SMM Integrity Protection via Hash Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

System management mode (SMM) in computing systems is vulnerable to malicious modifications due to its high privileges, which can be exploited for compromising the security of the computer system, such as by Rootkits or other malicious software.

Innovation Solution

Implementing integrity protection by determining a hash value of the SMM control routine during system initialization and comparing it during operation to ensure authenticity, with the processing unit restoring the original SMM instructions if any alterations are detected, thereby preventing unauthorized execution.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If SMM is used to execute instructions with high privileges, then operational capabilities are improved, but system security is worsened due to vulnerability to malicious modifications

Engineering Contradiction:

Improveoperational capabilitiesVSAvoidsystem security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent calculates and stores a hash value of the SMM control routine during system initialization (before execution) in a protected storage location. This preliminary action enables later verification of the control routine's integrity by comparing hash values, preventing malicious modifications from executing unauthorized code while maintaining SMM's high-privilege operational capabilities

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a hash value as an intermediary representation of the SMM control routine. Instead of directly verifying the entire control routine, the system uses the hash value (a condensed digital fingerprint) as a mediator to efficiently verify integrity. This intermediary enables security verification without compromising the operational functionality of SMM

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If integrity verification is implemented by comparing hash values, then system security is improved, but processing time is worsened due to additional verification steps

Engineering Contradiction:

Improvesystem securityVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent transforms the SMM control routine into a hash value (changing the parameter representation from full code to condensed fingerprint). This parameter transformation enables rapid comparison and verification, as hashing a condensed representation is computationally much cheaper than verifying the entire control routine, thus reducing processing time overhead while maintaining security

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The hash value of the SMM control routine is calculated and stored in a protected storage location during system initialization, before the control routine needs to be verified during execution. This preliminary calculation avoids repeated heavy computation during operation, reducing real-time processing time while maintaining continuous security verification capability

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS10664178B2Integrity protection for system management mode

Publication Date: 2020.05.26 INTEL CORP

AI summary

Various embodiments are directed to providing integrity protection for a system management mode. During initialization, a hash value of a system management mode control routine may be determined. Subsequently, during operation, the hash value may be compared to a hash value of a system management mode control routine to be executed. The system management mode control routine to be executed may be determined to be authentic if the hash values are the same.