Monitoring operating system invariant information
AssigneeHewlett Packard Enterprise Development LP
InventorsGeoffrey Ndu, Nigel Edwards
Life of this patent
Estimating the term…
Abstract
In some examples, a system executes a monitor separate from an operating system (OS) that uses mapping information in accessing data in a physical memory. The monitor identifies, using the mapping information, invariant information, that comprises program code, of the OS without suspending execution of the OS, the identifying comprising the monitor accessing the physical memory independently of the OS. The monitor determines, based on monitoring the invariant information of the OS, whether a security issue is present.
Claims20
A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to:
- execute a monitor separate from an operating system (OS) that uses mapping information in accessing data in a physical memory, wherein the mapping information maps virtual addresses to physical addresses of the physical memory;
- identifying, by the monitor using the mapping information, invariant information, that comprises program code, of the OS without suspending execution of the OS, the identifying comprising the monitor accessing the physical memory independently of the OS;
- and
- determining, by the monitor based on monitoring the invariant information of the OS, whether a security issue is present.
A system comprising:
- a physical memory;
- a first processor;
- a second processor;
- an operating system (OS) executable on the first processor, the OS to use mapping information in accessing data in the physical memory, wherein the mapping information maps virtual addresses to physical addresses of the physical memory;
- a monitor executable on the second processor that is different from the first processor to:
- identify, using the mapping information, invariant information comprising program code of the OS without suspending execution of the OS, the identifying based on the monitor accessing the physical memory independently of the OS, and
- determine, based on monitoring the invariant information of the OS, whether a security issue is present.
A method performed by a system comprising a hardware processor, comprising:
- accessing, by an operating system (OS) that includes a hypervisor, a physical memory using mapping information that maps virtual addresses to physical addresses of the physical memory;
- accessing, by a monitor using the mapping information, invariant information of the OS including the hypervisor without suspending execution of the OS;
- and
- determining, by the monitor based on monitoring the invariant information of the OS including the hypervisor, whether a security issue is present.
Dependencies are inferred from the claim text.