Auditing a device
View Patent ↗The auditing of a device that includes a physical memory is disclosed. One or more hardware parameters that correspond to a hardware configuration is received. Initialization information is also received. The physical memory is selectively written in accordance with a function. The physical memory is selectively read and at least one result is determined. The result is provided to a verifier.
1. A system, comprising:
a physical memory; and
a hardware processor configured to:
receive one or more hardware parameters that correspond to a hardware configuration and receive initialization information, wherein the one or more hardware parameters include at least one of an amount and a speed of the physical memory;
selectively write to a set of cells of the physical memory in accordance with a function;
selectively read the physical memory and determine at least one result; and
provide the result to a verifier.
2. The system of claim 1 wherein the set of cells consists of even numbered dwords.
3. The system of claim 1 wherein the processor is further configured to classify the contents of at least a portion of the physical memory.
4. The system of claim 3 wherein the processor is configured to classify the contents at least in part by determining whether a segment is static or dynamic.
5. The system of claim 1 wherein the processor is configured to selectively write the set of cells based on instructions provided by the verifier.
6. The system of claim 5 wherein the instructions include an identifier of at least one application a static portion of which is to be used in the selective writing.
7. The system of claim 5 wherein the instructions include a seed value for a pseudorandom number generator.
8. The system of claim 1 wherein the processor is configured to selectively write at least in part by writing an executable portion of a kernel to a subset of the cells of the physical memory in accordance with the function.
9. The system of claim 1 wherein the processor is configured to selectively write at least in part by writing an executable portion of a known-to-the-verifier application to a subset of the cells of the physical memory in accordance with the function.
10. The system of claim 9 wherein the processor is configured to send the name of the application to the verifier.
11. The system of claim 9 wherein the processor is configured to receive at least one of a hash and a description of the application from the verifier.
12. The system of claim 1 wherein the processor is further configured to determine whether to copy contents of a portion of the physical memory to a secondary memory.
13. The system of claim 1 wherein the processor is further configured to determine whether to write an identifier associated with an application resident in the physical memory.
14. The system of claim 1 wherein the processor is further configured to determine whether to write state information associated with an application resident in the physical memory.
15. The system of claim 1 wherein the processor is configured to selectively read the physical memory based at least in part on a step value.
16. The system of claim 1 wherein the processor is configured to determine the result at least in part by using an accumulator.
17. The system of claim 1 wherein the processor is configured to read only one half or fewer of the cells of the physical memory.
18. The system of claim 1 wherein the processor is further configured to determine whether to allow an application to run based on a whitelist.
19. A method, comprising:
receiving one or more hardware parameters that correspond to a hardware configuration and receiving initialization information, wherein the one or more hardware parameters include at least one of an amount and a speed of a physical memory;
selectively writing to a set of cells of the physical memory in accordance with a function;
selectively reading a physical memory and determining at least one result; and
providing the result to a verifier.
20. A system, comprising:
a physical memory; and
a hardware processor configured to:
receive one or more hardware parameters that correspond to a hardware configuration, wherein the one or more hardware parameters include at least one of an amount and a speed of the physical memory;
perform a sequence of modifications to the physical memory;
provide results to a verifier; and
perform a scan once it is determined that no evasive software is active in the physical memory;
wherein the scan is performed based at least in part on one or more criteria received from the verifier.