Preventing code modification after boot
AssigneeMicrosoft Technology Licensing, LLC
InventorsLing Tony Chen, Felix Stefan Domke
Life of this patent
Estimating the term…
Abstract
The subject disclosure is directed towards protecting code in memory from being modified after boot, such as code used in a dedicated microprocessor or microcontroller. Hardware, such as in logic or in a memory protection unit, allows a range of memory to be made non-writeable after being loaded, e.g., via a secure boot load operation. Further, startup code that is used to configure the hardware/memory may be made non-executable after having run once, so that no further execution may occur in that space, e.g., as a result of an attack. A function in the runtime code may allow for a limited, attack-protected reconfiguration of sub-regions of memory regions during the runtime execution.
Claims20
A method comprising:
- running secure boot code to load executable instructions into an executable memory space to perform a secure boot of a device, the executable memory space being loaded with at least a part of the executable instructions for enablement and disablement of a memory protection unit (MPU);
- responsive to executing the at least part of the executable instructions loaded in the memory space, enabling the MPU;
- and
- protecting the enabled MPU from any further changes by rendering a portion of the memory space comprising the at least part of the executable instructions as non-executable.
A system comprising:
- a memory;
- and
- one or more processors programmed to perform the following operations:
- running secure boot code to load executable instructions into an executable memory space in the memory to perform a secure boot of a device, the executable memory space being loaded with at least a part of the executable instructions for enablement and disablement of a memory protection unit (MPU)
- responsive to executing the at least part of the executable instructions loaded in the memory space, enabling the MPU;
- and
- protecting the enabled MPU from any further changes by rendering a portion of the memory space comprising the at least part of the executable instructions as non-executable.
One or more computer-readable hardware devices having executable instructions, which when executed perform steps, comprising:
- running secure boot code to load executable instructions into an executable memory space to perform a secure boot of a device, the executable memory space being loaded with at least a part of the executable instructions for enablement and disablement of a memory protection unit (MPU);
- responsive to executing the at least part of the executable instructions loaded in the memory space, enabling the MPU;
- and
- protecting the enabled MPU from any further changes by rendering a portion of the memory space comprising the at least part of the executable instructions as non-executable.
Dependencies are inferred from the claim text.