Rapid verification of executing processes
Rapid verification of executing processes includes receiving a seed from a verification unit. A checksum is generated at least in part by using a processor. The processor is coupled to a hierarchical memory, the hierarchical memory comprising an instruction cache, a data cache, and a shared memory accessible by both the instruction cache and the data cache. The shared memory is configured to store an executing program. A size of at least one of the instruction cache and the data cache is insufficient to store the entire executing program. The checksum is transmitted to the verification unit.
1. A system, comprising:
a verification unit;
a hierarchical memory comprising an instruction cache, a data cache, and a shared memory accessible by both the instruction cache and the data cache, wherein the shared memory is configured to store an executing program, and wherein the executing program is written to be larger than at least one of the instruction cache and the data cache; and
a processor coupled to the hierarchical memory and configured to:
receive, from the verification unit, a seed and at least one of a hop length and an initialized value for a register, wherein the hop length comprises a distance between two consecutive data reads;
based at least in part on the seed and the at least one of the hop length and the initialized value for the register, generate a checksum; and
transmit the checksum to the verification unit.
2. The system recited in claim 1 , wherein the checksum is generated based at least in part on contents of at least one of a data pointer, program counter, and the register.
3. The system of claim 1 , wherein generating the checksum includes selecting a portion of the executing program to execute based at least in part on performing a jump to a location that is determined based at least in part on a state of the checksum.
4. The system recited in claim 1 , wherein at least two checksums are computed, wherein the verification unit is configured to generate security determinations for the at least two checksums, and wherein the verification unit is further configured to generate a combined security determination based on the at least two security determinations.
5. The system recited in claim 1 , wherein the shared memory comprises a shared L2 cache that is shared between the instruction cache and the data cache.
6. The system recited in claim 1 , wherein the executing program fits, in its entirety, within the shared memory.
7. The system recited in claim 6 , wherein the executing program is greater than half of a size of the shared memory.
8. The system recited in claim 1 , wherein the verification unit is configured to:
determine an elapsed time between sending the seed and receiving the checksum; and
in response to determining that the elapsed time exceeds a threshold, generate a security determination indicating an attack.
9. The system of claim 1 , further comprising a second memory unit, wherein the instruction cache and the data cache are faster than the shared memory, and wherein the shared memory is faster than the second memory unit.
10. The system of claim 9 , wherein the second memory unit comprises Dynamic Random-Access Memory (DRAM).
11. A method, comprising:
receiving, from a verification unit, a seed and at least one of a hop length and an initialized value for a register, wherein the hop length comprises a distance between two consecutive data reads;
based at least in part on the seed and the at least one of the hop length and the initialized value for the register, generating, at least in part by using a processor, a checksum, wherein the processor is coupled to a hierarchical memory, the hierarchical memory comprising an instruction cache, a data cache, and a shared memory accessible by both the instruction cache and the data cache, wherein the shared memory is configured to store an executing program, and wherein the executing program is written to be larger than at least one of the instruction cache and the data cache; and
transmitting the checksum to the verification unit.
12. The method of claim 11 , wherein the checksum is generated based at least in part on contents of at least one of a data pointer, program counter, and the register.
13. The method of claim 11 , wherein generating the checksum includes selecting a portion of the executing program to execute based at least in part on performing a jump to a location that is determined based at least in part on a state of the checksum.
14. The method of claim 11 , wherein at least two checksums are computed, wherein the verification unit is configured to generate security determinations for the at least two checksums, and wherein the verification unit is further configured to generate a combined security determination based on the at least two security determinations.
15. The method of claim 11 , wherein the shared memory comprises a shared L2 cache that is shared between the instruction cache and the data cache.
16. The method of claim 11 , wherein the executing program fits, in its entirety, within the shared memory.
17. The method of claim 16 , wherein the executing program is greater than half of a size of the shared memory.
18. The method of claim 11 , wherein the verification unit is configured to:
determine an elapsed time between sending the seed and receiving the checksum; and
in response to determining that the elapsed time exceeds a threshold, generate a security determination indicating an attack.
19. The method of claim 11 , wherein the instruction cache and the data cache are faster than the shared memory, and wherein the shared memory is faster than a second memory unit.
20. The method of claim 19 , wherein the second memory unit comprises Dynamic Random-Access Memory (DRAM).