发明申请
- 专利标题: Portion-level in-memory module authentication
- 专利标题(中): 部分级内存模块认证
-
申请号: US10902244申请日: 2004-07-29
-
公开(公告)号: US20060026569A1公开(公告)日: 2006-02-02
- 发明人: Timothy Oerting , Philip Lafornara , Robert Oliver , Scott Brender , Michael Marr
- 申请人: Timothy Oerting , Philip Lafornara , Robert Oliver , Scott Brender , Michael Marr
- 申请人地址: US WA Redmond
- 专利权人: Microsoft Corporation
- 当前专利权人: Microsoft Corporation
- 当前专利权人地址: US WA Redmond
- 主分类号: G06F9/44
- IPC分类号: G06F9/44
摘要:
Dynamic run-time verification of a module which is loaded in memory (in whole or in part) for execution is enabled by using pre-computed portion-level verification data for portions of the module smaller than the whole (e.g. at the page-level). A portion of the module as loaded into memory for execution can be verified. Pre-computed portion-level verification data is retrieved from storage and used to verify the loaded portions of the executable. Verification data may be, for example, a digitally signed hash of the portion. Where the operating system loader has modified the portion for execution, the modifications are reversed, removing any changes performed by the operating system. If the portion has not been tampered, this will return the portion to its original pre-loaded state. This version is then used to determine validity using the pre-computed portion-level verification. Additionally, during execution of the module, new portions/pages of the module which are loaded can be verified to ensure that they have not been changed, and a list of hot pages of the module can be made, including pages to be continually reverified, in order to ensure that no malicious changes have been made in the module.
公开/授权文献
- US07644287B2 Portion-level in-memory module authentication 公开/授权日:2010-01-05
信息查询