Secure digital forensics
AssigneeMicrosoft Corporation
InventorsTodd L. Carpenter, William J. Westerinen
Life of this patent
Estimating the term…
Abstract
A security module is used to perform an audit of both a computer memory and the computer's processor status. The security module may assert itself as a bus master to read the computer memory without dependence on a program running on the computer. In addition, using a separate hardware path, the security module may access processor register data using a debug port. The security module may collect both memory and processor status information without the use of any of the computer resources being measured, avoiding either alteration of the data by the measurement tool or tampering with the data while being collected.
Claims17
A computer arranged and adapted for auditing comprising:
- a first processor including a first bus master interface;
- a system memory;
- a system bus coupling the first processor to the system memory;
- and
- a security module coupled to the system bus comprising:
- a second processor;
- a second bus master interface coupling the second processor to the system bus;
- a secure memory coupled to the second processor;
- a processor debug port interface on the security module;
- a signal connection independent of the system bus directly connecting the processor debug port interface on the security module and a processor debug port;
- and
- an interrupt switch that, when activated, causes the security module to read at least a program counter of the first processor.
A security module for use in capturing a state of operation of a computer comprising:
- a first processor;
- a bus master interface coupled to the first processor for interfacing to a system bus of the computer;
- a secure memory coupled to the first processor for storing image data captured via the bus master interface;
- and
- a debug port interface for directly connecting to a debug port of a system processor of the computer, wherein the first processor executes an interrupt service routine to capture processor status information responsive to an interrupt request and performs a forensic analysis of the image data and the processor status information to determine that unauthorized programs are not executing or participating in unlawful activity.
A method comprising:
- collecting memory data corresponding to a state of a computing device via a system bus of the computing device;
- activating an interrupt;
- responsive to the interrupt, sending a signal to a security module coupled to the system bus;
- responsive to the security module receiving the signal, accessing a system processor of the computing device via a signal connection between a processor debug port interface of the security module and a processor debug port of the system processor, wherein accessing the system processor is performed at least in part by a security module processor of the security module, and wherein the signal connection is independent of the system bus;
- downloading register data corresponding to the state of the computing device from the system processor to the security module via the signal connection;
- and
- utilizing the memory data and the register data to audit the state of the computing device.
Dependencies are inferred from the claim text.