Back to results
US 11,886,350 B2Granted
System memory context determination for integrity monitoring and related techniques
AssigneeRaytheon Company
InventorNathan T. Palmer
Life of this patent
Estimating the term…
Abstract
Techniques are disclosed for context-aware monitoring of the system memory to provide system integrity. An example methodology implementing the techniques includes determining a type of operating system (OS) that is loaded on system memory, examining contents of at least one system memory page, and assigning at least one tag to the at least one system memory page based on the determined type of OS and the examination of the contents of the at least one system memory page. The at least one tag indicates the characteristics of the contents of the at least one system memory page.
Claims12
A computer-implemented method comprising:
- determining, by a hypervisor, that an operating system (OS) is started in a host virtualization system, wherein the started OS comprises a boot fingerprint comprising an allocation of one or more host physical memory (HPM) pages;
- examining, by the hypervisor, contents of at least one system memory page of the one or more HPM pages to determine a type of OS that is loaded on the at least one system memory page of the one or more HPM pages, wherein the examination comprises analyzing information loaded on the one or more HPM pages when the OS is started and based on the boot fingerprint, wherein the boot fingerprint identifies various operating systems based on the one or more HPM pages storing particular aspects of the OS in specific addresses;
- and
- assigning, by the hypervisor and subsequent to the examination, at least one tag to the at least one system memory page of the one or more HPM pages based on the determined type of OS and the examination of the contents of the at least one system memory page of the one or more HPM pages,
- wherein the at least one tag indicates characteristics of the contents stored in the at least one system memory page of the one or more HPM pages including characteristics of data stored in an extended page table (EPT), and wherein the at least one tag allows for context-aware monitoring of the at least one system memory page.
2 more elements
A system comprising:
- one or more non-transitory machine-readable mediums configured to store instructions;
- and
- one or more processors configured to execute the instructions stored on the one or more non-transitory machine-readable mediums, wherein execution of the instructions causes the one or more processors to:
- determine, by a hypervisor, that an operating system (OS) is started in a host virtualization system, wherein the started OS comprises a boot fingerprint comprising an allocation of one or more host physical memory (HPM) pages;
- examine, by the hypervisor, contents of at least one system memory page of the one or more HPM pages to determine a type of OS that is loaded on the at least one system memory page of the one or more HPM pages, wherein the examination comprises analyzing information loaded on the one or more HPM pages when the OS is started and based on the boot fingerprint, wherein the boot fingerprint identifies various operating systems based on the one or more HPM pages storing particular aspects of the OS in specific addresses;
- and
- assign, by the hypervisor and subsequent to the examination, at least one tag to the at least one system memory page of the one or more HPM pages based on the determined type of OS and the examination of the contents of the at least one system memory page of the one or more HPM pages, wherein the at least one tag indicates characteristics of the contents stored in the at least one system memory page of the one or more HPM pages including characteristics of data stored in an extended page table (EPT), and wherein the at least one tag allows for context-aware monitoring of the at least one system memory page.
4 more elements
A computer program product including one or more non-transitory machine readable mediums encoded with instructions that when executed by one or more processors cause a process to be carried out, the process comprising:
- determining, by a hypervisor, that an operating system (OS) is started in a host virtualization system, wherein the started OS comprises a boot fingerprint comprising an allocation of one or more host physical memory (HPM) pages;
- examining, by the hypervisor, contents of at least one system memory page of the one or more HPM pages to determine a type of OS that is loaded on the at least one system memory page of the one or more HPM pages, wherein the examination comprises analyzing information loaded on the one or more HPM pages when the OS is started and based on the boot fingerprint, wherein the boot fingerprint identifies various operating systems based on the one or more HPM pages storing particular aspects of the OS in specific addresses;
- and
- assigning, by the hypervisor and subsequent to the examination, at least one tag to the at least one system memory page of the one or more HPM pages based on the determined type of OS and the examination of the contents of the at least one system memory page of the one or more HPM pages,
- wherein the at least one tag indicates characteristics of the contents stored in the at least one system memory page of the one or more HPM pages including characteristics of data stored in an extended page table (EPT), and wherein the at least one tag allows for context-aware monitoring of the at least one system memory page.
2 more elements
Dependencies are inferred from the claim text.