Malware-resistant computer system memory capture
There is provided a computer system of malware-resistant memory capture, comprising memory units operably connected to a first processor; secondary-storage-enabled memory units (SSEMUs) comprising a backup memory, being adapted to copy stored data to the comprised backup memory, and providing a data interface of reading from the backup memory; wherein the first processor and the one or more SSEMUs are configurable so that each SSEMU of the one or more SSEMUs at least partially mirrors a respective memory unit of the one or more memory units; and a memory controller (MC) operably connected to a control interface and the provided data interface of at least one SSEMU, and configured to signal, to the SSEMU, a control interface signal of copying of stored data to a comprised backup memory, and initiate reading of data from the comprised backup memory.
1 . A computer system of malware-resistant memory capture, the system comprising:
a) one or more memory units, each of the one or more memory units being operably connected to a first processor;
b) at least one secondary-storage-enabled memory unit (SSEMU), comprising:
i) a volatile random access main memory, and a first data interface of, at least, writing to the volatile random access memory,
ii) a backup memory, and a second data interface of, at least, reading from the backup memory,
the SSEMU being adapted to copy data stored in the comprised volatile random access main memory to the comprised backup memory, via a third data interface, responsive to, at least, a signal received on a control interface,
the first, second, and third data interfaces being distinct;
each SSEMU being operably connected to the first processor and configurable to store data from the first processor to the volatile random access main memory,
at least one SSEMU being adapted to copy comprised main memory data to the comprised backup memory responsive to a control interface signal comprising a low voltage on a dedicated bus pin,
thereby enabling a given SSEMU to conduct memory mirroring operations upon data of the first processor, concurrent with a manager or controller reading data from the backup memory of the given SSEMU; and
c) a memory controller (MC) operably connected to a respective control interface of at least one of the SSEMUs, the MC being configurable to:
signal, to a respective SSEMU, a control interface signal of copying of comprised main memory data to comprised backup memory, by setting the low voltage on the dedicated bus pin.
2 . The system of claim 1 , wherein the computer system is configurable to enable at least one SSEMU to at least partially mirror at least one of the memory units.
3 . The system of claim 1 , wherein the MC is configurable to perform the signaling responsive to an instruction from a manager that is operably connected to the MC via a network.
4 . The system of claim 1 , wherein the MC is configurable to initiate transfer of data from: the second data interface of a respective SSEMU to:
a forensic server,
thereby enabling transfer of SSEMU data to the manager, concurrent to SSEMU storing data from the first processor.
5 . The system of claim 1 , wherein the comprised backup memory of at least one of the SSEMUs is flash memory.
6 . The system of claim 1 , wherein the third data interface of at least one SSEMU utilizes at least one of: sideband signals, and an inter-integrated circuit interface.
7 . The system of claim 1 , wherein at least one SSEMU is a non-volatile Dual In-line Memory Module (NVDIMM).
8 . The system of claim 1 , wherein the second data interface of at least one SSEMU is a universal serial bus (USB) data interface.
9 . A processor-based method of malware-resistant memory capture, the method comprising:
a) providing one or more memory units, each of the one or more memory units being operably connected to a first processor;
b) providing at least one secondary-storage-enabled memory unit (SSEMU), comprising:
i) a volatile random access main memory, and a first data interface of, at least, writing to the volatile random access memory,
ii) a backup memory, and a second data interface of, at least, reading from the backup memory,
the SSEMU being adapted to copy data stored in the comprised volatile random access main memory to the comprised backup memory, responsive to, at least, a signal received on a control interface,
each SSEMU being operably connected to the first processor and configurable to store data from the first processor to the volatile random access main memory,
at least one SSEMU being adapted to copy comprised main memory data to the comprised backup memory responsive to a control interface signal comprising a low voltage on a dedicated bus pin,
thereby enabling a given SSEMU to conduct memory mirroring operations upon data of the first processor, concurrent with a manager or controller reading data from the backup memory of the given SSEMU; and
c) signaling, by a memory controller, to a respective SSEMU, a control interface signal of copying of comprised main memory data to comprised backup memory, by setting the low voltage on the dedicated bus pin.