Method and device for monitoring data integrity in shared memory environment

Provided is a method of memory access for a memory controller in an integrity monitoring system sharing memory with a host system. The memory access method may include: receiving a memory access command from a local processor of the integrity monitoring system; accessing a system memory of the host system according to the memory access command; receiving data corresponding to the memory access command from the host system; and forwarding the received data to the local processor, wherein the system memory includes a secure area, access to which is allowed when the memory controller receives a memory access command from the local processor. In a feature of the present invention, there are provided a method and apparatus that can monitor integrity of data processed in the host system in a SoC environment.

TECHNICAL FIELD

The present invention relates to a snooper-based kernel integrity monitoring apparatus and control method therefor. More particularly, the present invention relates to an integrity monitoring apparatus sharing a memory with the main system in a system on chip (SoC) environment and a control method therefor.

BACKGROUND ART

As the number of devices using a system on chip (SoC) increases, it has become necessary to monitor attacks from malicious software during data processing in SoC environments. Particularly in a SoC environment, to examine integrity of processed data and to effectively block attacks from malicious software, it is necessary to efficiently monitor attacks on the operating system (OS) kernel. However, using separate monitoring mechanisms entails addition of a processor and memory unit, causing an increase in the SoC chip area. This may result in an increase in manufacturing costs and power consumption during operation.

DISCLOSURE OF INVENTION

Technical Problem

The present invention has been made in view of the above problems. Accordingly, an aspect of the present invention is to provide an apparatus that can monitor attacks from malicious programs, detect a violation of data integrity, and perform a corresponding response action in a SoC environment, and a control method therefor.

Another aspect of the present invention is to provide a monitoring apparatus that shares a memory with the host system to monitor data integrity in a SoC environment in such a manner as to reduce the system area and power consumption, and a control method therefor.

Solution to Problem

In accordance with an aspect of the present invention, there is provided a method of memory access for a memory controller in an integrity monitoring system sharing memory with a host system. The memory access method may include: receiving a memory access command from a local processor of the integrity monitoring system; accessing a system memory of the host system according to the memory access command; receiving data corresponding to the memory access command from the host system; and forwarding the received data to the local processor. Here, the system memory may include a secure area, access to which is allowed when the memory controller receives a memory access command from the local processor.

In accordance with another aspect of the present invention, there is provided an apparatus for an integrity monitoring system sharing memory with a host system. The apparatus may include: a local processor to control operation of the integrity monitoring system; and a memory controller to perform a process of receiving a memory access command from the local processor, accessing a system memory of the host system according to the memory access command, receiving data corresponding to the memory access command from the host system, and forwarding the received data to the local processor, wherein the system memory includes a secure area, access to which is allowed when the memory controller receives a memory access command from the local processor.

Advantageous Effects of Invention

In a feature of the present invention, there are provided a method and apparatus that can monitor integrity of data processed in the host system in a SoC environment.

In another feature of the present invention, there is provided a method that enables an apparatus monitoring data integrity in the host system to share a memory with the host system in such a manner as to efficiently use the system area and reduce power consumption.

In another feature of the present invention, the integrity monitoring apparatus is equipped with a controller for memory read and write for memory sharing with the host system, heightening monitoring reliability.

MODE FOR THE INVENTION

Detailed descriptions of well-known functions and structures incorporated herein may be omitted to avoid obscuring the subject matter of the present invention.

In the drawings, some elements are exaggerated, omitted, or only outlined in brief, and thus may be not drawn to scale. The same or similar reference symbols are used throughout the drawings to refer to the same or like parts.

The aspects, features and advantages of certain embodiments of the present invention will be more apparent from the following detailed description taken in conjunction with the accompanying drawings. The description of the various embodiments is to be construed as exemplary only and does not describe every possible instance of the present invention. It should be apparent to those skilled in the art that the following description of various embodiments of the present invention is provided for illustration purpose only and not for the purpose of limiting the present invention as defined by the appended claims and their equivalents. The same reference symbols are used throughout the description to refer to the same parts.

Next, a description is given of a method and apparatus for monitoring data integrity in a shared memory environment as embodiments of the present invention with reference to the drawings.

Meanwhile, it is known to those skilled in the art that blocks of a flowchart (or sequence diagram) and a combination of flowcharts may be represented and executed by computer program instructions. These computer program instructions may be loaded on a processor of a general purpose computer, special purpose computer or programmable data processing equipment. When the loaded program instructions are executed by the processor, they create a means for carrying out functions described in the flowchart. As the computer program instructions may be stored in a computer readable memory that is usable in a specialized computer or a programmable data processing equipment, it is also possible to create articles of manufacture that carry out functions described in the flowchart. As the computer program instructions may be loaded on a computer or a programmable data processing equipment, when executed as processes, they may carry out steps of functions described in the flowchart.

A block of a flowchart may correspond to a module, a segment or a code containing one or more executable instructions implementing one or more logical functions, or to a part thereof. In some cases, functions described by blocks may be executed in an order different from the listed order. For example, two blocks listed in sequence may be executed at the same time or executed in reverse order.

In the description, the word “unit”, “module” or the like may refer to a software component or hardware component such as an FPGA or ASIC capable of carrying out a function or an operation. However, “unit” or the like is not limited to hardware or software. A unit or the like may be configured so as to reside in an addressable storage medium or to drive one or more processors. Units or the like may refer to software components, object-oriented software components, class components, task components, processes, functions, attributes, procedures, subroutines, program code segments, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays or variables. A function provided by a component and unit may be a combination of smaller components and units, and may be combined with others to compose large components and units. Components and units may be configured to drive a device or one or more processors in a secure multimedia card.

FIG. 1is a block diagram of the system according to an embodiment of the present invention.

Referring toFIG. 1, the system of the present invention may include a host system150to perform computation and transceive signals, and an integrity monitoring system100to monitor integrity of signals transceived by the host system150.

The integrity monitoring system100and the host system150may be implemented together on the same chip or may be interconnected through a separate connection structure according to embodiments.

In one embodiment, the integrity monitoring system100may include one or more of a snooper105, a verification unit110, a local bus115, a local memory120, a local processor125, and a local bridge130.

The snooper105may be connected with a system bus165, and may monitor data passing through the system bus165by use of snooping.

The verification unit110may verify traffic snooped by the snooper105to detect a breach of integrity owing to an attack from malicious software or the like. The verification unit110may use the local bus115to send and receive data to and from other components of the integrity monitoring system100.

The local memory120may store data needed for operation of the integrity monitoring system100and integrity check results. The local memory120may use the local bus115to send and receive data to and from other components of the integrity monitoring system100.

The local processor125may act as a controller controlling the overall operation of the integrity monitoring system100. The local processor125may use the local bus115to send and receive data to and from other components of the integrity monitoring system100.

The local bridge130may use the local bus115to send and receive data to and from other components of the integrity monitoring system100, and may act as a connection interface to exchange signals with an external system. In particular, the local bridge130may be connected with a system bridge170of the host system150for signal exchange.

The host system150may include one or more of a system memory155, a system processor160, a system bus165, and a system bridge170.

The system memory155may store data needed for operation of the host system150, and the stored data may be read under the control of the system processor160. The system memory155may use the system bus165to send and receive data to and from other components of the host system150.

The system processor160may act as a controller controlling the overall operation of the host system150. The system processor160may use the system bus165to send and receive data to and from other components of the host system150.

The system bridge170may use the system bus165to send and receive data to and from other components of the host system150, and may act as a connection interface to exchange signals with an external system. In particular, the system bridge170may be connected with the local bridge130of the integrity monitoring system100for signal exchange.

In one embodiment, the integrity monitoring system100may monitor traffic generated by the host system150to examine integrity of data in the traffic. Specifically, the integrity monitoring system100may monitor traffic on the system bus165of the host system150by use of the snooper105. The snooper105may monitor traffic passing through the system bus165by use of snooping.

When a violation of integrity is detected in traffic data, the integrity monitoring system100may notify the host system150of the integrity violation. Specifically, the integrity monitoring system100may notify the system processor160of the integrity violation via the local bridge130and the system bridge170. In response, the system processor160may handle (e.g. reprocess) the data whose integrity is violated. As such, the integrity monitoring system100monitoring integrity of traffic on the system bus165may increase operational reliability.

Here, the local bridge130may be optional, and the system bridge170may be directly connected with the local bus115.

FIG. 2is a block diagram of the system according to another embodiment of the present invention.

Referring toFIG. 2, the integrity monitoring system200and the host system250may be implemented together on the same chip or may be interconnected through a separate connection structure according to embodiments. In the embodiment ofFIG. 2, the integrity monitoring system200shares a region of the system memory255of the host system250, and may further include a memory controller220for such memory sharing.

In one embodiment, the integrity monitoring system200may include one or more of a snooper205, a verification unit210, a local bus215, a memory controller220, and a local processor225.

The host system250may include one or more of a system memory255, a system processor260, a system bus265, and a system bridge270.

The snooper205may be connected with the system bus265, and may monitor data passing through the system bus265by use of snooping.

The verification unit210may verify traffic snooped by the snooper205to detect a breach of integrity owing to an attack from malicious software or the like. The verification unit210may use the local bus215to send and receive data to and from other components of the integrity monitoring system200.

The memory controller220is a module enabling the integrity monitoring system200to share the system memory255of the host system250. Specifically, the memory controller220may access the system memory255for read and write according to control signals from the local processor225and the system processor260. The memory controller220may be connected with one or more of the local bus215, the local processor225, the system memory255, and the system bus265. One or more of the connections may be optional. The memory controller220and connections thereof are described in more detail later.

The local processor225may act as a controller controlling the overall operation of the integrity monitoring system200. The local processor225may use the local bus215to send and receive data to and from other components of the integrity monitoring system200. The local processor225may control the memory controller220to read data stored in the system memory255. Specifically, the memory controller220may read data stored in the system memory255and forward the data to the local processor225via the system bus265, the system bridge270and the local bus215. Here, the system bridge270may be an optional element. In another embodiment, a local bridge may be added between the local bus215and the system bridge270.

The host system250may include one or more of a system memory255, a system processor260, a system bus265, and a system bridge270.

The system memory255may include a secure area257and a system area259, and each of the secure area257and the system area259may store programs and/or data.

The secure area257may store programs and/or data related to the integrity monitoring system200. The system memory255may be accessed through the memory controller220, and the secure area257may be accessed through the memory controller220only in relation to operations of the integrity monitoring system200. This may ensure kernel independence of the integrity monitoring system200in a shared memory environment.

The system area259may be accessed by the host system250through the memory controller220. The system area259may store programs and/or data related to the host system250. When the memory controller220accesses the system memory255in response to a request from the host system250, it is not allowed to access the secure area257, ensuring kernel independence.

The local processor225may access the secure area257for setting and modification only through the memory controller220, and the system processor260is not allowed to access the secure area257.

In another embodiment, the snooper205may investigate information of the system bus265. The verification unit210may store the address of the secure area257. When an attack on the secure area257is detected, the verification unit210may request the local processor225to analyze the attack and notify the system processor260of the analysis result.

In another embodiment, the system processor260may allocate the secure area257to the integrity monitoring system200, and the roles of the memory controller220, the verification unit210and the local processor225may be determined according to the allocation information.

The system processor260may act as a controller controlling the overall operation of the host system250. The system processor260may use the system bus265to send and receive data to and from other components of the host system250. In one embodiment, the system processor260may control the overall operation of the host system250except for the secure area257.

The system bridge270may use the system bus265to send and receive data to and from other components of the host system250, and may act as a connection interface to exchange signals with an external system. In particular, the system bridge170may be connected with the integrity monitoring system200for signal exchange.

In one embodiment, the integrity monitoring system200may monitor traffic generated by the host system250to examine integrity of data in the traffic. Specifically, the integrity monitoring system200may monitor traffic on the system bus265of the host system250by use of the snooper205. The snooper205may monitor traffic passing through the system bus265by use of snooping.

When a violation of integrity is detected in traffic data, the integrity monitoring system200may notify the host system250of the integrity violation. As such, the integrity monitoring system200monitoring integrity of traffic on the system bus265may increase operational reliability. The configuration and connections of the memory controller220are described in more detail later.

Although the memory controller220is described as belonging to the integrity monitoring system200, it may belong to the host system250according to embodiments.

In one embodiment, the integrity monitoring system200may be connected with the host system250for operation. In this case, the integrity monitoring system200may control the system memory255so that the system memory255and the system bus265are not connected.

FIG. 3A to 3Cillustrate connections of the memory controller according to various embodiments of the present invention.

Referring toFIG. 3A, the memory controller305of the integrity monitoring system may include a memory accessor310and a configurator315.

The memory accessor310may be connected with the system memory and the system bus. According to a control command input to the configurator315, the memory accessor310may access the system memory for read or write operation. The memory accessor310may receive a program and/or data from the system bus and write the same to the system memory, or may read a program and/or data from the system memory and send the same to the system bus.

The configurator315may control the operation of the memory accessor310on the basis of a received control command. In one embodiment, the configurator315may be connected with the local bus of the integrity monitoring system. A control command may be received from the local processor of the integrity monitoring system. Such a control command may be received via the local bus. Specifically, when a read or write command is received via the system bus from the system processor of the host system, the memory accessor310may be controlled so as to access the system area of the system memory. When an access command is received from the local processor of the integrity monitoring system, the configurator315may control the memory accessor310to access the secure area of the system memory on the basis of the access command. A message input to the configurator315may be received via the local bus.

Referring toFIG. 3B, the memory controller305of the integrity monitoring system may include a memory accessor310and a configurator315.

The memory accessor310may be connected with the system memory and the system bus. According to a control command input to the configurator315, the memory accessor310may access the system memory for read or write operation. The memory accessor310may receive a program and/or data from the system bus and write the same to the system memory, or may read a program and/or data from the system memory and send the same to the system bus.

The configurator315may control the operation of the memory accessor310on the basis of a received control command. In one embodiment, the configurator315may be connected with the local processor of the integrity monitoring system. A control command may be received from the local processor of the integrity monitoring system. Specifically, when a read or write command is received via the system bus from the system processor of the host system, the memory accessor310may be controlled so as to access the system area of the system memory. When an access command is received from the local processor of the integrity monitoring system, the configurator315may control the memory accessor310to access the secure area of the system memory on the basis of the access command. A message input to the configurator315may be received via the local bus.

Referring toFIG. 3C, the memory controller305of the integrity monitoring system may include a memory accessor310and a configurator315.

The memory accessor310may be connected with the system memory and the system bus. According to a control command input to the configurator315, the memory accessor310may access the system memory for read or write operation. The memory accessor310may receive a program and/or data from the system bus and write the same to the system memory, or may read a program and/or data from the system memory and send the same to the system bus.

The configurator315may control the operation of the memory accessor310on the basis of a received control command. In one embodiment, the configurator315may be connected with the system bus of the host system. Specifically, the local processor may be connected with the system bus via the local bus, and may send a control command to the configurator315via the system bus. A control command may be received from the local processor of the integrity monitoring system. Specifically, when a read or write command is received via the system bus from the system processor of the host system, the memory accessor310may be controlled so as to access the system area of the system memory. When an access command is received from the local processor of the integrity monitoring system, the configurator315may control the memory accessor310to access the secure area of the system memory on the basis of the access command. A message input to the configurator315may be received via the local bus.

In one embodiment, the configurator315may determine the scheme whereby the memory accessor310is connected to the system memory according to a control command from the local processor. Only the integrity monitoring system is allowed to access the secure area of the system memory while preventing other devices from accessing the secure area, ensuring independence of the integrity monitoring system.

FIG. 4A to 4Cillustrate a flow of signals between components according to various embodiments of the present invention. Here, signals may be sent and received between one or more entities among the local processor401, the local bus402, the memory controller403, the system memory404, and the system bus405. The following description focuses on the signal flow for a read command. However, a write command may also be processed in a similar manner.

FIG. 4Aillustrates signal transmission and reception for the system configuration depicted inFIG. 3A.

Referring toFIG. 4A, at step410, the local processor401sends a memory read command to the local bus402.

At step412, the local bus402forwards the memory read command to the memory controller403.

At step414, the memory controller403sends a memory read request for the area corresponding to the received memory read command to the system memory404. Here, the area corresponding to the memory read command may be the secure area of the system memory404, which is accessible to the local processor401. Access to the secure area is allowed according to a read command from the local processor401under the control of the memory controller403.

At step416, the system memory404sends stored data corresponding to the memory read request to the memory controller403.

At step418, the memory controller403forwards the received data to the system bus405.

At step420, the system bus405forwards the received data to the local bus402.

At step422, the local bus402forwards the received data to the local processor401.

As such, the local processor401may access a corresponding area of the system memory404shared with the host system under the control of the memory controller403, ensuring independence of the integrity monitoring system.

FIG. 4Billustrates signal transmission and reception for the system configuration depicted inFIG. 3B.

Referring toFIG. 4B, at step430, the local processor401issues a memory read command to the memory controller403.

At step432, the memory controller403sends a memory read request for the area corresponding to the received memory read command to the system memory404. Here, the area corresponding to the memory read command may be the secure area of the system memory404, which is accessible to the local processor401. Access to the secure area is allowed according to a read command from the local processor401under the control of the memory controller403.

At step434, the system memory404sends stored data corresponding to the memory read request to the memory controller403.

At step436, the memory controller403forwards the received data to the system bus405.

At step438, the system bus405forwards the received data to the local bus402.

At step440, the local bus402forwards the received data to the local processor401.

As such, the local processor401may access a corresponding area of the system memory404shared with the host system under the control of the memory controller403, ensuring independence of the integrity monitoring system. In the present embodiment, the direct connection between the local processor401and the memory controller403may contribute to more rapid processing.

FIG. 4Cillustrates signal transmission and reception for the system configuration depicted inFIG. 3C.

Referring toFIG. 4C, at step450, the local processor401sends a memory read command to the local bus402.

At step452, the local bus402forwards the memory read command to the system bus405.

At step454, the system bus405forwards the memory read command to the memory controller403.

At step456, the memory controller403sends a memory read request for the area corresponding to the received memory read command to the system memory404. Here, the area corresponding to the memory read command may be the secure area of the system memory404, which is accessible to the local processor401. Access to the secure area is allowed according to a read command from the local processor401under the control of the memory controller403.

At step458, the system memory404sends stored data corresponding to the memory read request to the memory controller403.

At step460, the memory controller403forwards the received data to the system bus405.

At step462, the system bus405forwards the received data to the local bus402.

At step464, the local bus402forwards the received data to the local processor401.

As such, the local processor401may access a corresponding area of the system memory404shared with the host system under the control of the memory controller403, ensuring independence of the integrity monitoring system. In the present embodiment, the system bus405is used to send a memory read command to the memory controller403. That is, it is possible to deliver a control command without a direct command interface between the local processor401and the memory controller403. Accordingly, when the memory controller403is placed in the host system, the procedure ofFIG. 4Cmay be utilized.

Hereinabove, exemplary embodiments of the present invention have been described with reference to the accompanying drawings. Specific terms or words used in the description should be construed in accordance with the spirit of the present invention without limiting the subject matter thereof. It should be understood that many variations and modifications of the basic inventive concept described herein will still fall within the spirit and scope of the present invention as defined in the appended claims and their equivalents.