Methods and system for verifying memory device integrity

• US 8,370,689 B2
• Filed: 05/06/2010
• Issued: 02/05/2013
• Est. Priority Date: 05/06/2010
• Status: Active Grant

• Current Assignee: UTC Fire & Security Americas Corporation, Inc. (Carrier Global Corporation)
• Original Assignee: UTC Fire & Security Americas Corporation, Inc. (Carrier Global Corporation)
• Inventors: Potter, Timothy Steven, Becker, Donald, Montgomery, Bruce Jr., Dopson, Dave
• Primary Examiner(s): SCHELL, JOSEPH O
• Application Number:
  US12/775,205
• Publication Number:
  US 20110276837A1
• Time in Patent Office: 1,006 Days
• Field of Search: 714/42, 714/41, 714/718, 714/49, 714/54
• US Class Current: 714/49
• CPC Class Codes: G06F 11/073 in a memory management context, e.g. virtual memory or cache management memory management G06F12/00; testing of static memory units G11C29/00
• CPC Class Codes: G06F 11/0763 by bit configuration check, e.g. of formats or tags
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00

Abstract

A method and system for verifying memory device integrity includes identifying at least one memory block corresponding to at least one memory location within a memory device. The memory block is associated with a portion of a file and a checksum representing data within the memory block at a first time. Based at least in part on determining that the memory block is mapped to the same portion of the same file at a second time, it is indicated that the checksum represents expected data within the memory block. A system for verifying memory device integrity is also disclosed.

Claims

1. A method for verifying an integrity of a memory device, the method comprising:

calculating at a first time, by a processor coupled to the memory device, a first checksum for a memory block corresponding to at least one memory location within the memory device while the memory block is mapped to a first portion of a first file;

associating the memory block with the first portion of the first file to which the memory block is mapped at the first time, and to the first checksum representing data within the memory block at the first time;

determining, by the processor, whether the memory block is mapped to the first portion of the first file at a second time subsequent to the first time; and

based at least in part on determining that the memory block is mapped to the first portion of the first file at the second time, indicating, by the processor, that the first checksum represents expected data within the memory block at the second time,

wherein the calculating, the determining, and the indicating occur during a time period when the processor is executing one or more application programs.

2. A method in accordance with claim 1, further comprising

indicating that the first checksum represents expected data within the memory block at the second time based in part on determining that no write operations corresponding to the first file have been executed between the first time and the second time.

3. A method in accordance with claim 2, further comprising

determining that no write operations corresponding to the first file have been executed between the first time and the second time by comparing a first write count associated with the first file at the first time with a second write count associated with the first file at the second time.

4. A method in accordance with claim 1, further comprising

indicating that the first checksum represents expected data within the memory block at the second time based in part on determining that no write operations corresponding to the first file are pending at the second time.

5. A method in accordance with claim 1, wherein determining whether the memory block is mapped to the first portion of the first file at the second time comprises

determining whether the memory block is allocated to operating system kernel text.

6. A method in accordance with claim 1, wherein calculating at the first time, the first checksum for a memory block comprises:

receiving an address corresponding to a first memory location within the memory device; and

calculating the first checksum for the memory block corresponding to the first memory location.

7. A method in accordance with claim 6, further comprising

calculating the first checksum for the memory block based in part on a predefined memory block size.

8. A method in accordance with claim 1, wherein determining whether the memory block is mapped to the first portion of the first file at the second time comprises

identifying a page of virtual memory corresponding to a first memory location within the memory device, the first memory location corresponding to a second memory location within a storage device.

9. A method in accordance with claim 1, further comprising

associating the memory block with a second portion of a second file to which the memory block is mapped at the second time based on determining that the memory block is not mapped to the first portion of the first file at the second time.

10. A method in accordance with claim 1, further comprising

if the processor indicates that the first checksum represents expected data within the memory block at the second time then calculating, by the processor, a second checksum for the memory block at the second time;

and

comparing the first checksum to the second checksum.

11. A system for verifying an integrity of a memory device, the system comprising:

a memory device comprising a plurality of memory locations; and

a processor coupled to the memory device programmed to perform the following during a time period in which the processor is executing one or more application programs of an operation system;

identify a memory block corresponding to at least one memory location of the plurality of memory locations within the memory device;

calculate, at a first time, a checksum for the memory block while the memory block is mapped to a first portion of a first file;

associate the memory block with the first portion of the first file to which the memory block is mapped at the first time and with the checksum representing data within the memory block at the first time;

determine whether the memory block is mapped to the first portion of the first file at a second time subsequent to the first time; and

based at least in part on determining that the memory block is mapped to the first portion of the first file at the second time, indicate that the checksum represents expected data within the memory block at the second time.

12. A system in accordance with claim 11, wherein the processor is further programmed to

associate the memory block with a second portion of a second file to which the memory block is mapped at the second time when the memory block is not mapped to the first portion of the first file at the second time.

13. A system in accordance with claim 11, wherein the processor is further programmed to

indicate that the checksum does not represent expected data within the identified memory block when the memory block is not mapped to the first portion of the first file at the second time.

14. A system in accordance with claim 11, wherein the processor is further programmed to

determine whether the memory block is mapped to the first portion of the first file at the second time by, at least in part, determining whether the memory block is allocated to operating system kernel text.

15. A system in accordance with claim 11, further comprising

a storage device coupled to at least one of the processor and the memory device,

wherein the processor is further programmed to identify the memory block by identifying a page of virtual memory corresponding to a first memory location within the memory device, the first memory location corresponding to a second memory location within the storage device.

16. A system in accordance with claim 15, wherein the storage device is configured to store the first file.

17. A system in accordance with claim 11, wherein the processor is further programmed to:

determine whether a write operation corresponding to the first file has been executed between the first time and the second time; and

indicate that the checksum represents expected data within the identified memory block based in part on determining that no write operations corresponding to the first file have been executed between the first time and the second time.

18. A system in accordance with claim 17, wherein the processor is further programmed to

determine whether a write operation corresponding to the first file has been executed between the first time and the second time by comparing a first write count associated with the first file at the first time with a second write count associated with the first file at the second time.

19. A system in accordance with claim 11, wherein the processor is further programmed to:

determine whether a write operation corresponding to the first file is pending at the second time; and

indicate that the checksum represents expected data within the identified memory block based further on determining that no write operations corresponding to the first file are pending at the second time.

20. One or more non-transitory computer-readable storage media having computer-executable components for verifying an integrity of a memory device using at least one processor coupled to the memory device, the components comprising:

a control component that when executed by the at least one processor causes the at least one processor to;

identify a memory block corresponding to at least one memory location within the memory device during a time period in which the processor is also executing one or more application programs within an operating system; and

calculate, at a first time, a checksum for the memory block while the memory block is mapped to a first portion of a first file;

a fingerprinting component that when executed by the at least one processor causes the at least one processor to;

associate the memory block with the first portion of the first file to which the identified memory block is mapped at the first time and the checksum representing data within the identified memory block at the first time; and

determine whether the memory block is mapped to the first portion of the first file at a second time; and

a result component that when executed by the at least one processor causes the at least one processor to;

calculate a second checksum representing data within the memory block at the second time when the memory block is

mapped to the first portion of the first file at the second time; and

indicate whether the second checksum is equal to the first checksum.

21. A method for verifying an integrity of a memory device, the method comprising:

identifying, by a processor coupled to the memory device, a memory block corresponding to at least one memory location within the memory device, the memory block associated with a first portion of a first file to which the memory block is mapped at a first time and a prior checksum representing data within the memory block at the first time;

determining, by the processor, whether the memory block is mapped to the first portion of the first file at a second time subsequent to the first time; and

based at least in part on determining that the memory block is mapped to the first portion of the first file at the second time, indicating, by the processor, that the prior checksum represents expected data within the memory block at the second time based in part on determining that no write operations corresponding to the first file have been executed between the first time and the second time by comparing a first write count associated with the first file at the first time with a second write count associated with the first file at the second time.

22. A method for verifying an integrity of a memory device, the method comprising:

identifying, by a processor coupled to the memory device, a memory block corresponding to at least one memory location within the memory device, the memory block associated with a first portion of a first file to which the memory block is mapped at a first time and a prior checksum representing data within the memory block at the first time;

determining, by the processor, whether the memory block is mapped to the first portion of the first file at a second time subsequent to the first time; and

based at least in part on determining that the memory block is mapped to the first portion of the first file at the second time, indicating, by the processor, that the prior checksum represents expected data within the memory block at the second time based in part on determining that no write operations corresponding to the first file are pending at the second time.

23. A method for verifying an integrity of a memory device, the method comprising:

identifying, by a processor coupled to the memory device, a memory block corresponding to at least one memory location within the memory device, the memory block associated with a first portion of a first file to which the memory block is mapped at a first time and a prior checksum representing data within the memory block at the first time;

determining, by the processor, whether the memory block is mapped to the first portion of the first file at a second time subsequent to the first time;

based at least in part on determining that the memory block is mapped to the first portion of the first file at the second time, indicating, by the processor, that the prior checksum represents expected data within the memory block at the second time;

wherein identifying the memory block comprises receiving an address corresponding to a first memory location within the memory device and identifying a memory block corresponding to the first memory location, based in part on a predefined memory block size.

24. A system for verifying an integrity of a memory device, the system comprising:

a memory device comprising a plurality of memory locations; and

a processor coupled to the memory device and programmed to;

identify a memory block corresponding to at least one memory location of the plurality of memory locations within the memory device;

associate the identified memory block with a first portion of a first file to which the identified memory block is mapped at a first time and a checksum representing data within the identified memory block at the first time;

determine whether the identified memory block is mapped to the first portion of the first file at a second time subsequent to the first time;

based at least in part on determining that the identified memory block is mapped to the first portion of the first file at the second time, indicate that the checksum represents expected data within the identified memory block; and

determine whether the identified memory block is mapped to the first portion of the first file at the second time by, at least in part, determining whether the identified memory block is allocated to operating system kernel text.

25. A system for verifying an integrity of a memory device, the system comprising:

a memory device comprising a plurality of memory locations;

a storage device coupled to at least one of a processor and the memory device; and

the processor coupled to the memory device and programmed to;

identify a memory block corresponding to at least one memory location of the plurality of memory locations within the memory device by identifying a page the first memory location corresponding to a second memory location within the storage device;

associate the identified memory block with a first portion of a first file to which the identified memory block is mapped at a first time and a checksum representing data within the identified memory block at the first time;

determine whether the identified memory block is mapped to the first portion of the first file at a second time subsequent to the first time; and

based at least in part on determining that the identified memory block is mapped to the first portion of the first file at the second time, indicate that the checksum represents expected data within the identified memory block.

26. The system in accordance with claim 25, wherein the storage device is configured to store the first file.