Tamper-Resistant Network Traffic Logging via NVRAM Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information handling systems face challenges in securely logging and monitoring network traffic to detect malicious activities, as existing solutions are vulnerable to tampering and manipulation by malicious programs or users.
Innovation Solution
A managed system with a non-volatile random access memory (NVRAM) for secure data storage, including a log module that isolates log information from the operating system and programs, and a management controller (MC) that remotely launches and monitors the log module to track network traffic, providing tamper-resistant and encrypted logging capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If log information is stored in accessible memory for system monitoring, then ease of operation is improved, but reliability deteriorates due to vulnerability to tampering
Solution Approach 1:
The patent divides the logging system into separate components: a log module isolated in non-volatile memory (NVRAM) that is physically separated from the operating system and applications. This segmentation prevents malicious programs from accessing or tampering with log information while maintaining the ability to retrieve logs for monitoring purposes.
Solution Approach 2:
The patent introduces a management controller as an intermediary component that mediates between the isolated log module and external monitoring systems. The management controller can retrieve and transmit log information without allowing direct access to the log module, thus maintaining log integrity while enabling monitoring operations.
2Reliability
If log module is isolated from operating system for security, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent combines the log module with the management controller into an integrated logging system. The log module is implemented within the management controller's address space in NVRAM, allowing both components to work together as a unified system while maintaining the isolation benefits. This merging reduces overall system complexity compared to completely separate components.
3Reliability
If encryption is implemented for log storage, then reliability is improved, but use of energy increases
Solution Approach 1:
The patent implements log information encryption before storage in NVRAM, performing the encryption action in advance rather than during retrieval or analysis. This preliminary encryption ensures log security while minimizing energy consumption during system operation, as the encryption process only occurs during the initial logging phase when data is first written to storage.
Data Source
AI summary
A network interface device includes a memory and a processor operable to receive a malicious packet marker, store the malicious packet marker to the memory, monitor network data packets flowing in the network interface device, determine that a packet matches the malicious packet marker, and store log information from the packet to the memory.