Runtime Integrity Verification for System Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Integrity Measurement Architecture (IMA) is incapable of detecting modifications in system memory after the initial loading process, leaving a significant attack vector open, especially in infrastructure where systems rarely restart and software updates occur dynamically, thus requiring a comprehensive solution for runtime integrity verification.
Innovation Solution
A device and method for Dynamic Runtime Integrity Verification and Evaluation (DRIVE) that maps executable files into separate segments in system memory, generates measurements of all memory areas during runtime, maintains these measurements in a Dynamic Measurement Log (DML), and anchors them in a security module like a TPM for secure reporting and verification, extending static integrity measurements to include runtime changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static on-load measurement is used to measure files before execution, then measurement simplicity is improved, but runtime modification detection capability deteriorates
Solution Approach 1:
The patent transitions from static file measurement to dynamic runtime measurement. The IMA mechanism continuously measures memory contents during system operation, capturing changes that occur after initial loading. This dynamic approach allows detection of runtime modifications while maintaining the underlying measurement infrastructure.
Solution Approach 2:
The patent establishes baseline measurements of files before execution using conventional IMA, then uses these as reference points for subsequent runtime comparisons. The preliminary static measurement creates a trusted foundation that enables later detection of deviations during system operation.
2Reliability
If continuous runtime measurement is implemented to detect memory modifications, then security reliability is improved, but system complexity deteriorates
Solution Approach 1:
The patent extends the existing IMA mechanism to serve dual purposes: traditional file integrity measurement and runtime memory modification detection. By making IMA universal, the system achieves enhanced security without adding entirely new measurement infrastructure, thereby limiting complexity increase.
Solution Approach 2:
The patent introduces a measurement buffer as an intermediary component that stores runtime measurement data and facilitates comparison with baseline values. This buffer acts as a mediator between the measurement process and verification logic, simplifying the overall system architecture while enabling continuous monitoring.
3Measurement precision
If runtime measurements are performed continuously to detect changes, then detection precision is improved, but processing overhead deteriorates
Solution Approach 1:
The patent measures only critical memory regions and specific file contents during runtime rather than performing exhaustive full-system measurements. By focusing on partial measurements of key areas, the system achieves sufficient detection precision while reducing processing overhead and resource consumption.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A device 100 for measuring system states obtains measurements of corresponding areas of a system memory during systems runtime, and maintains each measurement individually in a measurement log. The device generates and anchors a fingerprint of the measurement log in a security module, and generates and sends the anchored fingerprint and the measurement log. A device 200 for verifying system states receives a measurement log containing measurements of a system memory, and a fingerprint of the measurement log. The device 200 verifies authenticity of the fingerprint based on a cryptographic key identifying the security module, to verify integrity of the measurement log based on the verified fingerprint, if the fingerprint is authentic, and verifies a reliability of each measurement in the measurement log based on a comparison of the measurement with a reference value if the measurement log is of integrity.