Data structure measurement comparison
A system comprising an inner kernel of an operating system (OS) running at a higher privilege level than an outer kernel of the OS, the inner kernel to measure a data structure in a memory; a device including a measurement engine to measure the data structure in the memory, wherein the device operates independently of the OS; and a trusted execution environment including an application to compare measurements from the inner kernel and the measurement engine.
1. A method comprising:
requesting, by an introspection enclave (IE), access to a scanning engine of a device, wherein the device is independent to an OS;
requesting, by the device, authentication from the IE;
in response to authentication verification from the IE to the device, initiating a secure exchange between the IE and the device, wherein the exchange includes a heartbeat signal from the device to the IE and requests for the device to measure a data structure in a memory;
requesting, by the IE, measurements of the data structure in the memory from a measurement engine in an inner kernel of the OS;
comparing, by the IE, the measurements of the data structure from the device and the measurement engine; and
in response to a difference in the comparison of the measurements of the data structure, taking, by the IE, remedial action.
2. The method of claim 1 , further comprising:
measuring continuously, by the scanning engine of the device, the data structure in memory.
3. The method of claim 1 , wherein communication between the IE and the device is encrypted.
4. The method of claim 1 , wherein the device access's the memory to measure the data structures in memory through a system management mode.
5. The method of claim 1 , wherein the inner kernel is a part of a kernel and the inner kernel runs critical security functions.
6. A non-transitory machine-readable storage medium encoded with instructions executable by a processor, the non-transitory machine-readable storage medium comprising, instructions to:
authenticate communication to and from a baseboard management controller (BMC);
in response to a reception of a heartbeat signal from the BMC, send a response to the BMC;
request, from the BMC, measurement of a data structure in memory;
request, from a measurement engine of an inner kernel, measurement of the data structure in the memory;
compare the measurements of the data structure in the memory from the BMC and from the measurement engine; and
in response to a difference in comparison of the measurements of the data structure in the memory from the BMC and from the measurement engine, initiate remedial action.
7. The non-transitory machine-readable storage medium of claim 6 , wherein, in response to a failure to respond to the heartbeat signal, the BMC to initiate remedial action.
8. The non-transitory machine-readable storage medium of claim 6 , wherein the OS includes the inner kernel and an outer kernel.
9. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions are executed in a trusted execution environment within the outer kernel of the OS.
10. The method of claim 1 , further comprising:
requesting, by the IE, second measurements of the data structure in the memory, at different times, from a measurement engine in an inner kernel of the OS;
comparing, by the IE, the second measurements of the data structure from the device and the measurement engine; and
in response to a second difference in the comparison of the measurements of the data structure, taking, by the IE, further remedial action.