Hewlett Packard Enterprise Development LP

Geoffrey Ndu

Nigel John Edwards

Ludovic Emmanuel Paul Noel Jacquin

Adrian Shaw

Dejan S Milojicic

Fraser John Dickin

Theofrastos Koulouris

Paolo Faraboschi

Pratyusa Kumar Manadhata

Chris I Dalton

Luis E Luciani, Jr

Stuart Haber

Sai Rahul Chalamalasetti

Brian Quentin Monahan

Christopher Ian Dalton

Christopher L Dalton

David Kimler Altobelli

Gustavo Knüppe

A process includes, responsive to a request to load a kernel module, determining, by an operating system kernel, a hash digest for the kernel module. The kernel module is associated with a name. The process includes determining, by the operating system kernel, whether an expected kernel module list contains an entry that contains the name and associates the name with the hash digest. The process includes, responsive to the determination of whether the expected kernel module list contains the entry, generating, by the operating system kernel, an alert that is associated with the kernel module.

Generating alerts for unexpected kernel modules

In some examples, a system executes a monitor separate from an operating system (OS) that uses mapping information in accessing data in a physical memory. The monitor identifies, using the mapping information, invariant information, that comprises program code, of the OS without suspending execution of the OS, the identifying comprising the monitor accessing the physical memory independently of the OS. The monitor determines, based on monitoring the invariant information of the OS, whether a security issue is present.

Monitoring operating system invariant information

A technique includes an operating system agent of a computer system monitoring a process to detect whether an integrity of the process has been compromised. The monitoring includes the operating system agent scanning a data structure. The process executes in a user space, and the data structure is part of an operating system kernel space. The technique includes a hardware controller of the computer system listening for a heartbeat that is generated by the operating system agent. The hardware controller takes a corrective action in response to at least one of the hardware controller detecting an interruption of the heartbeat, or the operating system agent communicating to the hardware controller a security alert for the process.

Memory scan-based process monitoring

Examples disclosed herein relate to integrity monitoring of a computing system using a kernel that can update its own code. Trust of state information is verified. Kernel code and module code are loaded into memory that is accessible to a device separate from a processor that loads the kernel code and module code. A measurement module is verified and loaded into memory. The state information can correspond to multiple symbols. The measurement module can measure the state information corresponding to each of the respective symbols to generate a set of initial measurements. The set of initial measurements can be provided to a device for integrity monitoring. The device is to compare a current measurement with an initial measurement to determine if a potential violation occurred. The device is to use a representation of a jump table to determine whether the potential violation is a violation.

Measuring integrity of computing system using jump table

Examples disclosed herein relate to performing a verification check in response to receiving notification. A computing system includes a host processor, memory coupled to the host processor, and a device separate from the host processor capable of accessing the memory. The host processor has a page table base register. The host processor is configured to send a notification to the device when the page table base register changes. The device performs a verification check in response to receiving the notification.

Perform verification check in response to change in page table base register

Examples disclosed herein relate to integrity monitoring of a computing system. Trust of state information is verified. Kernel code and module code are loaded into memory that is accessible to a device separate from a processor that loads the kernel code and module code. A measurement module is verified and loaded into memory. The state information can correspond to multiple symbols. The measurement module can measure the state information corresponding to each of the respective symbols to generate a set of initial measurements. The set of initial measurements can be provided to a device for integrity monitoring.

Measuring integrity of computing system

A method comprising: generating, with a device, a nonce; writing, with the device, the nonce to a memory location accessible to a kernel; initializing the kernel; in response to an end of initialization, measuring a specified kernel space to produce a first result; writing the first result to a register of a second device; writing a location and size of the specified kernel space to a buffer; measuring the buffer; writing a result of buffer measurement to a second register of the second device; requesting a quote from the second device, the quote to include the nonce, the contents of the register, and the contents of the second register; and passing the quote to the device.

Kernel space measurement

A system comprising an inner kernel of an operating system (OS) running at a higher privilege level than an outer kernel of the OS, the inner kernel to measure a data structure in a memory; a device including a measurement engine to measure the data structure in the memory, wherein the device operates independently of the OS; and a trusted execution environment including an application to compare measurements from the inner kernel and the measurement engine.

Data structure measurement comparison

In some examples, a control device includes a controller to receive, from a requester device that is separate from the control device, a request to access a first memory region of a memory. The controller is to determine, based on occurrence of a systems initialization event and according to permissions information that identifies access permissions for respective memory regions of the memory, whether access of content in the first memory region is allowed.

Access permissions for memory regions

Examples relate to Input/Output (I/O) data encryption and decryption. In an example, an encryption/decryption engine on an Integrated Circuit (IC) of a computing device obtains at least one plaintext data. Some examples determine, by the encryption/decryption engine, whether the at least one plaintext data is to be sent to a memory in the computing device or to an I/O device. Some examples apply, when the at least one plaintext data is to be sent to the I/O device and by the encryption/decryption engine, an encryption primitive of a block cipher encryption algorithm to the at least one plaintext data to create output encrypted data, wherein an initialization vector that comprises a random number is applied to the encryption primitive.

Growing community of inventors

Bristol, United Kingdom

Geoffrey Ndu