Integrity monitoring of encrypted operating system information

A system comprising:

• a central processing unit (CPU) to execute an operating system (OS) kernel;
• a controller to perform integrity monitoring of encrypted kernel information of the OS kernel, the encrypted kernel information encrypted with a first key,
• wherein the OS kernel comprises a driver executable by the CPU to:
• identify a memory page containing the encrypted kernel information;
• associate an encryption disabled indicator with the memory page;
• request the encrypted kernel information from the memory page, wherein the request is to cause the CPU to read the encrypted kernel information from the memory page, and the encryption disabled indicator is to cause the CPU to refrain from decrypting the encrypted kernel information using the first key when reading the encrypted kernel information from the memory page;
• compute a reference measurement value based on the encrypted kernel information read by the CPU from the memory page without decryption using the first key;
• and
• provide the reference measurement value to the controller.

A method comprising:

• populating, by an operating system (OS) kernel in a computing system comprising a central processing unit (CPU), an entry of mapping information that maps a virtual address to a physical address of a memory page, wherein the entry comprises an encryption disabled indicator;
• requesting, by the OS kernel, encrypted kernel information from the memory page, the encrypted kernel information encrypted with a first key;
• reading, by the CPU in response to the requesting, the encrypted kernel information from the memory page, wherein the encryption disabled indicator causes the CPU to refrain from decrypting the encrypted kernel information using the first key when reading the encrypted kernel information from the memory page;
• computing, by the OS kernel, a reference measurement value based on the encrypted kernel information read by the CPU from the memory page without decryption using the first key;
• retrieving, by a scanner, the encrypted kernel information in a direct memory access (DMA) transfer, wherein the encrypted kernel information retrieved in the DMA transfer is not decrypted with the first key;
• and
• determining, by the scanner based on the reference measurement value and a measurement value calculated from the encrypted kernel information retrieved in the DMA transfer, whether an integrity violation of the encrypted kernel information has occurred.