초록 ▼

A method for providing secure registration and integrity assessment of software in a computer system is disclosed. A secure hash table is created containing a list of secure programs that the user wants to validate prior to execution. The table contains a secure hash value (i.e., a value generated b

A method for providing secure registration and integrity assessment of software in a computer system is disclosed. A secure hash table is created containing a list of secure programs that the user wants to validate prior to execution. The table contains a secure hash value (i.e., a value generated by modification detection code) for each of these programs as originally installed on the computer system. This hash table is stored in protected memory that can only be accessed when the computer system is in system management mode. Following an attempt to execute a secured program, a system management interrupt is generated. An SMI handler then generates a current hash value for the program to be executed. In the event that the current hash value matches the stored hash value, the integrity of the program is guaranteed and it is loaded into memory and executed. If the two values do not match, the user is alerted to the discrepancy and may be given the option to update or override the stored hash value by entering an administrative password.

대표청구항 ▼

[ What is claimed is:] [1.] A method for providing secure registration and integrity assessment of software in a computer system having a processor incorporating system management capabilities, the computer system also having a stored table containing a modification detection value for each program

[ What is claimed is:] [1.] A method for providing secure registration and integrity assessment of software in a computer system having a processor incorporating system management capabilities, the computer system also having a stored table containing a modification detection value for each program or logical file to be validated, wherein the stored table is maintained in system management memory or other protected memory that is accessible only when the computer system is in a non-typical operating mode such as system management mode, the method comprising the steps of:storing a program or logical file on a disk drive;generating a system management interrupt in response to a request to execute the program or access the logical file stored on the disk drive;placing the computer system in system management mode as a result of said step of generating a system management mode interrupt; andexecuting a system management interrupt handler upon entry into system management mode, wherein said execution of the system management interrupt handler comprises the steps of:generating a current modification detection value for the requested program or logical file;determining if the stored table contains a secure modification detection value for the requested program or logical file;retrieving the secure modification detection value if it exists in the stored table;comparing the current modification detection value to the secure modification detection value if it exists in the stored table; andpermitting execution of the requested program or access to the requested logical file if the secure modification detection value exists in the stored table and the current modification detection value matches the secure modification detection value.