Patent Description:
<CIT> is concerned with protecting a processing system from attackers using a hardware handler that implements a virtual machine manager (VMM) in a protected memory. The VMM is configured to monitor for one or more critical events in the secure processing apparatus and creates a break point on the critical events using a hardware virtual machine extension (VMX). The VMX isolates the operating system from the hardware and isolates an attacker.

In <CIT> an example system includes a main processor operable in a normal mode or a trusted mode, the main processor having an embedded diagnostic trusted code executable in the trusted mode; a secure memory accessible by the main processor when the main processor is in the trusted mode and inaccessible to the main processor when the main processor is in the normal mode, wherein execution of the embedded diagnostic trusted code causes the main processor to write diagnostic information to the secure memory; and a monitor processor having access to the secure memory to analyze the diagnostic information to determine a state of the main processor.

Further preferred embodiments may be derived from claims <NUM>-<NUM>.

Various features of certain examples will be apparent from the detailed description which follows, taken in conjunction with the accompanying drawings, which together illustrate, by way of example only, a number of features, and wherein:.

In the following description, for purposes of explanation, numerous specific details of certain examples are set forth. Reference in the specification to "an example" or similar language means that a particular feature, structure, or characteristic described in connection with the example is included in at least that one example, but not necessarily in other examples.

In an execution environment, such as a computing device or a virtual system, boot firmware, such as the Basic Input/Output System (BIOS) or Unified Extensible Firmware Interface (UEFI) compliant firmware, are used to test and initialise hardware components before transferring execution to an OS.

In a virtualised system, in which one or more virtual machines (VMs) may be instantiated over physical hardware, a hypervisor or virtual machine monitor (VMM) is used to apportion hardware access and present and manage the execution of an OS to VMs.

Arbitrary instructions executed in one of these low-level execution environments, which changes its original expected behaviour (such as skipping a verification step), can compromise subsequent parts of the system. Accordingly, tampering with these environments is appealing for attackers who may try to infect them with malware. Due to the nature of these environments and their early execution, such malware can become persistent, hard to detect and remove, and be independent of an OS.

On x86 instruction set systems (which are based on a family of backward-compatible instruction set architectures) for example, a highly privileged execution mode of the CPU, the System Management Mode (SMM), can modify the system flash which contains the boot firmware. Use of the SMM can prevent a compromised operating system infecting the system firmware.

More specifically, during an initial system boot process, and before executing the system OS, the boot firmware can load some instructions into so-called System Management RAM (SMRAM). These instructions correspond to privileged functions to be executed in SMM. The firmware can the lock the SMRAM and the flash (using hardware features) to prevent modification by the OS.

It is also possible to use cryptographic signatures during a boot process and an update process so that firmware signed by a vendor's key is executed. In addition, measurements (cryptographic hash) of components and configurations of the boot process can be computed and stored at boot time to attest to the integrity of the platform.

While cryptographic signatures and measurements provide instruction and data integrity at boot time, they may not preclude an attacker exploiting a vulnerability in the SMM, for example, at runtime of the system. Accordingly, if an attacker manages to execute malicious instructions in the SMM or another low-level execution environment, it can create malware that is undetectable to an OS.

According to an example, there is provided an intrusion detection system (IDS) to detect intrusions that modify the expected behaviour of a low-level execution environment at runtime. The IDS can be used to monitor the integrity of the SMM at runtime, and may be used to monitor a kernel or VMM or other low-level execution environment.

Part of the system uses a monitor to receive messages from a target forming a monitored component of a system. In an example, the monitor is isolated from the monitored component by using a co-processor, which is a structurally separate device. An IDS according to an example leverages a communication channel that enables the target to send information to bridge a semantic gap between the monitor and the target.

<FIG> is a schematic representation of an intrusion detection system according to an example. A monitor <NUM> can receive messages from a target <NUM> over a low-latency communication link <NUM>. In an example, monitor <NUM> can be a co-processor, and is a trusted component that is used to detect intrusions in the system. Any alteration to the normal behaviour of the host system does not affect the integrity of the monitor.

The isolation offered by the monitor <NUM> implies a loss in knowledge of the context in which instructions executed on the target <NUM>. Without the full context, there can be a semantic gap between what the target's actual behaviour is, and what the monitor <NUM> can infer. For example, there may be a shortfall of knowledge relating to a virtual to physical address mapping, or an execution path taken. According to an example, the communication channel <NUM> between the monitor <NUM> and the target <NUM> enables the target <NUM> to send information to the monitor <NUM> in order to narrow the semantic gap for the monitor <NUM>.

According to an example, the following properties are presented:.

According to an example, communication from the target <NUM> to the monitor <NUM> can be enabled using an instrumentation step during compilation of the instructions to be executed on the low-level execution environment under consideration (i.e. the target). Such instrumentation can, for example, operate at the compiler level or by rewriting binary if it does not have access to a set of source instructions.

According to an example, instrumentation can fetch information at runtime from the target at a location known at compile time. Control flow integrity (CFI) is an example of such instrumentation where the compiler can instrument binary instructions without recourse to a developer. A further instrumentation according to an example can be an ad hoc approach that uses manual modification of source instructions of the target or that can provide other information such as annotations. For example, x86 control registers, like CR3, can change the behaviour of a system if an attacker can modify their value. The expected value of the registers is known, as is the case when a modification is legitimate. Thus, an instrumented portion of instructions can be used to send the value of these registers to the monitor.

<FIG> is a schematic representation of an intrusion detection system according to an example. Monitor <NUM> can receive messages <NUM>, <NUM>,. and so on from a target <NUM> over a low-latency communication link <NUM>.

According to an example, monitor <NUM> can be a co-processor that can be used as security processor to perform sensitive tasks and handle sensitive data (e.g., cryptographic keys). The main processor of a system does not directly access the security processor memory. Thus, it cannot access sensitive data, but can query the co-processor to perform tasks via a communication channel.

The latency of a communication channel, link or pathway can impact the latency of System Management Interrupt (SMI) handlers for each message sent from a target to the monitor. An acceptable latency can be of the order of <NUM>. Fast and frequent SMIs cause a degradation of performance (I/O throughput or CPU time). On the other hand, long and infrequent SMIs cause a user experience degradation, where audio playback using a USB device is considered unresponsive by the driver, and a severe drop in frame rates in game engines can occur for example.

Therefore, according to an example, a controlled access memory structure <NUM> can be logically positioned between the target and the monitor using point-to-point interconnects in order to enable a low-latency communication path between a target and monitor. In an example, the memory structure may form part of the target, part of the monitor or be a separate component so that a co-processor can be used as monitor without modification. In this connection therefore, logical positioning refers to the memory structure being configured to receive data from a target and send data to (or have the data pulled from) a monitor and does not preclude the structure from being formed within or as part of a target or monitor or being a separate component in a system. Other components may physically lie in between a target and monitor.

In an example, the memory structure can use a restricted access First In First Out (FIFO) queue that allows the target to push and the monitor to pop messages. In an example, the FIFO can receive messages fragmented in packets. The FIFO can store messages sent by the target that are awaiting processing by the monitor.

In an example, the memory structure <NUM> can handle a write pointer. Thus, an attacker does not control it and does not have access to its memory and cannot therefore violate the integrity of the messages. The monitored component (target) <NUM> has a mapping between a physical address and the memory structure <NUM>. At the beginning of each SMI, the target <NUM> or the monitor <NUM> can ensure that the target has a mapping to communicate with the monitor in order to avoid other devices communicating with it while in SMM and to avoid remapping attacks. A system as depicted in <FIG> fulfils the data integrity property mentioned above since the target does not have direct access to the monitor memory, it can push messages and if the queue is full it does not wrap over. It fulfils the chronological order property because there is no concurrent access to it while in SMM. Moreover, it fulfils the exclusive access property since one core is active while in SMM and no other device can communicate with the monitor. Finally, for the last property regarding the low latency, a fast interconnect, such as a point-to-point interconnect, between the main processor executing the monitored component and the monitor can be used. The interconnect used depends on the CPU manufacturer. In x86 architectures, for example, a QuickPath (QPI) or HyperTransport interconnect can be used. These interconnects are used for inter-core or inter-processor communication and are specifically designed for low latency.

Referring to <FIG>, instructions executing in the firmware <NUM> of a target <NUM> are pushed as packets <NUM>, <NUM> to the memory structure <NUM> of the monitor <NUM>. Monitor <NUM> can fetch messages from the structure <NUM> at block <NUM>. Initially, the memory structure <NUM> can receive a message from the target <NUM> indicating that the target <NUM> has entered or is in a controlled mode of operation, such as SMM for example. That is, in order for the monitor <NUM> to ensure that when the target <NUM> is executing, it has exclusive access to the communication link <NUM>, the target <NUM> can use an extra signal to notify the monitor <NUM> that it has entered the execution mode for the low-level instructions. For example, with ARM TrustZone the Non-Secure bit (NS-bit) can be used to differentiate whether the processor is currently executing low-level instructions in a secure space or not. On an x86 architecture, the monitor <NUM> can also determine when the processor is executing in SMM by using a signal available at the chipset level. Additionally, any logical signalling that can be trusted by the monitor (such as by using virtual wires, cryptographically authenticated signals, etc.) can be used to notify the monitor of the execution of the low-level instructions.

Thus, a data integrity property is respected since the target <NUM> does not have direct access to the monitor memory structure <NUM>. It can push messages and if the queue is full it does not wrap over. In an example, structure <NUM> can fulfil the chronological order property because it is in the form of a FIFO queue and there is no concurrent access to it while the target is executing. The queue can be in the form of a linear or circular array in which messages are processed in the order in which they are received.

Messages fetched from memory structure <NUM> are processed by the monitor to determine if there is any deviation from an expected behaviour at the target <NUM>. For example, the messages can be compared with a list, map or graph of expected behaviour to determine the presence of deviations (<NUM>) in indirect calls handling (<NUM>), shadow stack calls (<NUM>) and other suitable behaviours (<NUM>).

According to an example, target <NUM> can be a hypervisor of a virtualised system or a kernel of an OS. Monitor <NUM> can be virtual machine. For example, a virtual machine can be instantiated over physical hardware allocated in a virtualised system using a hypervisor forming the monitored component. The virtual machine can comprise a secure execution environment inaccessible to other components of the virtualised system.

Examples in the present disclosure can be provided as methods, systems or machine-readable instructions, such as any combination of software, hardware, firmware or the like. Such machine-readable instructions may be included on a computer readable storage medium (including but not limited to disc storage, CD-ROM, optical storage, etc.) having computer readable program codes therein or thereon.

The present disclosure is described with reference to flow charts and/or block diagrams of the method, devices and systems according to examples of the present disclosure. Although the flow diagrams described above may show a specific order of execution, the order of execution may differ from that which is depicted. Blocks described in relation to one flow chart may be combined with those of another flow chart. In some examples, some blocks of the flow diagrams may not be necessary and/or additional blocks may be added. It shall be understood that each flow and/or block in the flow charts and/or block diagrams, as well as combinations of the flows and/or diagrams in the flow charts and/or block diagrams can be realized by machine readable instructions.

The machine-readable instructions may, for example, be executed by a general-purpose computer, a special purpose computer, an embedded processor or processors of other programmable data processing devices to realize the functions described in the description and diagrams. In particular, a processor or processing apparatus may execute the machine-readable instructions. Thus, modules of apparatus (for example, monitor <NUM>) may be implemented by a processor executing machine readable instructions stored in a memory, or a processor operating in accordance with instructions embedded in logic circuitry. The term 'processor' is to be interpreted broadly to include a CPU, processing unit, ASIC, logic unit, or programmable gate set etc. The methods and modules may all be performed by a single processor or divided amongst several processors.

Such machine-readable instructions may also be stored in a computer readable storage that can guide the computer or other programmable data processing devices to operate in a specific mode.

For example, the instructions may be provided on a non-transitory computer readable storage medium encoded with instructions, executable by a processor.

<FIG> shows an example of a processor <NUM> associated with a memory <NUM>. The memory <NUM> comprises computer readable instructions <NUM> which are executable by the processor <NUM>. The instructions <NUM> comprise:.

<FIG> is a flow chart of a series of instructions according to an example. At bock <NUM>, a message is received at a monitor from a target indicating that the target has entered a controlled mode of operation. At block <NUM>, messages received at a monitor from a target over a low-latency communication link comprising a controlled access memory structure logically positioned between the target and the monitor using point-to-point interconnects are processed.

Such machine-readable instructions may also be loaded onto a computer or other programmable data processing devices, so that the computer or other programmable data processing devices perform a series of operations to produce computer-implemented processing, thus the instructions executed on the computer or other programmable devices provide an operation for realizing functions specified by flow(s) in the flow charts and/or block(s) in the block diagrams.

Further, the teachings herein may be implemented in the form of a computer software product, the computer software product being stored in a storage medium and comprising a plurality of instructions for making a computer device implement the methods recited in the examples of the present disclosure.

A feature or block from one example may be combined with or substituted by a feature/block of another example.

The word "comprising" does not exclude the presence of elements other than those listed in a claim, "a" or "an" does not exclude a plurality, and a single processor or other unit may fulfil the functions of several units recited in the claims.

Claim 1:
An intrusion detection system, comprising:
a target (<NUM>, <NUM>);
a monitor (<NUM>, <NUM>); and
a communication link (<NUM>, <NUM>) comprising a controlled access memory structure (<NUM>) logically positioned between the target and the monitor using point-to-point interconnects;
the monitor arranged to process messages (<NUM>, <NUM>) received from the target (<NUM>, <NUM>) over the communication link (<NUM>, <NUM>), the monitor arranged to process a message from the target indicating that the target has entered a controlled mode of operation,
wherein the target has exclusive access to the communication link, such that no other device can communicate with the monitor, when the target is executing in the controlled mode of operation,
wherein the monitor (<NUM>, <NUM>) is arranged to compare the messages (<NUM>, <NUM>) received from the controlled access memory structure to information of an expected behaviour of the target to detect a deviation from the expected behaviour, the deviation being indicative of an intrusion.