Runtime verification using external device
Examples herein disclose a processor-based computing system. The system comprises at least one processor, a non-volatile memory comprising a basic input output system (BIOS), wherein the BIOS creates a data structure and sets up at least one verification software component executed by the processor, a controller communicatively linked to the at least one verification software component, and a memory comprising a system management memory coupled to the at least one processor and code which is executable by the processor-based system to cause the processor to validate the BIOS during a runtime of the processor-based system using the at least one verification software component and the controller.
1. A processor-based computing system, comprising:
at least one processor;
a non-volatile memory comprising a basic input output system (BIOS), wherein the BIOS includes instructions that are executed by the at least one processor to create a data structure and set up at least one verification software component for execution by the at least one processor;
a microprocessor communicatively linked to the at least one verification software component; and
a memory comprising a system management memory coupled to the at least one processor and code which is executable by the processor-based computing system to cause the at least one processor to validate the BIOS during a runtime of the processor-based computing system using the at least one verification software component and the microprocessor.
2. The processor-based computing system of claim 1 , wherein the microprocessor does not require access to the memory.
3. The processor-based computing system of claim 1 , wherein the data structure contains memory address ranges and cryptographic hash of memory content, the cryptographic hash used to create the data structure.
4. The processor-based computing system of claim 3 , wherein the at least one processor executes the at least one verification software component, and the at least one verification software component verifies integrity of memory areas in the data structure by computing the cryptographic hash used to create the data structure and comparing the computed cryptographic hash with the cryptographic hash in the data structure.
5. The processor-based computing system of claim 1 , wherein the BIOS further includes instructions that are executed by the at least one processor to send a message to the microprocessor and initiate an end of a system booting process.
6. The processor-based computing system of claim 1 , wherein the at least one processor handles system management interrupt (SMI) handlers comprising software routines which perform various system management functions including a system booting process.
7. The processor-based computing system of claim 1 , wherein the microprocessor sends a system management interrupt (SMI) Scan Event message and expects a SMI Enter Event message within a specified timeframe in response to the SMI Scan Event message.
8. The processor-based computing system of claim 7 , wherein the BIOS is invalidated if the SMI Enter Event message is not provided to the microprocessor within the specified timeframe.
9. The processor-based computing system of claim 7 , wherein the microprocessor expects a system management memory (SMM) Scan Result message within the specified timeframe if the SMI Enter Event message is provided to the microprocessor.
10. The processor-based computing system of claim 9 , wherein the BIOS is invalidated if the SMM Scan Result message is not provided to the microprocessor within the specified timeframe.
11. The processor-based computing system of claim 1 , wherein the BIOS further includes instructions that are executed by the at least one processor to generate a random number and send it to the at least one verification software component and to the microprocessor.
12. The processor-based computing system of claim 11 , wherein the at least one verification software component sends a message to the microprocessor using the randomly generated number, the message comprising status of runtime verification of the BIOS.
13. The processor-based computing system of claim 12 , wherein the status comprises a success message or an error message.
14. A method, performed by a computing device, comprising;
receiving a data structure comprising memory address ranges and cryptographic hash of memory content in memory areas, the memory areas comprising code associated with a basic input output system (BIOS) and communicated to a microprocessor;
executing at least one verification software component to verify integrity of the memory areas in the data structure; and
providing runtime verification of the BIOS using the least one verification software component and the microprocessor,
wherein the least one verification software component and the data structure are created by instructions of the BIOS executed by the computing device.
15. The method of claim 14 , wherein executing at least one verification software component to verify integrity of the memory areas in the data structure comprises computing a cryptographic hash used to create the data structure and comparing the computed cryptographic hash with the cryptographic hash in the data structure.