Patent ID: 11948008
Assignee: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 10:
11. A non-transitory computer readable medium storing instructions that, when executed by a firmware controller of a computing device, cause the firmware controller to:
generate a set of cryptographic keys;
store the set of cryptographic keys in system management random access memory (SMRAM) of the computing device; and
in response to an interruption to normal operation of an operating system of the computing device, initiate a system management (SM) execution mode of the computing device;
during the SM execution mode,
retrieve a first cryptographic key from operating system memory of the computing device;
validate the first cryptographic key exists within the set of cryptographic keys;
scan memory of the computing device with an interrupt handler to detect a process pool tag;
generate a signature for the process pool tag that is detected;
compare the signature generated for the process pool tag to a set of signatures of known process pool tags, wherein a known process pool tag identifies a process implemented in normal operation of an operating system of the computing device;
detect a coherency discrepancy from comparing the signature generated for the process pool tag and the set of signatures of known process pool tags, wherein the coherency discrepancy indicates a presence of malware on the computing device;
store the coherency discrepancy in the memory for access by the operating system following exit from the SM execution mode; and
exit the SM execution mode.