Determination by circuitry of presence of authorized and/or malicious data

• US 8,214,902 B2
• Filed: 06/19/2009
• Issued: 07/03/2012
• Est. Priority Date: 06/19/2009
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Khosravi, Hormuzd M., Von Bokern, Vincent E., Long, Men
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US12/487,878
• Publication Number:
  US 20100325729A1
• Time in Patent Office: 1,110 Days
• Field of Search: 726/24, 726/23, 713/165, 713/176, 713/187, 713/188, 713/189, 326/12
• US Class Current: 726/24
• CPC Class Codes: G06F 21/565 by checking file integrity

Abstract

An embodiment may include circuitry that may be comprised in a host. The host may include memory and a host processor to execute an operating system. The circuitry may be to determine, independently of the operating system and the host processor, the authenticity of signature list information, based at least in part upon authentication information received by the circuitry from a remote server. The circuitry also may be to determine, independently of the operating system and the host processor, based at least in part upon comparison of at least one portion of the signature list information with at least one portion of contents of the memory, whether authorized and/or malicious data are present in the at least one portion of the contents of the memory. Of course, many variations, modifications, and alternatives are possible without departing from this embodiment.

Claims

1. An apparatus comprising:

circuitry to be comprised in a host, the host including a host processor and memory, the host processor being to execute an operating system, the circuitry being to determine, independently of the operating system and the host processor, authenticity of signature list information, the circuitry being to determine the authenticity based at least in part upon authentication information received by the circuitry from a remote server, the circuitry also being to determine, independently of the operating system and the host processor, based at least in part upon comparison of at least one portion of the signature list information with at least one portion of contents of the memory, whether at least one of authorized data and malicious data is present in the at least one portion of the contents of the memory, the circuitry comprising a finite state machine, the finite state machine comprising a flip-flop to receive, during a clock transition, next state information that is to be supplied to a decoder during a succeeding clock transition as current state information, the finite state machine comprising the decoder, the next state information representing a next state of the finite state machine, the current state information representing a current state of the finite state machine.

2. The apparatus of claim 1, wherein:

the at least one portion of the signature list information includes one or more signatures;

the malicious data comprises at least one unauthorized program instruction executable by the host processor;

the authorized data indicates, at least in part, that the at least one portion is authorized, at least in part; and

the signature list information is received, at least in part, from the remote server by the circuitry, independently of the host processor and the operating system.

3. The apparatus of claim 1, wherein:

a circuit board comprises the host processor;

a circuit card comprises, at least in part, the circuitry; and

the circuit card is to be coupled to the circuit board.

4. The apparatus of claim 1, wherein:

the at least one portion of the signature list information includes one or more signatures;

the circuitry comprises memory access circuitry, one or more buffers, and pattern matching circuitry;

the memory access circuitry is to retrieve from the memory and to store in the one or more buffers the at least one portion of the contents of the memory; and

the pattern matching circuitry comprises;

one or more shift registers to receive from the one or more buffers the at least one portion of the contents of the memory;

one or more signature registers to store the one or more signatures; and

comparator circuitry to receive from the one or more shift registers the at least one portion of the contents of the memory and to compare with the at least one portion of the contents of the memory the one or more signatures stored in the one or more signatures registers.

5. The apparatus of claim 1, wherein:

the at least one portion of the signature list information includes one or more signatures;

the decoder is to generate, based at least in part upon a subset of the at least one portion of the contents of the memory and the current state information, a decoded address; and

the finite state machine includes;

another memory to store tuples at address locations and to select one of the tuples addressed by the decoded address, the one of the tuples including a first value and a second value, the first value indicating the next state information, the second value indicating whether the at least one portion of contents matches the one or more signatures, and if the second value indicates that the at least one portion of the contents matches the one or more signatures, the second value also indicates which of the one or more signatures matches the at least one portion of the contents.

6. The apparatus of claim 1, wherein:

the at least one portion of the signature list information includes one or more signatures;

the state machine includes;

another memory to store tuples at addresses in the another memory, the tuples being associated with possible current states of the state machine, each respective one of the tuples including;

one or more respective addresses in the another memory that store another respective tuple that is associated with a respective possible next state of the state machine;

a respective indicator to indicate whether yet another respective tuple stored in the another memory is associated with a respective possible current state of the state machine that is associated with the respective one of the tuples;

a respective vector indicating whether the at least one portion of contents matches the one or more signatures, and if the respective vector indicates that the at least one portion of the contents matches the one or more signatures, the respective vector also indicates which of the one or more signatures matches the at least one portion of the contents; and

a respective possible value of a subset of the at least one portion of the contents, the respective possible value to be compared to a respective actual value of the subset to determine whether to select the respective possible next state as an actual next state of the state machine.

7. The apparatus of claim 6, wherein:

the apparatus is to select a selected address in the another memory that is associated with a current selected one of the tuples, the current selected one of the tuples being associated with an actual current state of the state machine; and

the apparatus is to generate the selected address based at least in part upon an offset, the offset being based at least in part upon a hashing of the subset.

8. The apparatus of claim 6, wherein:

the apparatus is to select a selected address in the another memory that is associated with a current selected one of the tuples, the current selected one of the tuples being associated with an actual current state of the state machine; and

if the actual current state of the state machine is an initial state, the apparatus is to generate the selected address based at least in part upon an offset, the offset being based at least in part upon an entry in a content addressable memory accessed based at least in part upon the subset.

9. The apparatus of claim 1, wherein:

the circuitry is at least one of;

comprised at least in part in at least one chipset;

comprised in a co-processor separate from the host processor; and

comprised in a manageability co-processor separate from the host processor.

10. A method comprising:

determining by circuitry, independently of a host processor and an operating system, authenticity of signature list information, the circuitry to be comprised in a host, the host including the host processor and memory, the host processor being to execute the operating system, the circuitry determining the authenticity based at least in part upon authentication information received by the circuitry from a remote server; and

determining by the circuitry, independently of the operating system and the host processor, based at least in part upon comparison of at least one portion of the signature list information with at least one portion of contents of the memory, whether at least one of authorized data and malicious data is present in the at least one portion of the contents of the memory, the circuitry comprising a finite state machine, the finite state machine comprising a flip-flop to receive, during a clock transition, next state information that is to be supplied to a decoder during a succeeding clock transition as current state information, the finite state machine comprising the decoder, the next state information representing a next state of the finite state machine, the current state information representing a current state of the finite state machine.

11. The method of claim 10, wherein:

the at least one portion of the signature list information includes one or more signatures;

the malicious data comprises at least one unauthorized program instruction executable by the host processor;

the authorized data indicates, at least in part, that the at least one portion is authorized at least in part; and

the signature list information is received, at least in part, from the remote server by the circuitry, independently of the host processor and the operating system.

12. The method of claim 10, wherein:

at least one of the determining of the authenticity of the signature list information and the determining whether the at least one of the authorized data and the malicious data is present is carried out by the circuitry at least in part while the host processor is in a relatively lower power state relative to a fully powered-on state.

13. The method of claim of claim 10, wherein:

the circuitry comprises pattern matching circuitry, the pattern matching circuitry being to determine, at least in part, whether the at least one of the authorized data and the malicious data is present.

14. The method of claim 10, wherein:

the circuitry is at least one of;

comprised at least in part in at least one chipset;

comprised in a co-processor separate from the host processor; and

comprised in a manageability co-processor separate from the host processor.

15. Computer-readable memory storing one or more instructions that when executed by a machine result in execution of a set of operations comprising:

determining by circuitry, independently of a host processor and an operating system, authenticity of signature list information, the circuitry to be comprised in a host, the host including the host processor and memory, the host processor being to execute the operating system, the circuitry determining the authenticity based at least in part upon authentication information received by the circuitry from a remote server; and

determining by the circuitry, independently of the operating system and the host processor, based at least in part upon comparison of at least one portion of the signature list information with at least one portion of contents of the memory, whether at least one of authorized data and malicious data is present in the at least one portion of the contents of the memory, the circuitry comprising a finite state machine, the finite state machine comprising a flip-flop to receive, during a clock transition, next state information that is to be supplied to a decoder during a succeeding clock transition as current state information, the finite state machine comprising the decoder, the next state information representing a next state of the finite state machine, the current state information representing a current state of the finite state machine.

16. The computer-readable memory of claim 15, wherein:

the at least one portion of the signature list information includes one or more signatures;

the malicious data comprises at least one unauthorized program instruction executable by the host processor;

the authorized data indicates, at least in part, that the at least one portion is authorized at least in part; and

the signature list information is received, at least in part, from the remote server by the circuitry, independently of the host processor and the operating system.

17. The computer-readable memory of claim 15, wherein:

at least one of the determining of the authenticity of the signature list information and the determining whether the at least one of the authorized data and the malicious data is present is carried out by the circuitry at least in part while the host processor is in a relatively lower power state relative to a fully powered-on state.

18. The computer-readable memory of claim 15, wherein:

the circuitry comprises pattern matching circuitry, the pattern matching circuitry being to determine, at least in part, whether the at least one of the authorized data and the malicious data is present.

19. The computer-readable memory of claim 18, wherein:

the malicious data comprises one or more other instructions executable by the host processor.

20. The computer-readable memory of claim 15, wherein:

the circuitry is at least one of;

comprised at least in part in at least one chipset;

comprised in a co-processor separate from the host processor; and

comprised in a manageability co-processor separate from the host processor.