentation isolates security verification functions from general processing tasks, creating specialized security zones that enhance reliability. The validation module operates independently to check code integrity without interfering with normal system operations, thereby improving both security reliability and system stability.
2Reliability
If runtime integrity verification is implemented, then security against runtime attacks is improved, but device complexity and processing overhead are worsened
Solution Approach 1:
The patent implements preliminary action by pre-calculating and storing hash values (integrity information) of legitimate code in a dedicated storage area during system initialization or firmware updates. These pre-computed hash values are stored securely in the manageability engine's memory. During runtime, the validation module simply compares current code hashes against these pre-stored values, avoiding complex real-time analysis and reducing processing overhead while maintaining strong security against runtime attacks.
Solution Approach 2:
The system implements self-service through automatic integrity verification performed by the validation module without requiring external intervention. The manageability engine autonomously monitors code integrity by periodically validating hashes of critical system code, automatically detecting tampering attempts. This self-monitoring mechanism reduces the need for external security management complexity while providing continuous runtime protection.
3Measurement precision
If periodic re-validation of code integrity is performed during runtime, then detection of code tampering is improved, but processing time and system performance are worsened
Solution Approach 1:
The patent changes the verification parameter from complex code analysis to simple hash value comparison. By representing code integrity as a single hash value and comparing it against pre-stored reference hashes, the system achieves high detection precision for code tampering while minimizing processing time. The validation module only needs to compute and compare hash values rather than performing exhaustive code analysis, significantly reducing the time overhead of periodic re-validation.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
In some embodiments, a processor-based system may include at least one processor, at least one memory coupled to the at least one processor, a code block, and code which is executable by the processor-based system to cause the processor-based system to generate integrity information for the code block upon a restart of the processor-based system, securely store the integrity information, and validate the integrity of the code block during a runtime of the processor-based system using the securely stored integrity information. Other embodiments are disclosed and claimed.