Preventing attacks on devices with multiple CPUs
View Patent ↗Disclosed are systems and methods to utilize two different processing units (e.g., CPUs) to monitor each other. The processing units may have limited visibility and/or read only access to each other to reduce the possibility that one affected processing unit could compromise the second processing unit. Devices containing multiple processing units of different architectures could be configured so that one type of processing unit monitors another type of processing unit. When the processing units are different architectures a single piece of malicious software (malware) is unlikely to affect both processing units. Each processing unit can be configured to detect rootkits and other types of malware on the other processor(s) of the system/device.
1. A non-transitory computer readable medium comprising computer executable instructions stored thereon to cause two or more processing units to:
interrogate, by a first processing unit, information associated with a second processing unit;
analyze, by the first processing unit, the information associated with the second processing unit to determine if an operating condition associated with the second processing unit indicates a first potential abnormality, the first potential abnormality comprising malicious code operable to attempt concealment from instructions executed by the second processing unit;
interrogate, by the second processing unit, information associated with the first processing unit; and
analyze, by the second processing unit, the information associated with the first processing unit to determine if an operating condition associated with the first processing unit indicates a second potential abnormality comprising malicious code operable to attempt concealment from instructions executed by the first processing unit.
2. The non-transitory computer readable medium of claim 1 further comprising instructions to cause at least one of the two or more processing units to perform a remedial action based on the determination.
3. The non-transitory computer readable medium of claim 1 wherein the instructions to cause the first processor to analyze the information associated with the second processing unit comprise instructions to cause the first processing unit to compare the information associated with the second processing unit with monitoring information.
4. The non-transitory computer readable medium of claim 3 wherein the monitoring information is accessible by the first processing unit and not accessible by the second processing unit.
5. The non-transitory computer readable medium of claim 1 wherein the first and second processing units have different architectures.
6. A mobile device comprising:
a first processing unit; and
a second processing unit, configured to monitor an operating environment associated with the first processing unit;
wherein, the second processing unit is configured to:
interrogate information associated with the first processing unit; and
analyze the information associated with the first processing unit to determine if an operating condition of the operating environment associated with the first processing unit indicates a first potential abnormality, the first potential abnormality comprising malicious code operable to attempt concealment from the operating environment associated with the first processing unit; and
wherein the first processing unit is configured to:
interrogate information associated with the second processing unit;
analyze the information associated with the second processing unit to determine if an operating condition of the operating environment associated with the second processing unit indicates a second potential abnormality, the second potential abnormality comprising malicious code operable to attempt concealment from the operating environment associated with the second processing unit.
7. The mobile device of claim 6 , wherein the second processing unit is further configured to perform a remedial action based on the determination that an operating condition of the operating environment associated with the first processing unit indicates the first potential abnormality.
8. The mobile device of claim 6 , further comprising a cellular communication interface, wherein the first processing unit is configured to support the cellular communication interface.
9. The mobile device of claim 6 , wherein the first processing unit is configured to support a user interface function.
10. The mobile device of claim 6 , wherein the first processing unit is configured to support a cellular communication interface and the second processing unit is configured to support a user interface function.
11. The mobile device of claim 6 , wherein the first processing unit and the second processing unit have different architectures.
12. The mobile device of claim 6 , wherein the second processing unit has access to monitoring information that is not accessible by the first processing unit.
13. The mobile device of claim 12 , wherein the second processing unit is configured to analyze the information associated with the first processing unit by comparing the information associated with the first processing unit to at least a portion of the monitoring information.
14. The mobile device of claim 6 , wherein the second processing unit has access to monitoring information that is accessible in read-only mode from the first processing unit.
15. A method of updating a mobile device, the mobile device comprising a first processing unit and a second processing unit, wherein the first processing unit is configured to monitor the second processing unit, the method comprising:
establishing a connection between a mobile device and an update server;
retrieving, from the update server, first code or monitoring information to be utilized by a first processing unit to monitor a second processing unit, wherein the first and second processing units are included in the mobile device;
retrieving, from the update server, second code or monitoring information to be utilized by the second processing unit to monitor the first processing unit;
performing an update process to store the first code or monitoring information to an area of memory accessible by the first processing unit and not accessible by the second processing unit;
performing an update process to store the second code or monitoring information to an area of memory accessible by the second processing unit and not accessible by the first processing unit,
wherein the first code or monitoring information to be utilized by the first processing unit to monitor the second processing unit comprises code or monitoring information to determine if an operating condition of the environment associated with the second processing unit indicates a first potential abnormality, the first potential abnormality comprising malicious code operable to attempt concealment from the operating system associated with the second processing unit; and
wherein the second code or monitoring information to be utilized by the second processing unit to monitor the first processing unit comprises code or monitoring information to determine if an operating condition of the environment associated with the first processing unit indicates a second potential abnormality, the second potential abnormality comprising malicious code operable to attempt concealment from the operating system associated with the first processing unit.
16. The method of claim 15 , wherein the first processing unit and the second processing unit have different architectures.
17. The method of claim 15 , wherein the area of memory accessible to the first processing unit comprises an area of memory utilized to store firmware code.
18. The method of claim 17 , wherein the area of memory accessible to the first processing unit further comprises an area of memory to store the monitoring information separate from the area of memory utilized to store firmware code.
19. The method of claim 15 , wherein only monitoring information is retrieved and updated on the mobile device.