METHODS AND SYSTEM FOR VERIFYING MEMORY DEVICE INTEGRITY

• US 20110276837A1
• Filed: 05/06/2010
• Published: 11/10/2011
• Est. Priority Date: 05/06/2010
• Status: Active Grant

• Current Assignee: Kidde Fire Protection LLC
• Original Assignee: UTC Fire & Security Americas Corporation, Inc. (Carrier Global Corporation)
• Inventors: Montgomery, Bruce JR., Dopson, Dave, Potter, Timothy Steven, Becker, Donald
• Granted Patent: US 8,370,689 B2
• Time in Patent Office: Days
• US Class Current: 714/42
• CPC Class Codes: G06F 11/073 in a memory management context, e.g. virtual memory or cache management memory management G06F12/00; testing of static memory units G11C29/00
• CPC Class Codes: G06F 11/0763 by bit configuration check, e.g. of formats or tags
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00

Abstract

A method and system for verifying memory device integrity includes identifying at least one memory block corresponding to at least one memory location within a memory device. The memory block is associated with a portion of a file and a checksum representing data within the memory block at a first time. Based at least in part on determining that the memory block is mapped to the same portion of the same file at a second time, it is indicated that the checksum represents expected data within the memory block. A system for verifying memory device integrity is also disclosed.

Claims

1. A method for verifying an integrity of a memory device, the method comprising:

identifying, by a processor coupled to the memory device, a memory block corresponding to at least one memory location within the memory device, the memory block associated with a first portion of a first file to which the memory block is mapped at a first time and a prior checksum representing data within the memory block at the first time;

determining, by the processor, whether the memory block is mapped to the first portion of the first file at a second time subsequent to the first time; and

based at least in part on determining that the memory block is mapped to the first portion of the first file at the second time, indicating, by the processor, that the prior checksum represents expected data within the memory block at the second time.

2. A method in accordance with claim 1, further comprising indicating that the prior checksum represents expected data within the memory block at the second time based in part on determining that no write operations corresponding to the first file have been executed between the first time and the second time.

3. A method in accordance with claim 2, further comprising determining that no write operations corresponding to the first file have been executed between the first time and the second time by comparing a first write count associated with the first file at the first time with a second write count associated with the first file at the second time.

4. A method in accordance with claim 1, further comprising indicating that the prior checksum represents expected data within the memory block at the second time based in part on determining that no write operations corresponding to the first file are pending at the second time.

5. A method in accordance with claim 1, wherein determining whether the memory block is mapped to the first portion of the first file at the second time comprises determining whether the memory block is allocated to operating system kernel text.

6. A method in accordance with claim 1, wherein identifying a memory block comprises:

receiving an address corresponding to a first memory location within the memory device; and

identifying a memory block corresponding to the first memory location.

7. A method in accordance with claim 6, further comprising identifying the memory block based in part on a predefined memory block size.

8. A method in accordance with claim 1, wherein identifying a memory block comprises identifying a page of virtual memory corresponding to a first memory location within the memory device, the first memory location corresponding to a second memory location within a storage device.

9. A method in accordance with claim 1, further comprising associating the memory block with a second portion of a second file to which the memory block is mapped at the second time based on determining that the memory block is not mapped to the first portion of the first file at the second time.

10. A method in accordance with claim 1, further comprising associating, by the processor, the memory block with a second portion of a second file to which the memory block is mapped at the second time based on determining that the memory block is not mapped to the first portion of the first file at the second time.

11. A system for verifying an integrity of a memory device, the system comprising:

a memory device comprising a plurality of memory locations; and

a processor coupled to the memory device and programmed to;

identify a memory block corresponding to at least one memory location of the plurality of memory locations within the memory device;

associate the identified memory block with a first portion of a first file to which the identified memory block is mapped at a first time and a checksum representing data within the identified memory block at the first time;

determine whether the identified memory block is mapped to the first portion of the first file at a second time subsequent to the first time; and

based at least in part on determining that the identified memory block is mapped to the first portion of the first file at the second time, indicate that the checksum represents expected data within the identified memory block.

12. A system in accordance with claim 11, wherein the processor is further programmed to associate the identified memory block with a second portion of a second file to which the identified memory block is mapped at the second time when the identified memory block is not mapped to the first portion of the first file at the second time.

13. A system in accordance with claim 11, wherein the processor is further programmed to indicate that the checksum does not represent expected data within the identified memory block when the identified memory block is not mapped to the first portion of the first file at the second time.

14. A system in accordance with claim 11, wherein the processor is further programmed to determine whether the identified memory block is mapped to the first portion of the first file at the second time by, at least in part, determining whether the identified memory block is allocated to operating system kernel text.

15. A system in accordance with claim 11, further comprising a storage device coupled to at least one of the processor and the memory device, wherein the processor is further programmed to identify the identified memory block by identifying a page of virtual memory corresponding to a first memory location within the memory device, the first memory location corresponding to a second memory location within the storage device.

16. A system in accordance with claim 15, wherein the storage device is configured to store the first file.

17. A system in accordance with claim 11, wherein the processor is further programmed to:

determine whether a write operation corresponding to the first file has been executed between the first time and the second time; and

indicate that the checksum represents expected data within the identified memory block based in part on determining that no write operations corresponding to the first file have been executed between the first time and the second time.

18. A system in accordance with claim 17, wherein the processor is further programmed to determine whether a write operation corresponding to the first file has been executed between the first time and the second time by comparing a first write count associated with the first file at the first time with a second write count associated with the first file at the second time.

19. A system in accordance with claim 11, wherein the processor is further programmed to:

determine whether a write operation corresponding to the first file is pending at the second time; and

indicate that the checksum represents expected data within the identified memory block based further on determining that no write operations corresponding to the first file are pending at the second time.

20. One or more computer-readable storage media having computer-executable components for verifying an integrity of a memory device using at least one processor coupled to the memory device, the components comprising:

a control component that when executed by the at least one processor causes the at least one processor to;

identify a memory block corresponding to at least one memory location within the memory device;

a fingerprinting component that when executed by the at least one processor causes the at least one processor to;

associate the identified memory block with a first portion of a first file to which the identified memory block is mapped at a first time and a first checksum representing data within the identified memory block at the first time; and

determine whether the identified memory block is mapped to the first portion of the first file at a second time; and

a result component that when executed by the at least one processor causes the at least one processor to;

calculate a second checksum representing data within the identified memory block at the second time when the identified memory block is mapped to the first portion of the first file at the second time; and

indicate whether the second checksum is equal to the first checksum.