Program execution integrity verification for a computer system
A computer system may be employed to verify program execution integrity by receiving a request to launch a program that has been instrumented to include at least one integrity marker, instantiating the program with an integrity marker value, and verifying the execution integrity of the program based on the integrity marker value and information received from the program during execution. A computer system may also be employed for program instrumentation by modifying the program to include at least one instruction for passing an integrity marker value to an operating system kernel during execution of the instruction.
1. A method of program instrumentation employing a computer system including at least one processor, the method comprising the computer system modifying a user-space program that is not part of an operating system kernel to include at least one instruction for passing an integrity marker value from the user-space program to the operating system kernel during execution of the at least one instruction;
the computer system modifying the user-space program to accept a random or pseudorandom number from the operating system kernel to use as the integrity marker value upon execution of the at least one instruction, the random or pseudorandom number being passed back to the operating system kernel during execution of the at least one instruction to verify program execution integrity; and
making the at least one instruction part of at least one system call included in the user-space program to request access to one or more resources of the computer system; wherein the at least one system call comprises a system call number that is modified to include the integrity marker value.
2. The method of claim 1 , wherein the modifying of the user-space program comprises modifying at least one existing instruction of the user-space program or adding at least one new instruction to the user-space program to pass the integrity marker value to the operating system kernel during execution of the at least one existing instruction or the at least one new instruction.
3. The method of claim 1 , wherein the one or more resources includes at least one of a CPU, a memory, and I/O devices, and wherein the requested access includes at least one of control of the CPU, control of the memory, and control of the I/O devices.
4. The method of claim 1 , wherein the making the at least one instruction part of the at least one system call includes making the at least one instruction part of every system call included in the user-space program.
5. An apparatus for program instrumentation, the apparatus comprising:
at least one processor configured to modify a user-space program that is not part of an operating system kernel to include at least one instruction for passing an integrity marker value from the user-space program to the operating system kernel during execution of the at least one instruction, to modify the user-space program to accept a random or pseudorandom number from the operating system kernel to use as the integrity marker value upon execution of the at least one instruction, the random or pseudorandom number being passed back to the operating system kernel during execution of the at least one instruction to verify program execution integrity;
and to make the at least one instruction part of at least one system call included in the user-space program to request access to one or more resources of the computer system; and at least one non-transitory storage medium coupled to the at least one processor and configured to store the user-space program; wherein the at least one system call comprises a system call number that is modified to include the integrity marker value.
6. The apparatus of claim 5 , wherein the modifying of the user-space program comprises modifying at least one existing instruction of the user-space program or adding at least one new instruction to the user-space program to pass the integrity marker value to the operating system kernel during execution of the at least one existing instruction or the at least one new instruction.
7. The apparatus of claim 5 , wherein the one or more resources includes at least one of a CPU, a memory, and I/O devices, and wherein the requested access includes at least one of control of the CPU, control of the memory, and control of the I/O devices.
8. The apparatus of claim 5 , wherein the at least one processor is configured to make the at least one instruction part of every system call included in the user-space program.