WO2021248665A1 - Sgx侧信道攻击防御方法、系统、介质、程序及应用 - Google Patents

Sgx侧信道攻击防御方法、系统、介质、程序及应用 Download PDF

Info

Publication number
WO2021248665A1
WO2021248665A1 PCT/CN2020/107589 CN2020107589W WO2021248665A1 WO 2021248665 A1 WO2021248665 A1 WO 2021248665A1 CN 2020107589 W CN2020107589 W CN 2020107589W WO 2021248665 A1 WO2021248665 A1 WO 2021248665A1
Authority
WO
WIPO (PCT)
Prior art keywords
input data
side channel
data
branch
size
Prior art date
Application number
PCT/CN2020/107589
Other languages
English (en)
French (fr)
Inventor
李兴华
石志远
张晓涵
杨超
杨力
郭晶晶
Original Assignee
西安电子科技大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 西安电子科技大学 filed Critical 西安电子科技大学
Publication of WO2021248665A1 publication Critical patent/WO2021248665A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Definitions

  • the invention belongs to the technical field of network security, and in particular relates to a method, system, medium, program and application for SGX side channel attack defense.
  • TEE Trusted Computing Base
  • SoC system-on-chip
  • This dependence provides special opportunities for untrusted privileged software to infer trustworthiness by controlling side channels (ie, page faults, cache, branch target buffer (BTB), and last branch record (LBR)) Secrets in the container).
  • side channels ie, page faults, cache, branch target buffer (BTB), and last branch record (LBR)
  • BTB branch target buffer
  • LBR last branch record
  • the interface-based side-channel attack uses the interface call tracking of the SGX auxiliary application. Due to the direct availability of semantics and determinism, compared with other types of attacks, interface calls can provide richer information for secret reasoning.
  • Interface-based side-channel attacks include a variety of attacks at the time and space levels, including interface call duration, parameter size, return value size, and so on.
  • Comprehensive defense against such interface-based side-channel attacks requires consideration of the combined use of multiple technologies, and cannot bring large overheads. In consideration of reducing the workload of developers, the solution needs to eliminate the need for developers to manually modify the source code as much as possible.
  • Interface-based side-channel attacks will undermine the security guarantee of SGX and can be used to extract secrets in secure zone applications. For example, it can be used to reduce the key space of RSA keys, to infer network traffic processing paths, and so on.
  • the invention is used to defend against interface-based side channel attacks and provides an overall solution. The invention does not need to modify the program source code, the defense process is automatically executed by the compiler, and the compiled program has good performance.
  • the present invention provides a method, system, medium, program and application for SGX side channel attack defense.
  • an SGX side channel attack defense method includes:
  • the framework hides the interface-based side channel information exposed to the output data and control flow due to the use of different input data; uses branch confusion and loop confusion to alleviate the difference in call sequence and call delay between different input data; use A constant size wrapper to make the size of the output data constant.
  • the framework hides the interface-based side channel information exposed to the output data and control flow due to the use of different input data; uses branch confusion and loop confusion to alleviate the calling sequence and calls between different input data Latency difference; using a constant size wrapper to make the size of the output data constant includes:
  • Bait Store instruction The key component of the obfuscation mechanism is the Bait Store instruction
  • Branch obfuscation wrapper The branch obfuscation mechanism will force the program to execute all instructions in two paths to obfuscate the branch;
  • the framework converts the code.
  • the code is used as a call to encrypt some data to the [out] pointer.
  • the comment in the EDL file informs that the content of the Phasar pointer is sensitive input.
  • the decoy Store instruction the original Store instruction accepts the source operand and the target operand, and moves the source operand to the target; implements the decoy Store instruction by moving the source operand to the source operand itself; uses the decoy Store instruction to The execution delay execution bait path that is the same as the actual execution path;
  • the branch obfuscation wrapper by inserting all the original instructions of one path to the beginning of another path, and then inserting all the original instructions of another path to the end of the original path; by replacing all the original instructions with the decoy Store instructions described earlier Store instruction inserted;
  • the loop obfuscation wrapper first performs static taint analysis to determine which loops actually depend on the secret data; then, the loops affected by sensitive data are modified; an approximate number is set for the loop counter during operation to make the loop Body execution is greater than or equal to the least squares of the actual number of cycles;
  • the fixed-size wrapper first finds the location where the encryption function is used, determines whether its parameter contains a pointer marked by [out]/[usercheck], and fills the source data in the function parameter to a fixed size.
  • the SGX side-channel attack defense method converts the source code to LLVM IR, and the branch instruction of lines 07-08 from the static taint analysis depends on the secret value.
  • the branch is obfuscated, and all Basicblocks are copied to the corresponding one. In the corresponding position of the other path, replace all copied Store instructions with decoy Store instructions; replace all functions called in the decoy Basicblock with decoy functions, and all Store instructions in the decoy function are replaced by decoy Store instructions;
  • the source address and size of the encryption function are also replaced with a new pointer, which is filled to a fixed size.
  • Another object of the present invention is to provide a computer device that includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the following step:
  • the framework hides the interface-based side channel information exposed to the output data and control flow due to the use of different input data; uses branch confusion and loop confusion to alleviate the difference in call sequence and call delay between different input data; use A constant size wrapper to make the size of the output data constant.
  • Another object of the present invention is to provide a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the processor executes the following steps:
  • the framework hides the interface-based side channel information exposed to the output data and control flow due to the use of different input data; uses branch confusion and loop confusion to alleviate the difference in call sequence and call delay between different input data; use A constant size wrapper to make the size of the output data constant.
  • Another object of the present invention is to provide an SGX side channel attack defense system that implements the SGX side channel attack defense method.
  • the SGX side channel attack defense system includes:
  • Vulnerability identification module used to track the data flow of the input data in the safe area, find branches and loops that depend on the input data, such branches and loops will leak side channel information about the input data; the framework reads the EDL file to obtain all Ecall functions And its parameters, as the source of taint analysis; after determining the functions and variables, use Phasar to perform accurate inter-process taint analysis to identify branches, loops and operands that depend on the input data of the safe zone;
  • Vulnerability mitigation module used to hide the interface-based side channel information exposed by the output data and control flow when using different security zones to input data; use branch obfuscation and loop obfuscation to alleviate the calling sequence and calling between different input data Delay difference; use a constant size wrapper to make the size of the output data constant.
  • Another object of the present invention is to provide a computer security control system equipped with the SGX side channel attack defense system.
  • Intel Software Guard Extension is a newly introduced trusted computing technology, which provides an independent and secure enclave for user programs The execution environment without trusting any privileged software (such as operating system or hypervisor) or firmware.
  • Some side channel attacks (such as page fault-based attacks, cache-based attacks, and interface-based attacks) leak the secrets of the enclave.
  • the side channel attack based on the interface uses the side channel information at the interface to infer the secret of the enclave.
  • the root cause of the side channel attack based on the interface is the input-related interface call information (such as Interface information and call mode), revealing the control flow inside the security zone. No defense method has been proposed for this type of attack.
  • the present invention provides a feasible defense method against such interface-based side channel attacks.
  • the key idea of the method of the present invention is to obfuscate the program at the source code level so that the control flow of the program is independent of input. It also proves that the conversion of the present invention is safe under the background of modern processors.
  • the root cause of the interface-based side channel attack of the present invention is that different data in the safe zone interface call (ECALL/OCALL) leads to different observable interface call modes (for example, interface call sequence and call delay, etc.). Therefore, when other solutions try to hide the symptoms, for example, the number of instructions to control the two paths is equal, and the problem is solved fundamentally by executing unrelated program paths. Intuitively speaking, after obfuscation, any ECALL/OCALL call performed by the adversary using different inputs will look the same through any side channel, as if the program was run multiple times with the same input.
  • ECALL/OCALL safe zone interface call
  • the only difference between the real path and the decoy path is the value written to the memory: the decoy path and the real path will write different values, but unless the adversary can destroy the data encryption, she cannot distinguish the decoy path from the real path by monitoring the digital side channel .
  • the present invention can resist almost all interface-based SGX side channel attacks; does not require the program itself to be secret, only requires data; does not need to disable standard processor functions, such as cache, branch pre-dictator and pre-fetcher.
  • the present invention defends the program executed on common hardware from the side channel attack based on the interface. Assess the security of the mechanism, the obfuscated data flow and control flow are correct and always kept secret; use the information flow to demonstrate that your code will not leak information based on the inference rules. It is shown that the present invention resists simple but powerful interface-based SGX side channel attacks.
  • the performance overhead of the solution of the present invention is 5% less than that of the most similar Raccoon, but Raccoon cannot defend against all interface-based SGX side channel attacks.
  • Fig. 1 is a flowchart of an SGX side channel attack defense method provided by an embodiment of the present invention.
  • Figure 2 is a schematic structural diagram of an SGX side channel attack defense system provided by an embodiment of the present invention
  • Vulnerability identification module In the figure: 1. Vulnerability identification module; 2. Vulnerability mitigation module.
  • Fig. 3 is a schematic diagram of an example source program provided by an embodiment of the present invention.
  • Fig. 4 is a schematic diagram of an intermediate language representation of an example source program provided by an embodiment of the present invention.
  • Fig. 5 is a schematic diagram showing a converted intermediate language provided by an embodiment of the present invention.
  • Fig. 6 is a schematic diagram of comparing the overhead of the present invention and Raccoon provided by an embodiment of the present invention.
  • the present invention provides an SGX side channel attack defense method, system, medium, program, and application.
  • the present invention will be described in detail below with reference to the accompanying drawings.
  • the SGX side channel attack defense method provided by the present invention includes the following steps:
  • S101 Track the data flow of the input data in the safe zone to find the branches and loops that depend on the input data, which will leak the information of the input data; the framework reads the EDL file to obtain all Ecall functions and their parameters as the source of taint analysis; After determining the functions and variables, use Phasar to perform accurate inter-process taint analysis to identify branches, loops and operands that depend on the input data of the safe zone;
  • S102 The framework hides the interface-based side channel information exposed to the output data and control flow due to the use of different input data; uses branch confusion and loop confusion to alleviate the difference in call sequence and call delay between different input data ; Use a constant size wrapper to make the size of the output data constant.
  • the SGX side channel attack defense method provided by the present invention can be implemented by ordinary technicians in the industry using other steps.
  • the SGX side channel attack defense method provided by the present invention in FIG. 1 is only a specific embodiment.
  • the SGX side channel attack defense system provided by the present invention includes:
  • Vulnerability identification module 1 used to track the data flow of the input data in the safe area, and find branches and loops that depend on the input data. Such branches and loops will leak side channel information about the input data; the framework reads the EDL file to obtain all Ecalls Functions and their parameters are used as the source of taint analysis; after determining the functions and variables, use Phasar to perform accurate inter-procedural taint analysis to identify branches, loops and operands that depend on the input data of the safe zone;
  • Vulnerability mitigation module 2 used to hide the interface-based side channel information exposed by output data and control flow when using different security zones to input data; use branch confusion and loop confusion to alleviate the calling sequence between different input data Difference from call delay; use a constant size wrapper to make the output data size constant.
  • Intel SGX is a hardware-based mechanism that can ensure the confidentiality and integrity of application code and data even if an attacker obtains privileged software or physical access to the machine (for example, memory bus and system bus) . It relies on two main mechanisms for achieving security promises. The first is a hardware-enforced process isolation mechanism, which enables user-level applications to have private memory that even the most privileged system software cannot access. The second is the remote attestation mechanism, which allows the remote verifier to verify whether a security zone has been established on the SGX-enabled system and the integrity of the code running in the security zone.
  • the software isolation mechanism is implemented by new instructions provided by Intel. These instructions can be used to create a "safe zone", which is a storage area that can only be accessed by the creator process.
  • Each security zone is mapped to a secure zone page cache (EPC), which is a hardware-encrypted address space in the main memory access controlled by the processor.
  • EPC secure zone page cache
  • the content of the EPC is only decrypted inside the processor using a processor-specific key. Therefore, even privileged software (for example, OS and virtual machine manager) cannot access the contents of the secure zone.
  • Security zone code is always executed in user mode, so any interaction with the OS through system calls (such as network or disk I/O) must be executed outside the security zone.
  • Intel SGX SDK provides a function call mechanism for SGX applications through external call (OCALL) and safe zone entry call (ECALL). Developers need to define the interface between the security zone code and other untrusted application code. Specifically, the call to the safe zone is called ECALL, and OCALL allows the safe zone code to call untrusted external functions.
  • ECALL the SDK will add instructions to encapsulate the parameters outside the safe area, and unpack the parameters after entering the safe area, and then execute the function in the safe area.
  • the added SDK code exits the security zone, unencapsulates the parameters, executes untrusted code outside the security zone, and then re-enters the security zone.
  • the remote attestation mechanism is implemented by using a challenge response protocol to generate a metric value for the safe zone, which is signed by the processor.
  • Intel's Enhanced Privacy ID (EPID) cryptographic system can be used to verify the measurement result.
  • SGX cannot defend against any side-channel attacks.
  • the Intel SGX library runs outside the secure area. Therefore, the OS can observe any safe zone call patterns, and can use these patterns to infer information about the safe zone input data.
  • Operating system resource sharing and the sharing of publicly accessible statistical information of system resources is a side channel of operating system resources generated.
  • Many systems provide this type of information without any privileged authority.
  • the proc file system in a Unix-like system is a pseudo file system that provides an interface to the kernel data structure. It is usually installed on /proc and contains information about system resources. This type of side-channel attack is usually carried out between applications that do not have privileged permissions.
  • Stack content eavesdrop on the user's keystrokes through the contents of the extended stack pointer (ESP) and extended instruction pointer (EIP) information provided by /proc/pid/stat on the Linux system.
  • ESP extended stack pointer
  • EIP extended instruction pointer
  • Memory tracking by observing the memory usage and CPU scheduling statistics on the multi-user system, infers the webpages the user visits and the relationship between the victim and the site.
  • Memory page deduplication uses the write access time difference on the memory page after data deduplication recreated by the copy-on-write page management mechanism to identify the application running on the victim's Vitrul computer (VM).
  • VM Vitrul computer
  • DRAM uses the shared DRAM buffer line between the attacker and the victim to monitor the keystrokes in the Firefox address bar; against Intel SGX's Cache-DRAM attack, the attack combines cache and DRAM line buffer information to monitor the safe area Branches related to input.
  • the Prime+Probe and Flush+Reload methods have been proposed. These methods take advantage of the difference in the access latency of the shared cache between the attacker and the victim to infer the secret of the victim.
  • TLB translation lookaside buffer
  • ASLR address space layout randomization
  • Brasser, Gotzfried, Hahnel, and Moghimi demonstrated a cache-based side-channel attack on SGX to infer secrets in the secure zone, such as AES keys, RSA keys, or encrypted input data in the secure zone.
  • Branch target buffer (BTB). Dmitry's current BTB side-channel attack can discover the memory layout of another process or kernel, thereby bypassing the KASLR scheme. Lee explains the branch shadow attack by constructing code that shares the branch target buffer (BTB) with the flying area code and observing the last branch record (LBR) to infer the fine-grained control flow of the flying area code.
  • BTB branch target buffer
  • LBR last branch record
  • Speculative execution showing a side-channel attack that uses a branch prediction unit to recover the secret key. Chen et al. used speculative execution mechanism to steal secrets located in the security zone in the register.
  • the threat model includes a malicious OS with privileged authority in this type of attack.
  • DCA differential calculation analysis
  • TEE trusted computing execution
  • Intel SGX and ARM TrustZone applications using such TEE technologies are always divided into trusted parts (packages) and untrusted parts.
  • the malicious OS can observe the communication between the two parts. Therefore, the privileged system software can collect and analyze the interface calling pattern between the two parts. When these patterns rely on secrets, they may leak sensitive information in sensitive parts.
  • This type of side channel is an interface-based side channel attack.
  • the existing side channel attacks on the SGX platform are mainly concentrated on the side channel of the architecture and the control side channel of the OS. Since the security zone is executed in an isolated memory space, and there is no interface for statistical information of the OS resources of the SGX auxiliary application, the OS resource side channel is hardly used. Compared with other types of side channel attacks, side channel attacks based on interfaces have some advantages. First, it can accurately collect side channel information. All existing side-channel attacks on the SGX platform suffer from the problem of false positive rates of side-channel information collection. For example, multiple memory accesses to different memory addresses may generate the same cache set and page access tracking. However, the collection of information in interface-based side-channel attacks is accurate. Every time the decisive interface is called, the present invention can collect accurate interface calling information.
  • the present invention will summarize the existing side channel defense technologies and discuss technologies that may be applicable to side channel attacks based on interfaces.
  • the existing side channel defense technologies mainly include the following categories.
  • the application hardening strategy will modify the application code to prevent the leakage of sensitive information from the side channel.
  • Manually or use a special compiler to hide the memory access mode They can be used to use cache and page fault side channels to defend against side channel attacks.
  • the branch execution mode that can defend the BTB side channel is ignored.
  • By filling the execution time to a fixed value or a predefined value the execution processing time side channel is defended, thereby reducing the granularity of the potential processing time.
  • the attack does not rely on memory access pattern information and branch execution information. Therefore, application hardening used to hide memory access patterns and branch execution paths will not be suitable for interface-based side-channel attacks.
  • the fixed running time may hide the interface call delay in the interface-based side channel attack. However, this mechanism will always produce a large performance overhead, and is only used in the time side channel.
  • the restricted function strategy deletes the auxiliary channel by restricting the source of the auxiliary channel, the command used by the attacker, or refreshing the state of the auxiliary channel. For example, disabling the cache can prevent cache-based side channel attacks, refreshing the branch status can prevent BTB-based side channel attacks, and restricting RDTSC can prevent attackers from measuring memory access time. Restricting RDTSC seems to protect against the attacks of the present invention. However, this naive strategy will prevent all program developers from analyzing program performance, and there are other timing measurements. Likewise, it is only applicable to the interface call delay channel in the attack of the present invention.
  • the new software mechanism strategy proposes a new software mechanism, which helps to eliminate the existing secondary channels. Move paging from the OS to an application that can be used to prevent side channels from page faults. ORAM technology hides the memory access mode and can defend cache-based and DRAM-based side-channel attacks. Use the current CPU's hyper-threading function to run verifiable shadow threads to prevent side-channel attacks using hyper-threading. Interface-based side-channel attacks do not rely on memory access patterns and hyper-threading capabilities. Therefore, the aforementioned defense measures are not applicable to interface-based side channel attacks.
  • Hardware architecture modification The hardware architecture modification strategy redesigned the current hardware to prevent side channel information leakage. Rely on randomization of access in the cache to defend against cache-based side-channel attacks.
  • the cache partition is proposed to ensure that security-sensitive code will never share the cache with untrusted processes.
  • the hardware architecture modification is mainly applicable to the side channel attack of the architecture. Interface-based side-channel attacks will not be relayed on any hardware architecture attributes. Therefore, this defense is not suitable for interface-based side channel attacks.
  • Attack detection Shih et al. and Chen et al. used Intel's hardware transaction memory to detect frequent interrupts and program execution time delays caused by side-channel attacks. They used abnormal cache misses to detect cache-based side-channel attacks. However, interface-based side-channel attacks will not cause interruption, and execution time-based attack detection can only prevent attackers from using execution time information. Attackers can still use the other two interface side channel information to attack. Cache miss detection is not applicable to interface-based side channel attacks.
  • the present invention assumes that an adversary can monitor and tamper with any digital signal on the processor's I/O pins.
  • the present invention also assumes that the processor is a sealed chip, all off-chip resources (including DRAM, disks, and network equipment) are untrustworthy, all read and write values are encrypted, and the integrity of all reads and writes is checked.
  • the present invention assumes that the adversary can run the malicious application on the same operating system and/or hardware as the victim's application.
  • the present invention allows malicious applications to detect runtime statistics of victim applications disclosed by the operating system (for example, the stack pointer in /proc/pid/stat).
  • the design of the present invention assumes that the input program has no errors, that is, (1) the program does not contain errors that can cause the application to crash, (2) the program does not display undefined behavior, and (3) if it is multi-threaded, the program does not have data compete. Under these assumptions, the present invention will not introduce new termination channel leakage, and will correctly confuse multi-threaded programs.
  • the present invention statically converts the user code into a modified binary code; the present invention assumes that the opponent can access the converted binary code and any symbol tables and debugging information that may exist.
  • the present invention proposes a method to automatically identify and eliminate the side channel information leakage vulnerability based on the interface on the SGX application binary file.
  • the vulnerability identification mechanism is based on taint analysis.
  • the automatic mitigation mechanism is implemented using LLVM, which is composed of three wrappers: branch obfuscation, loop obfuscation, and constant size.
  • the present invention tracks the data flow of the input data in the safe area, and finds branches and loops that depend on the input data. Such branches and loops will leak side channel information about the input data.
  • the framework of the present invention reads the EDL file to obtain all Ecall functions and their parameters as the source of stain analysis. After determining these functions and variables, the present invention uses Phasar to perform accurate inter-process taint analysis to identify branches, loops and operands that depend on the input data of the safe zone. These instructions need to be obfuscated to prevent leakage of side channel information based on the interface.
  • the result of the taint analysis of the present invention is a list of memory access and conditional branch statements that must be confused to protect privacy.
  • the present invention hides the interface-based side channel information exposed on the output data and control flow due to the use of different input data.
  • the present invention uses branch confusion and loop confusion to alleviate the difference in call sequence and call delay between different input data.
  • the present invention proposes to use a constant size wrapper to make the size of the output data constant.
  • Bait Store instruction The key component of the obfuscation mechanism is the Bait Store instruction.
  • the original Store instruction accepts a source operand and a destination operand, and it moves the source operand to the destination.
  • the present invention implements the decoy Store instruction by moving the source operand to the source operand itself.
  • the present invention uses the decoy Store instruction to execute the decoy path with the same execution delay as the actual execution path without any changes to the program result.
  • Branch obfuscation wrapper The branch obfuscation mechanism of the present invention forces the program to execute all instructions in two paths to obfuscate branches. This encounters two challenges: (1) How to execute instructions in two paths so that the attacker can only obtain fixed side channel information, and (2) How to ensure that the memory update performed in the decoy path does not change the original The result of the instruction.
  • the present invention solves the first challenge by inserting all original instructions of one path at the beginning of another path, and then inserting all original instructions of another path at the end of the original path. This ensures the sequential execution of the two paths generated by the conditional branch instruction.
  • the present invention solves the second challenge by replacing all inserted Store operations with the previously described decoy Store instructions.
  • the present invention creates a new function at compile time, which is almost a copy of the original function, but stores all of it The instruction is changed to the Bait Store instruction.
  • Loop obfuscation wrapper converts the loop count related to the input data into several fixed numbers to prevent information leakage.
  • the present invention first performs a static stain analysis to determine which cycles actually depend on the secret data. Then, the present invention modifies the loop affected by sensitive data, so that the side channel information will not be leaked without affecting its execution result.
  • the present invention cannot set the loop count as a fixed number because the number of iterations cannot be determined statically. Therefore, the present invention sets an approximate number for the cycle counter during operation.
  • the present invention enables the loop body to execute the least squares times greater than or equal to the actual loop times.
  • the execution times of the loop body are set to the least squares greater than 20, that is, 32 times.
  • a compromise is made between program performance and security.
  • the decoy Store instruction so that the newly added loop code does not affect the result of the original program.
  • an opponent who observes that the loop counter is L can infer that the actual loop trip count L is between 0.5x L and L.
  • the exact value of L will not be revealed.
  • the present invention also allows developers to manually specify the minimum and maximum number of cycles to reduce brute force cracking behavior.
  • the present invention sets the output data size to an approximate number to alleviate the information leakage caused by the output data.
  • Intel SGX SDK requires programmers to use [in]/[out]/[user check] to annotate the pointers in the EDL file to indicate the use of pointers.
  • the present invention assumes that developers use the widely used encryption library provided in the SGX SDK to encrypt data before writing the data into the output buffer. Therefore, the present invention first finds the location where these encryption functions are used, and then determines whether the parameter contains a pointer marked by [out]/[usercheck], and fills the source data to a fixed size in these operations. Similar to circular conversion, the padding size can be greater than or equal to the least square of the source data size or the size provided by the developer.
  • the present invention converts the source code into LLVM IR, as shown in Figure 4.
  • the static taint analysis found that the branch instructions on lines 07-08 depend on the secret value, so the present invention obfuscates the branch, which means that the present invention copies all Basicblocks to the corresponding positions of the other corresponding paths.
  • all the copied Store instructions are replaced with decoy Store instructions.
  • the decoy Store instruction is shown in line 16 of Figure 5, and its source address and destination address are the same.
  • the present invention also replaces all functions called in the decoy Basicblock with decoy functions, and all Store instructions in the decoy function are replaced by decoy Store instructions.
  • the source address and size of the encryption function are also replaced with a new pointer, which is filled to a fixed size, as shown in lines 11-13.
  • the present invention first proves that the control flow in the obfuscated program is correct and has nothing to do with the secret value. Then, the present invention uses the type rule of tracking information flow, and considers that the code of the present invention will not leak secret information. The present invention explains the defensive measures of the present invention against the SGX side channel attack based on the interface by reasoning about the abnormality in the x86 processing program.
  • the present invention believes that the obfuscated control flow and data flow (1) retain the dependency of the original program, and (2) does not reveal any secret information.
  • the present invention uses the previously described decoy Store instruction to replace all inserted Store instructions. Since the source address and destination address of the decoy Store instruction are the same, the present invention will also decoy the Basicblock All the called functions are replaced with decoy functions, and all Store instructions in the decoy function are also replaced by decoy Store instructions, so the memory update performed in the decoy path will not change the result of the original instruction; in the loop obfuscation wrapper, the present invention uses The approximate number of loop counts replaces the number of static iterations, and the decoy Store instruction is used to make the newly added loop code not affect the results of the original program.
  • the present invention obfuscates the decoy path.
  • the present invention inserts all the original instructions of a path to the beginning of the decoy path, and then inserts all the original instructions of the decoy path to the end of the original path, so that the attacker can only obtain fixed side channel information ;
  • the loop wrapper converts the static number of iterations to the least squares of the actual number of loops, so that the attacker can only infer the interval value of the number of iterations, and cannot obtain the definite number of loops;
  • the fixed-size wrapper can pass The padding processing of the output data size.
  • the padding size can be greater than or equal to the least square of the source data size or the size provided by the developer. After the source data is filled to a fixed size in the instruction, the information caused by the output data can be alleviated leakage.
  • the solution of the present invention can also confuse the multi-threaded code correctly.
  • the load and Store instructions on the real path are atomic and are globally visible, while the Store instructions on the decoy path are only locally visible. Therefore, the present invention concludes that the obfuscated code maintains the correct data flow for single-threaded and multi-threaded programs.
  • the present invention is implemented in the LLVM compiler framework v10.0.0.
  • the host operating system is CentOS7.
  • the present invention uses 8 programs. Table 1 summarizes their characteristics and related input data size. The eight programs in the table are the same as those used to evaluate Raccoon, and the present invention uses these programs to compare the cost of the present invention with the cost of Raccoon.
  • the present invention uses a data size similar to that of Raccoon.
  • the present invention transplants Raccoon into a language that can be compiled into LLVM IR. All tests use the LLVM/Clang compiler tool chain.
  • the present invention runs all experiments on a computer with two Intel Xeon processors and 16GB (8 ⁇ 2GB) DDR3 memory. Each processor has eight cores with 256KB of dedicated L2 cache. The eight cores on the processor chip share 20MB of L3 cache.
  • the stream encryption/decryption hardware makes the cost of accessing the memory from the encrypted RAM storage area almost the same as the cost of accessing the DRAM storage area.
  • the underlying hardware does not support encrypted RAM storage areas, but the present invention does not separately add any encryption-related overhead in the measurement, because the cost of stream access with or without encryption is almost the same.
  • the main sources of the overhead of the present invention are: control flow obfuscation overhead (including the overhead of buffer memory access, the overhead of copying program stack and CPU registers, and the overhead of obfuscating algorithms and memory access instructions).
  • control flow obfuscation overhead including the overhead of buffer memory access, the overhead of copying program stack and CPU registers, and the overhead of obfuscating algorithms and memory access instructions.
  • the overhead will vary with program characteristics, such as the size of input data, the number of obfuscated statements, and the number of memory access statements.
  • Figure 6 compares the overhead of Raccoon on the analog processor and the present invention. In the experiment, the average overhead of the eight programs of the present invention is about 5% lower than that of Raccoon, but Raccoon cannot defend against all interface-based SGX side channel attacks, and the present invention can resist almost all interface-based SGX side channel attacks.
  • IntelSGX is a TEE realized by hardware technology, and it is considered one of the very promising TEEs. However, it may suffer from various side channel attacks during its use.
  • the present invention designs a solution to defend against interface-based SGX side-channel attacks.
  • the present invention uses inter-program taint analysis to identify applications based on binary The side channel information of the interface is leaked, and then branch obfuscation, loop obfuscation, and constant size encapsulation are used to defend against such vulnerability attacks.
  • This solution can basically defend against all interface-based SGX side-channel attacks.
  • the present invention analyzes the security and overhead of the obfuscated code in the scheme, and achieves better performance in the experiment.
  • the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware.
  • the hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware.
  • an appropriate instruction execution system such as a microprocessor or dedicated design hardware.
  • Those of ordinary skill in the art can understand that the above-mentioned devices and methods can be implemented using computer-executable instructions and/or included in processor control codes, for example, on a carrier medium such as a disk, CD or DVD-ROM, such as a read-only memory.
  • Such codes are provided on a programmable memory (firmware) or a data carrier such as an optical or electronic signal carrier.
  • the device and its modules of the present invention can be implemented by hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., It can also be implemented by software executed by various types of processors, or can be implemented by a combination of the above-mentioned hardware circuit and software, such as firmware.

Abstract

本发明属于网络安全技术领域，公开了一种SGX侧信道攻击的识别和防御方法、系统、介质、程序及应用，其原理是跟踪安全区输入数据的数据流，找到依赖于输入数据的分支和循环，此类分支和循环将泄漏有关输入数据的侧信道信息；框架读取EDL文件以获取所有Ecall函数及其参数，作为污点分析的源（Source）；使用Phasar进行精确的过程间污点分析，识别依赖于安全区输入数据的分支，循环和操作数；框架隐藏了由于使用了不同的输入数据而被暴露于输出数据和控制流上的基于接口的侧信道信息；使用分支混淆和循环混淆消除不同输入数据之间调用顺序和调用延迟差异；使用恒定大小包装器使输出数据大小恒定。本发明的性能开销比最相似的Raccoon小5％。

Description

SGX侧信道攻击防御方法、系统、介质、程序及应用 技术领域
本发明属于网络安全技术领域，尤其涉及一种SGX侧信道攻击防御方法、系统、介质、程序及应用。
背景技术
随着软件复杂性的提高以提供更丰富的功能，编写无漏洞软件已被广泛认为是一项艰巨的任务。尽管在编程语言，软件测试和操作系统方面都进行了积极的研究，但是软件漏洞仍然以惊人的速度被发现，并且仍然是计算机安全的主要挑战。当软件堆栈受到破坏时，有两种主要的方法可用于实现安全计算：加密算法或安全系统。为了对机密数据进行安全的计算，现有方法对输入进行加密，然后对其进行操作，只有拥有陷门的授权方才能获得计算结果。然而，尽管最近的研究在同态加密上取得了突破，能够对加密数据进行任意计算，但其性能开销仍然较高。另一方面，计算机体系结构社区的解决方法是将可信计算基础(TCB)最小化到仅处理器，从而产生了硬件辅助的可信执行环境(TEE)。TEE通过仅信任片上系统(SoC)，从而防御最高特权的软件，例如BIOS和操作系统。由于认识到这种方法的潜力，所有主要的处理器制造商都开发了类似的硬件原语，例如ARM TrustZone和Intel SGX。这些受信任的执行环境也已在移动和云环境的生产系统中使用。尽管安全区内的应用程序代码和数据受到保护，但防护区仍需要依靠操作系统(OS)进行系统服务，例如内存管理和调度。这种依赖为不受信任的特权软件提供了特别的机会，使其可以通过控制侧信道(即页面错误，高速缓存，分支目标缓冲区(BTB)和最后分支记录(LBR))来推断可信容器内的秘密)。其中，基于接口的侧信道攻击利用了SGX辅助应用程序的接口调用跟踪。由于语义和确定性的直接可用性，与其他攻击类型相比，接口调用可提供更丰富的信息以进行秘密推理。
目前针对侧信道攻击提出了许多SGX防御侧信道攻击的解决方案。但是这些防御措施只针对特定的侧信道提供了点解决方案，但是基于接口的侧信道攻击包含了时间和空间层面的多种攻击，尚未有方案提供整体化的解决方案，考虑到组合多个点对点解决方案会带来很高的开销，希望找到能解决全部此类基于接口的侧信道攻击的解决方案。
通过上述分析，现有技术存在的问题及缺陷为：目前针对侧信道攻击提出了许多SGX防御侧信道攻击的解决方案只针对特定的侧信道提供了点解决方案，无法防御所有类型的基于接口的侧信道攻击，组合多个解决方案开销高。
解决以上问题及缺陷的难度为：
基于接口的侧信道攻击包含了时间和空间层面的多种攻击，包括接口调用时长，参数大小，返回值大小等等。全面防御此类基于接口的侧信道攻击需要考虑多种技术组合使用，且不能带来较大的开销。考虑到减轻开发人员的工作量，方案需要尽可能无需开发人员手动修改源代码。
解决以上问题及缺陷的意义为：
基于接口的侧信道攻击会破坏SGX的安全保证，可以用于提取安全区应用程序中的秘密，例如，可以用于减小RSA密钥的密钥空间，用于推断网络流量处理路径等等。本发明用于防御基于接口的侧信道攻击，并提供了整体的解决方案，使用本发明不需要对程序源代码进行修改，防御过程由编译器自动执行，且编译后的程序具有良好的性能。
发明内容
针对现有技术存在的问题，本发明提供了一种SGX侧信道攻击防御方法、系统、介质、程序及应用。
本发明是这样实现的，一种SGX侧信道攻击防御方法，所述SGX侧信道攻击防御方法包括：
跟踪安全区输入数据的数据流，找到依赖于输入数据的分支和循环，此类 分支和循环将泄漏有关输入数据的侧信道信息；框架读取EDL文件以获取所有Ecall函数及其参数，作为污点分析的来源；在确定功能和变量之后，使用Phasar进行精确的过程间污点分析，识别依赖于安全区输入数据的分支，循环和操作数；
框架隐藏了由于使用了不同的输入数据而被暴露于输出数据和控制流上的基于接口的侧信道信息；使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据的大小恒定。
进一步，所述SGX侧信道攻击防御方法的污点分析的结果混淆以保护隐私的内存访问和条件分支语句的列表。
进一步，所述框架隐藏了由于使用了不同的输入数据而被暴露于输出数据和控制流上的基于接口的侧信道信息；使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据的大小恒定包括：
1)诱饵Store指令：混淆机制的关键组成部分是诱饵Store指令；
2)分支混淆包装器：分支混淆机制会强制程序在两条路径中执行所有指令，以对分支进行混淆；
3)循环混淆包装器。将输入数据相关的循环计数转换为几个固定数以防止信息泄漏；
4)固定大小包装器，将输出数据大小设置为一个近似数字；
5)同时使用，框架转换代码，代码用作调用以将某些数据加密到[out]指针，EDL文件中的注释告知Phasar指针的内容是敏感输入。
进一步，所述诱饵Store指令：原始的Store指令接受源操作数和目标操作数，将源操作数移动到目标；通过将源操作数移动到源操作数本身实现诱饵Store指令；使用诱饵Store指令以与实际执行路径相同的执行延迟执行诱饵路径；
所述分支混淆包装器，通过将一个路径的所有原始指令插入到另一路径的开头，然后将另一种路径的所有原始指令插入到原始路径的结尾；通过用前面 描述的诱饵Store指令替换所有插入的Store指令；
对于在诱饵路径中的函数调用在编译时创建了一个新函数，将全部Store指令更改为诱饵Store指令。
进一步，所述循环混淆包装器首先执行静态污点分析，以确定哪些循环实际上取决于秘密数据；然后，对受敏感数据影响的循环进行修改；在运行期间为循环计数器设置一个近似数，使循环体执行大于或等于实际循环次数的最小二乘方次；
所述固定大小包装器先找到使用加密函数的位置，判断其参数是否含有被[out]/[user check]标记的指针，并将函数参数中的源数据填充至固定大小。
进一步，所述SGX侧信道攻击防御方法将源代码转换为LLVM IR，静态污点分析到07-08行的分支指令取决于秘密值，对该分支进行模糊处理，将所有Basicblock复制到另一条到对应的另一条路径的对应位置，将复制的所有Store指令替换为诱饵Store指令；将诱饵Basicblock中调用的所有函数替换为诱饵函数，诱饵函数中的所有Store指令被诱饵Store指令替换；
在恒定大小的转换过程中，加密函数的源地址和大小也被替换为新指针，该指针填充到固定大小。
本发明的另一目的在于提供一种计算机设备，所述计算机设备包括存储器和处理器，所述存储器存储有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行如下步骤：
跟踪安全区输入数据的数据流，找到依赖于输入数据的分支和循环，此类分支和循环将泄漏有关输入数据的侧信道信息；框架读取EDL文件以获取所有Ecall函数及其参数，作为污点分析的来源；在确定功能和变量之后，使用Phasar进行精确的过程间污点分析，识别依赖于安全区输入数据的分支，循环和操作数；
框架隐藏了由于使用了不同的输入数据而被暴露于输出数据和控制流上的基于接口的侧信道信息；使用分支混淆和循环混淆来缓解不同输入数据之间的 调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据的大小恒定。
本发明的另一目的在于提供一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时，使得所述处理器执行如下步骤：
跟踪安全区输入数据的数据流，找到依赖于输入数据的分支和循环，此类分支和循环将泄漏有关输入数据的侧信道信息；框架读取EDL文件以获取所有Ecall函数及其参数，作为污点分析的来源；在确定功能和变量之后，使用Phasar进行精确的过程间污点分析，识别依赖于安全区输入数据的分支，循环和操作数；
框架隐藏了由于使用了不同的输入数据而被暴露于输出数据和控制流上的基于接口的侧信道信息；使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据的大小恒定。
本发明的另一目的在于提供一种实施所述SGX侧信道攻击防御方法的SGX侧信道攻击防御系统，所述SGX侧信道攻击防御系统包括：
漏洞识别模块，用于跟踪安全区输入数据的数据流，找到依赖于输入数据的分支和循环，此类分支和循环将泄漏有关输入数据的侧信道信息；框架读取EDL文件以获取所有Ecall函数及其参数，作为污点分析的来源；在确定了功能和变量之后，使用Phasar进行精确的过程间污点分析，以识别依赖于安全区输入数据的分支，循环和操作数；
漏洞缓解模块，用于当使用不同的安全区输入数据时，隐藏输出数据和控制流所暴露的基于接口的侧信道信息；使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据的大小恒定。
本发明的另一目的在于提供一种计算机安全控制系统，所述计算机安全控制系统搭载所述的SGX侧信道攻击防御系统。
结合上述的所有技术方案，本发明所具备的优点及积极效果为：Intel Software Guard Extension(SGX)是一种新引入的可信计算技术，它为用户程序 提供了一个称为enclave的独立、安全的执行环境，而无需信任任何特权软件(如操作系统或管理程序)或固件。一些侧信道攻击(例如基于页面错误的攻击、基于缓存的攻击和基于接口的攻击)来泄漏enclave的机密。其中，基于接口的侧信道攻击利用接口处的侧信道信息来推断enclave的秘密，产生基于接口的侧信道攻击的根本原因是不可信权限软件所能观察到的与输入相关的接口调用信息(如接口信息和调用模式)，揭示了安全区内部的控制流，该类攻击尚没有研究提出防御方法。本发明文给出了针对此类基于接口的侧信道攻击的一种可行的防御方法，本发明方法的关键思想是在源代码级别混淆程序，使得程序的控制流与输入无关。并证明了在现代处理器的背景下本发明的转换是安全的。
本发明基于接口的侧信道攻击的根本原因是安全区接口调用(ECALL/OCALL)时不同的数据导致了不同的可观察的接口调用模式(例如，接口调用顺序和调用延迟等)。因此，当其他解决方案试图隐藏症状时，例如控制两条路径的指令数量相等，通过执行无关的程序路径来从根本上解决问题。直观地说，在混淆之后，对手使用不同的输入执行的任何ECALL/OCALL调用通过任何侧信道的视角看起来都是相同的，就好像程序是用相同的输入多次运行一样。真实路径和诱饵路径的唯一区别在于写入内存的值：诱饵路径和真实路径将写入不同的值，但除非对手能够破坏数据加密，否则她无法通过监视数字侧信道来区分诱饵路径和真实路径。
本发明可以抵御几乎所有的基于接口的SGX侧信道攻击；不要求程序本身是秘密的，只要求数据；不需要禁用标准处理器功能，如缓存、分支预听写器和预取器。
本发明为在普通硬件上执行的程序防御基于接口的侧信道攻击。评估机制的安全性，混淆的数据流和控制流是正确的，并且总是保密的；使用信息流在推理规则之上来论证自己的代码不会泄漏信息。展示了本发明抵御简单但强大的基于接口的SGX侧信道攻击。
本发明方案的性能开销比最相似的Raccoon小5％，但Raccoon无法防御所 有基于接口的SGX侧信道攻击。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对本申请实施例中所需要使用的附图做简单的介绍，显而易见地，下面所描述的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下还可以根据这些附图获得其他的附图。
图1是本发明实施例提供的SGX侧信道攻击防御方法流程图。
图2是本发明实施例提供的SGX侧信道攻击防御系统的结构示意图；
图中：1、漏洞识别模块；2、漏洞缓解模块。
图3是本发明实施例提供的示例源程序示意图。
图4是本发明实施例提供的示例源程序的中间语言表示示意图。
图5是本发明实施例提供的转换后的中间语言表示示意图。
图6是本发明实施例提供的本发明与Raccoon开销比较示意图。
具体实施方式
为了使本发明的目的、技术方案及优点更加清楚明白，以下结合实施例，对本发明进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
针对现有技术存在的问题，本发明提供了一种SGX侧信道攻击防御方法、系统、介质、程序及应用，下面结合附图对本发明作详细的描述。
如图1所示，本发明提供的SGX侧信道攻击防御方法包括以下步骤：
S101：跟踪安全区输入数据的数据流，以找到依赖于输入数据的分支和循环，这将泄漏输入数据的信息；框架读取EDL文件以获取所有Ecall函数及其参数，作为污点分析的来源；在确定了功能和变量之后，使用Phasar进行精确 的过程间污点分析，以识别依赖于安全区输入数据的分支，循环和操作数；
S102：框架隐藏了由于使用了不同的输入数据而被暴露于输出数据和控制流上的基于接口的侧信道信息；使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据的大小恒定。
本发明提供的SGX侧信道攻击防御方法业内的普通技术人员还可以采用其他的步骤实施，图1的本发明提供的SGX侧信道攻击防御方法仅仅是一个具体实施例而已。
如图2所示，本发明提供的SGX侧信道攻击防御系统包括：
漏洞识别模块1，用于跟踪安全区输入数据的数据流，找到依赖于输入数据的分支和循环，此类分支和循环将泄漏有关输入数据的侧信道信息；框架读取EDL文件以获取所有Ecall函数及其参数，作为污点分析的来源；在确定了功能和变量之后，使用Phasar进行精确的过程间污点分析，以识别依赖于安全区输入数据的分支，循环和操作数；
漏洞缓解模块2，用于当使用不同的安全区输入数据时，隐藏了输出数据和控制流所暴露的基于接口的侧信道信；使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据的大小恒定。
下面结合附图对本发明的技术方案作进一步的描述。
1、背景知识与相关工作
1.1可信执行环境-Intel SGX
英特尔SGX是一种基于硬件的机制，它可以确保即使攻击者获取了特权软件或对机器的物理访问(例如，内存总线和系统总线)，也可以确保应用程序代码和数据的机密性和完整性。它依赖于实现安全承诺的两种主要机制。第一个是硬件强制的进程隔离机制，该机制使用户级应用程序拥有即使是最高特权的系统软件也无法访问的私有内存。第二种是远程证明机制，它允许远程验证者 验证是否在已启用SGX的系统上建立了安全区以及在安全区内运行的代码的完整性。软件隔离机制由Intel提供的新指令实现。这些指令可用于创建“安全区”，该安全区是只能由创建者进程访问的存储区域。每个安全区都映射到安全区页面高速缓存(EPC)，该高速缓存是由处理器控制的主内存访问中的硬件加密地址空间。EPC的内容仅在处理器内部使用处理器特定的密钥解密。因此，即使特权软件(例如，OS和虚拟机管理器)也不能访问安全区内容。安全区代码始终在用户模式下执行，因此通过系统调用(例如网络或磁盘I/O)与OS进行的任何交互都必须在安全区外部执行。
支持SGX的应用程序开发人员可以使用Intel的SGX SDK创建安全区库，这些库可以装入安全区并由SGX支持的CPU执行。英特尔SGX SDK通过外部调用(OCALL)和安全区入口调用(ECALL)为SGX应用程序提供了一种函数调用机制。开发人员需要定义安全区代码和其他不受信任的应用程序代码之间的接口。具体来说，对安全区的调用称为ECALL，而OCALL允许安全区代码调用不受信任的外部函数。对于每个ECALL，SDK会添加指令以在安全区外部封装参数，并在进去安全区后解除参数封装，然后在安全区内执行函数。对于每个OCALL，添加的SDK代码退出安全区，解除参数封装，并在安全区外执行不受信任的代码，然后重新进入安全区。
远程证明机制是通过使用质询响应协议来生成对安全区的度量值来实现的，该度量值由处理器签名。可以使用英特尔的增强隐私ID(EPID)密码系统来验证该测量结果。通过将软件隔离机制和远程证明机制相结合，远程方可以在接收到隐私数据之前，验证期望代码是否已在安全区域中运行，随后将机密发送到远程系统。收到机密后，远程系统的任何其他部分都无法访问这些机密。
但是，SGX无法防御任何侧信道攻击。特别是，英特尔SGX库在安全区域外运行。因此，OS可以观察到任何安全区调用模式，可以利用这些模式来推断有关安全区输入数据的信息。
1.2软件侧信道攻击
由于对智能手机系统的侧信道攻击取决于PC平台系统中不存在的智能手机系统的特定属性。因此，仅关注针对PC平台的软件侧信道攻击。根据被利用的侧信道的类型将现有的软件侧信道攻击分为四类，包括架构，操作系统资源，操作系统控制通道和接口。以下将详细总结各种旁路攻击。
1)操作系统资源侧信道：
操作系统资源共享和系统资源的公共可访问统计信息(例如上下文切换数，CPU利用率时间，中断计数器等)的共享所生成的操作系统资源侧信道。许多系统在没有任何特权权限的情况下提供此类信息。例如，类似Unix的系统中的proc文件系统是提供内核数据结构接口的伪文件系统。它通常安装在/proc上，并包含有关系统资源的信息。通常在没有特权权限的应用程序之间进行这种旁通道攻击。
堆栈内容，通过Linux系统上的/proc/pid/stat提供的扩展堆栈指针(ESP)和扩展指令指针(EIP)信息的内容窃听用户的按键。
内存跟踪，通过观察多用户系统上的内存占用量和CPU调度统计信息，推断用户访问的网页以及受害者与站点的关系。
数据包统计，借助对procfs提供的传入/传出TCP数据包数量的汇总统计信息，进行TCP序列号推理攻击。
内存页去重，利用通过写时复制页面管理机制重新创建的重复数据消除后的内存页面上的写访问时间差，以识别在受害者的Vitrul计算机(VM)上运行的应用程序。
2)架构侧信道：
通过在攻击者应用程序和受害者应用程序之间共享计算机体系结构硬件，可以生成体系结构侧信道。这种攻击也不需要特权权限。
DRAM，利用攻击者和受害者之间的共享DRAM缓冲区行来监视Firefox地址栏中的击键；针对Intel SGX的Cache-DRAM攻击，该攻击结合了缓存和DRAM行缓冲区信息来监视安全区中与输入有关的分支。
Cache。目前已经提出了Prime+Probe和Flush+Reload方法，这些方法利用了攻击者和受害者之间共享缓存访问延迟的差异来推断受害者的秘密。利用转换后备缓冲区(TLB)打破地址空间布局随机化(ASLR)。Brasser，Gotzfried，Hahnel和Moghimi展示了对SGX的基于缓存的侧信道攻击，以推断安全区中的秘密，例如AES密钥，RSA密钥或安全区中的加密输入数据。
分支目标缓冲区(BTB)。Dmitry当前的BTB侧信道攻击，它可以发现另一个进程或内核的内存布局，从而绕过KASLR方案。Lee通过构造与飞区代码共享分支目标缓冲区(BTB)的代码并观察最后分支记录(LBR)来推断飞区代码的细粒度控制流，来说明分支影子攻击。
推测执行，展示利用分支预测单元恢复秘密密钥的侧信道攻击。Chen等利用推测执行机制窃取位于寄存器中的安全区中的秘密。
3)OS服务(控制)侧信道：
当受害者应用程序运行时，操作系统服务(控制)侧信道攻击会利用恶意操作系统提供的信息。因此，威胁模型包括在这种攻击中具有特权权限的恶意OS。
页面错误。Shinde和Bulck阐述了页面错误攻击，它们有意操纵不受信任的OS管理的页面表以推断安全区域内的秘密。利用当前CPU的超线程功能来刷新PTE条目，该条目可用于进行页面错误攻击而不会产生任何中断。
内存访问地址，Joppe阐述了差分计算分析(DCA)。DCA使用内存访问跟踪来打破白盒加密技术，该技术将加密密钥隐藏在软件程序中。
4)基于RPC接口的侧信道
随着多种可信计算执行(TEE)技术的出现，例如英特尔SGX和ARM TrustZone，使用此类TEE技术的应用程序始终分为可信部分(包)和不可信部分。恶意OS可以观察到这两部分之间的通信。因此，特权系统软件可以收集和分析两个部分之间的接口调用模式。当这些模式依赖于秘密时，它们可能会在敏感部分泄漏敏感信息。这类侧信道即基于接口的侧信道攻击。
SGX平台上的现有侧信道攻击主要集中在体系结构侧信道和OS控制侧信道上。由于安全区是在隔离的内存空间中执行的，并且没有用于统计SGX辅助应用程序的OS资源的统计信息的接口，因此几乎不会利用OS资源侧信道。相比其他类型的侧信道攻击，基于接口的侧信道攻击具有一些优点。首先，它可以精确地收集侧信道信息。SGX平台上所有现有的侧信道攻击都遭受侧信道信息收集假阳率的问题。例如，对不同内存地址的多次内存访问可能会生成相同的缓存集和页面访问跟踪。但是，基于接口的侧信道攻击中的信息收集是精确的。每次调用决定性接口时，本发明都可以收集精确的接口调用信息。其次，它是隐蔽的。当收集侧信道信息时，某些侧信道攻击将产生中断。但是，基于接口的在收集辅助通道信息时不会引入任何中断。最后，基于接口的侧信道攻击是有效的。它只需要执行一次目标程序，即可收集所需的辅助信道信息。尽管多次测量执行时间可以提高时间测量的精度，但是结合其他接口侧信道的时间测量也可以达到良好的攻击效果。
1.3防御方法
本发明将总结现有的侧信道防御技术，并讨论可能适用于基于接口的侧信道攻击的技术。现有的侧信道防御技术主要包括以下几类。
应用强化。应用程序强化策略会修改应用程序代码，以防止敏感信息从侧信道中泄漏。手动或使用特殊编译器隐藏内存访问模式。它们可用于利用缓存和页面错误侧信道来防御侧信道攻击。忽略了可以防御BTB侧信道的分支执行模式。通过将执行时间填充到固定值或预定义值来防御执行处理时间侧信道，从而降低了潜在处理时间的粒度。攻击不依赖于内存访问模式信息和分支执行信息。因此，用于隐藏内存访问模式和分支执行路径的应用程序加固将不适用于基于接口的侧信道攻击。固定的运行时间的可能会在基于接口的侧信道攻击中隐藏接口调用延迟。但是这种机制总是会产生很大的性能开销，并且仅在用于时间侧信道。
限制功能。限制功能策略通过限制辅助通道源，攻击者使用的指令或刷新 辅助通道状态来删除辅助通道。例如，禁用缓存可以防御基于缓存的侧信道攻击，刷新分支状态可以防御基于BTB的侧信道攻击，限制RDTSC可以防止攻击者测量内存访问时间。限制RDTSC似乎可以防御本发明的攻击。但是，这种幼稚的策略将阻止所有程序开发人员分析程序性能，并且还有其他计时测量方法。同样，它仅在本发明的攻击中适用于接口调用延迟通道。
新的软件机制。新的软件机制策略提出了新的软件机制，有助于消除现有的副渠道。将页面调度从OS移至可用于防御页面故障侧信道的应用程序。ORAM技术来隐藏内存访问模式，可以防御基于缓存和基于DRAM的侧信道攻击。使用当前CPU的超线程功能来运行可验证的影子线程，以防止使用超线程进行侧信道攻击。基于接口的侧信道攻击不依赖于内存访问模式和超线程功能。因此，上述防御措施不适用于基于接口的侧信道攻击。
硬件体系结构修改。硬件体系结构修改策略重新设计了当前硬件，以防止侧信道信息泄漏。依靠缓存中的访问随机化来防御基于缓存的侧信道攻击。提出了缓存分区，以确保对安全敏感的代码永远不会与不受信任的进程共享缓存。硬件体系结构修改主要适用于体系结构侧信道攻击。基于接口的侧信道攻击不会在任何硬件体系结构属性上进行中继。因此，这种防御不适用于基于接口的侧信道攻击。
攻击检测。Shih等和Chen等使用Intel的硬件事务存储器来检测由侧信道攻击引起的频繁中断和程序执行时间延迟使用异常缓存未命中来检测基于缓存的侧信道攻击。但是，基于接口的侧信道攻击不会产生中断，基于执行时间的攻击检测只能阻止攻击者使用执行时间信息。攻击者仍然可以使用其他两种接口侧信道信息进行攻击。缓存未命中检测不适用于基于接口的侧信道攻击。
2、威胁模型和假设
本发明假设对手可以监视和篡改处理器I/O引脚上的任何数字信号。本发明还假设处理器是一个密封芯片，所有片外资源(包括DRAM、磁盘和网络设备)都是不可信的，所有读写值都是加密的，并且检查所有读写的完整性。
软件假设。本发明假设对手可以在与受害者的应用程序相同的操作系统和/或硬件上运行恶意应用程序。本发明允许恶意应用程序探测操作系统公开的受害者应用程序的运行时统计信息(例如/proc/pid/stat中的堆栈指针)。
本发明设计假定输入程序没有错误，即(1)程序不包含会导致应用程序崩溃的错误，(2)程序不显示未定义的行为，以及(3)如果是多线程的，则程序不存在数据竞争。在这些假设下，本发明不会引入新的终止通道泄漏，会正确地混淆多线程程序。
本发明静态地将用户代码转换为修改过的二进制代码；本发明假设对手可以访问此转换的二进制代码以及可能存在的任何符号表和调试信息。
3、方案设计
本发明提出了一种方法来自动识别和消除SGX应用程序二进制文件上基于接口的侧信道信息泄漏漏洞。漏洞识别机制基于污点分析。自动缓解机制利用LLVM实现，该机制由分支混淆，循环混淆和恒定大小三种包装器组成。
A.漏洞识别
本发明跟踪安全区输入数据的数据流，找到依赖于输入数据的分支和循环，此类分支和循环将泄漏有关输入数据的侧信道信息。本发明的框架读取EDL文件以获取所有Ecall函数及其参数，作为污点分析的来源。在确定了这些功能和变量之后，本发明使用Phasar进行精确的过程间污点分析，以识别依赖于安全区输入数据的分支，循环和操作数。这些指令需要进行混淆以防止基于接口的侧信道信息泄漏。本发明的污点分析的结果是必须混淆以保护隐私的内存访问和条件分支语句的列表。
B.漏洞缓解
本发明隐藏了由于使用了不同的输入数据而被暴露于输出数据和控制流上的基于接口的侧信道信息。为了隐藏由控制流引起的信息泄漏，本发明使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异。为了隐藏由输出数据引起的信息泄漏，本发明建议使用恒定大小的包装器以使输出 数据的大小恒定。
1)诱饵Store指令：混淆机制的关键组成部分是诱饵Store指令。原始的Store指令接受源操作数和目标操作数，它将源操作数移动到目标。本发明通过将源操作数移动到源操作数本身来实现诱饵Store指令。本发明使用诱饵Store指令以与实际执行路径相同的执行延迟来执行诱饵路径，而无需对程序结果进行任何更改。
2)分支混淆包装器：本发明的分支混淆机制会强制程序在两条路径中执行所有指令，以对分支进行混淆。这遇到了两个挑战：(1)如何在两条路径中执行指令，从而使攻击者只能获得固定的侧通道信息，以及(2)如何确保在诱饵路径中执行的内存更新不会改变原始指令的结果。本发明通过将一个路径的所有原始指令插入到另一路径的开头，然后将另一种路径的所有原始指令插入到原始路径的结尾，来解决第一个挑战。这确保了条件分支指令产生的两个路径的顺序执行。本发明通过用前面描述的诱饵Store指令替换所有插入的Store操作来解决第二个挑战。
对于那些在诱饵路径中的函数调用(它们的参数为指针或引用时可能会更改输入值)，本发明在编译时创建了一个新函数，该函数几乎是原始函数的拷贝，但将其全部Store指令更改为诱饵Store指令。
3)循环混淆包装器：本发明将输入数据相关的循环计数转换为几个固定数以防止信息泄漏。本发明首先执行静态污点分析，以确定哪些循环实际上取决于秘密数据。然后，本发明对受敏感数据影响的循环进行修改，从而在不影响其执行结果的情况下使其不会泄露侧信道信息。本发明无法将循环计数设置为固定数字，因为无法静态确定迭代次数。因此，本发明在运行期间为循环计数器设置一个近似数。本发明使循环体执行大于或等于实际循环次数的最小二乘方次，例如循环体执行了20次，则将循环体的执行次数设置为大于20的最小2乘方，即32次，从而在程序性能和安全性之间取得折衷。并且使用诱饵Store指令使新增加的循环代码不对原始程序的结果产生影响。使用此转换后的代码， 观察到循环计数器为L的对手可以推断出实际的循环跳闸计数L在0.5x L到L之间。但是，L的确切值不会泄露。另外，本发明也允许中开发者手动指定最小和最大循环次数，以减轻暴力破解行为。
4)固定大小包装器：本发明将输出数据大小设置为一个近似数字，以缓解由输出数据引起的信息泄漏。英特尔SGX SDK需要程序员使用[in]/[out]/[user check]注释EDL文件中的指针，以指示指针的使用。本发明假设开发人员使用SGX SDK中提供的被广泛应用的加密库在将数据写入输出缓冲区前对数据进行加密。因此，本发明先找到使用这些加密函数的位置，然后判断其参数是否含有被[out]/[user check]标记的指针，并在这些操作中将源数据填充至固定大小。与循环转换类似，填充大小可以是大于或等于源数据大小的最小二乘方或由开发者提供的大小。
5)同时使用：现在，本发明解释框架如何转换图3所示的代码，该代码用作调用以将某些数据加密到[out]指针。EDL文件中的注释告知Phasar指针的内容是敏感输入。
然后，本发明将源代码转换为LLVM IR，如图4所示。静态污点分析分析到07-08行的分支指令取决于秘密值，因此本发明对该分支进行了模糊处理，这意味着本发明将所有Basicblock复制到另一条到对应的另一条路径的对应位置，但是将复制的所有Store指令替换为诱饵Store指令，诱饵Store指令如图5的第16行所示，其源地址和目的地址相同。本发明还将诱饵Basicblock中调用的所有函数替换为诱饵函数，诱饵函数中的所有Store指令被诱饵Store指令替换。
在恒定大小的转换过程中，加密函数的源地址和大小也被替换为新指针，该指针填充到固定大小，如第11-13行所示。
下面结合安全性分析对本发明的技术方案作进一步的描述。
本发明首先证明混淆程序中的控制流是正确的，并且与秘密值无关。然后，本发明使用跟踪信息流的类型规则，认为本发明的代码不会泄漏秘密信息。本发明通过推理x86处理程序中的异常来说明本发明针对基于接口的SGX侧道攻 击的防御措施。
混淆代码的安全性，本发明认为混淆的控制流和数据流(1)保留了原始程序的依赖关系，而(2)没有透露任何秘密信息。
保留原始程序的依赖关系。在分支混淆包装器中，为了确保正确的控制流，本发明使用前面描述的诱饵Store指令替换所有插入的Store指令，由于诱饵Store指令的源地址和目的地址相同，同时本发明还将诱饵Basicblock中调用的所有函数替换为诱饵函数，诱饵函数中的所有Store指令也被诱饵Store指令替换，所以在诱饵路径中执行的内存更新不会改变原始指令的结果；在循环混淆包装器中，本发明使用循环计数的近似数来代替静态的迭代次数，并且使用诱饵Store指令使新增加的循环代码不对原始程序的结果产生影响。
不会透露秘密信息。在分支和循环混淆包装器中，本发明对诱饵路径进行了混淆。在分支混淆包装器中，本发明通过将一个路径的所有原始指令插入到诱饵路径的开头，然后将诱饵路径的所有原始指令插入到原始路径的结尾，使得攻击者只能获得固定的侧通道信息；循环包装器中将静态的迭代次数转换为实际循环次数的最小二乘方次，这样攻击者只可能推断出迭代次数的区间值，并无法获取确定的循环次数；固定大小包装器可以通过对输出数据大小的填充处理，填充大小可以是大于或等于源数据大小的最小二乘方或由开发者提供的大小，在指令中将源数据填充至固定大小后，可以缓解由输出数据引起的信息泄漏。
本发明方案也可以正确地混淆了多线程代码。在混淆的程序中，真实路径上的加载和Store指令是原子性的，并且是全局可见的，而诱饵路径上的Store指令是仅本地可见的。因此，本发明得出的结论是，混淆代码为单线程和多线程程序维护了正确的数据流。
下面结合性能评估对本发明的技术效果作详细的描述。
1、性能评估
本发明在LLVM编译器框架v10.0.0中实现。在本发明的测试设置中，主机 操作系统是CentOS 7。为了评估性能，本发明使用8个程序。表1总结了它们的特性和相关的输入数据大小。表中的8个程序与用于评估Raccoon的程序相同，本发明使用这些程序将本发明的开销与Raccoon的开销进行比较。本发明使用与Raccoon相似的数据大小。本发明将Raccoon移植为可编译为LLVM IR的语言。所有测试都使用LLVM/Clang编译器工具链。
表1
Figure PCTCN2020107589-appb-000001
本发明在一台具有两个Intel Xeon处理器和16GB(8×2GB)DDR3内存的计算机上运行所有实验。每个处理器有八个内核，带有256KB专用L2缓存。处理器芯片上的八个核心共享20MB的L3缓存。流加密/解密硬件使从加密RAM存储区访问存储器的成本几乎与访问DRAM存储区的成本相同。底层硬件不支持加密的RAM存储区，但是本发明不会在测量中单独添加任何与加密相关的开销，因为带或不带加密的流访问成本几乎相同。
2、混淆开销
本发明的开销主要来源有：控制流混淆的开销(包括缓冲内存访问的开销，复制程序堆栈的开销和CPU寄存器，以及混淆算法和内存访问指令的成本)。当然，开销会随程序特性而变化，例如输入数据的大小，混淆语句的数量和内 存访问语句的数量。图6比较了Raccoon在模拟处理器上和本发明的开销。实验中本发明8个程序中的平均开销约比Raccoon的平均开销低5％，但是Raccoon无法防御所有基于接口的SGX侧信道攻击，本发明几乎可以抵御所有的基于接口的SGX侧信道攻击。
IntelSGX是一种由硬件技术实现的TEE，它被认为是非常有前景的TEE之一。然而，在它是使用过程中可能会遭受到各种各样的侧信道攻击。在本发明中，本发明根据基于接口的侧信道攻击的可行性和能力，设计了一种防御基于接口的SGX侧信道攻击的解决方案，本发明利用程序间污点分析来识别应用程序二进制中基于接口的侧信道信息泄漏，然后使用分支混淆、循环混淆和常量大小封装来防御此类漏洞攻击。该方案基本可以防御所有基于接口的SGX侧信道攻击。最后本发明分析了该方案中混淆代码的安全性以及开销，并在实验中取得了较好的性能。
应当注意，本发明的实施方式可以通过硬件、软件或者软件和硬件的结合来实现。硬件部分可以利用专用逻辑来实现；软件部分可以存储在存储器中，由适当的指令执行系统，例如微处理器或者专用设计硬件来执行。本领域的普通技术人员可以理解上述的设备和方法可以使用计算机可执行指令和/或包含在处理器控制代码中来实现，例如在诸如磁盘、CD或DVD-ROM的载体介质、诸如只读存储器(固件)的可编程的存储器或者诸如光学或电子信号载体的数据载体上提供了这样的代码。本发明的设备及其模块可以由诸如超大规模集成电路或门阵列、诸如逻辑芯片、晶体管等的半导体、或者诸如现场可编程门阵列、可编程逻辑设备等的可编程硬件设备的硬件电路实现，也可以用由各种类型的处理器执行的软件实现，也可以由上述硬件电路和软件的结合例如固件来实现。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，凡在本发明的精神和原则之内所作的任何修改、等同替换和改进等，都应涵盖在本发明的保护范围之内。

Claims (10)

  1. 一种SGX侧信道攻击防御方法，其特征在于，所述SGX侧信道攻击防御方法包括：
    跟踪安全区输入数据的数据流，找到依赖于输入数据的分支和循环，此类分支和循环将泄漏有关输入数据的侧信道信息；框架读取EDL文件以获取所有Ecall函数及其参数，作为污点分析的来源；在确定功能和变量之后，使用Phasar进行精确的过程间污点分析，识别依赖于安全区输入数据的分支，循环和操作数；
    隐藏了由于使用了不同的输入数据而被暴露于输出数据和控制流上的基于接口的侧信道信息；使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据的大小恒定。
  2. 如权利要求1所述的SGX侧信道攻击防御方法，其特征在于，将所述SGX侧信道攻击防御方法的污点分析的结果混淆以保护输出数据和控制流不泄漏基于接口的侧信道信息。
  3. 如权利要求1所述的SGX侧信道攻击防御方法，其特征在于，所述框架隐藏了由于使用了不同的输入数据而被暴露于输出数据和控制流上的基于接口的侧信道信息；使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据的大小恒定，包括：
    1)诱饵Store指令：混淆机制的关键组成部分是诱饵Store指令；
    2)分支混淆包装器：分支混淆机制会强制程序在两条路径中执行所有指令，以对分支进行混淆；
    3)循环混淆包装器，将输入数据相关的循环计数转换为几个固定数以防止信息泄漏；
    4)固定大小包装器，将输出数据大小设置为一个近似数字；
    5)同时使用，框架转换代码，代码用作调用以将某些数据加密到[out]指针，EDL文件中的注释告知Phasar指针的内容是敏感输入。
  4. 如权利要求3所述的SGX侧信道攻击防御方法，其特征在于，所述诱 饵Store指令：原始的Store指令接受源操作数和目标操作数，将源操作数移动到目标；通过将源操作数移动到源操作数本身实现诱饵Store指令；使用诱饵Store指令以使得诱饵路径与真实执行路径具有相同的执行延迟；
    所述分支混淆包装器，通过将一个路径的所有原始指令插入到另一路径的开头，然后将另一种路径的所有原始指令插入到原始路径的结尾；通过用前面描述的诱饵Store指令替换所有插入的Store指令；
    对于在诱饵路径中的函数调用在编译时创建了一个新函数，将新函数中的全部Store指令更改为诱饵Store指令。
  5. 如权利要求3所述的SGX侧信道攻击防御方法，其特征在于，所述循环混淆包装器首先执行静态污点分析，以确定哪些循环实际上取决于秘密数据；然后，对受敏感数据影响的循环进行修改；在运行期间为循环计数器设置一个近似数，使循环体执行大于或等于实际循环次数的最小二乘方次；
    所述固定大小包装器先找到使用加密函数的位置，判断其参数是否含有被[out]/[user check]标记的指针，并将函数参数中的源数据填充至固定大小。
  6. 如权利要求1所述的SGX侧信道攻击防御方法，其特征在于，所述SGX侧信道攻击防御方法将源代码转换为LLVM IR，静态污点分析到某条分支指令取决于秘密值，则对该分支进行模糊处理，将所有Basicblock复制到另一条路径的对应位置，将诱饵Basicblock中调用的所有函数替换为诱饵函数，诱饵函数中的所有Store指令被诱饵Store指令替换；
    在恒定大小的转换过程中，加密函数的源地址和大小也被替换为新指针，该指针填充到固定大小。
  7. 一种计算机设备，其特征在于，所述计算机设备包括存储器和处理器，所述存储器存储有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行如下步骤：
    跟踪安全区输入数据的数据流，找到依赖于输入数据的分支和循环，此类分支和循环将泄漏有关输入数据的侧信道信息；框架读取EDL文件以获取所有 Ecall函数及其参数，作为污点分析的来源；在确定功能和变量之后，使用Phasar进行精确的过程间污点分析，识别依赖于安全区输入数据的分支，循环和操作数；
    框架隐藏了由于使用了不同的输入数据而被暴露于输出数据和控制流上的基于接口的侧信道信息；使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据的大小恒定。
  8. 一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时，使得所述处理器执行如下步骤：
    跟踪安全区输入数据的数据流，找到依赖于输入数据的分支和循环，此类分支和循环将泄漏有关输入数据的侧信道信息；框架读取EDL文件以获取所有Ecall函数及其参数，作为污点分析的来源；在确定功能和变量之后，使用Phasar进行精确的过程间污点分析，识别依赖于安全区输入数据的分支，循环和操作数；
    框架隐藏了由于使用了不同的输入数据而被暴露于输出数据和控制流上的基于接口的侧信道信息；使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据的大小恒定。
  9. 一种实施权利要求1～6任意一项所述SGX侧信道攻击防御方法的SGX侧信道攻击防御系统，其特征在于，所述SGX侧信道攻击防御系统包括：
    漏洞识别模块，用于跟踪安全区输入数据的数据流，找到依赖于输入数据的分支和循环，此类分支和循环将泄漏有关输入数据的信息；框架读取EDL文件以获取所有Ecall函数及其参数，作为污点分析的来源；在确定了功能和变量之后，使用Phasar进行精确的过程间污点分析，以识别依赖于安全区输入数据的分支，循环和操作数；
    漏洞缓解模块，用于当使用不同的安全区输入数据时，隐藏输出数据和控制流所暴露的基于接口的侧信道信息；使用分支混淆和循环混淆来缓解不同输入数据之间的调用顺序和调用延迟差异；使用恒定大小的包装器以使输出数据 的大小恒定。
  10. 一种计算机安全控制系统，其特征在于，所述计算机安全控制系统搭载权利要求9所述的SGX侧信道攻击防御系统。
PCT/CN2020/107589 2020-06-08 2020-08-07 Sgx侧信道攻击防御方法、系统、介质、程序及应用 WO2021248665A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010514306.4 2020-06-08
CN202010514306.4A CN111865909B (zh) 2020-06-08 2020-06-08 Sgx侧信道攻击防御方法、系统、介质、程序及应用

Publications (1)

Publication Number Publication Date
WO2021248665A1 true WO2021248665A1 (zh) 2021-12-16

Family

ID=72987478

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/107589 WO2021248665A1 (zh) 2020-06-08 2020-08-07 Sgx侧信道攻击防御方法、系统、介质、程序及应用

Country Status (2)

Country Link
CN (1) CN111865909B (zh)
WO (1) WO2021248665A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114357389A (zh) * 2021-12-31 2022-04-15 北京大学 一种基于llvm的指令加花混淆方法及装置
CN115329346A (zh) * 2022-10-09 2022-11-11 支付宝(杭州)信息技术有限公司 一种检测侧信道漏洞的方法和装置
CN116527729A (zh) * 2023-07-03 2023-08-01 厦门泛卓信息科技有限公司 一种基于Web3的分布式数据管理系统

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113127880A (zh) * 2021-03-25 2021-07-16 华东师范大学 一种一级数据缓存中推测执行侧信道漏洞检测方法
CN113779578B (zh) * 2021-09-13 2024-01-19 支付宝(杭州)信息技术有限公司 移动端应用的智能混淆方法和系统
CN114268479B (zh) * 2021-12-14 2023-08-18 北京奕斯伟计算技术股份有限公司 防御共享存储侧信道攻击的处理方法、装置及电子设备
CN114389978B (zh) * 2021-12-21 2024-04-02 中国人民解放军32802部队 一种基于静态污点分析的网络协议侧信道检测方法和系统
CN114531284B (zh) * 2022-02-03 2024-02-09 百果园技术(新加坡)有限公司 数据加密方法、装置、电子设备及存储介质
CN115292723B (zh) * 2022-10-09 2023-03-24 支付宝(杭州)信息技术有限公司 一种检测侧信道漏洞的方法和装置
CN117521061B (zh) * 2024-01-05 2024-03-15 南京南自华盾数字技术有限公司 一种基于二进制转换器的定时旁路攻击安全防护方法
CN117749529A (zh) * 2024-02-19 2024-03-22 中汽智联技术有限公司 一种查找全量攻击路径的方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170255416A1 (en) * 2016-03-04 2017-09-07 Mingwei Zhang Technologies to defeat secure enclave side-channel attacks using fault-oriented programming
CN109543401A (zh) * 2018-11-23 2019-03-29 中国人民解放军战略支援部队信息工程大学 基于控制流锁的sgx侧信道攻击防御方法
CN109829313A (zh) * 2019-02-28 2019-05-31 中国人民解放军战略支援部队信息工程大学 一种基于代码复用编程防御sgx侧信道攻击的方法及装置
CN109995505A (zh) * 2019-03-07 2019-07-09 西安电子科技大学 一种雾计算环境下数据安全去重系统及方法、云存储平台

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103714000A (zh) * 2013-12-18 2014-04-09 杭州电子科技大学 一种面向敏感区域的嵌入式软件测试用例生成方法
US10333699B1 (en) * 2015-09-30 2019-06-25 Cryptography Research, Inc. Generating a pseudorandom number based on a portion of shares used in a cryptographic operation
CN106709356B (zh) * 2016-12-07 2019-05-24 西安电子科技大学 基于静态污点分析和符号执行的安卓应用漏洞挖掘方法
CN106940773B (zh) * 2017-01-10 2019-10-25 西安电子科技大学 基于静态污点数据分析的隐私泄漏漏洞检测确认方法
CN109684840B (zh) * 2018-12-20 2021-06-25 西安电子科技大学 基于敏感调用路径的Android恶意软件检测方法
CN110119302B (zh) * 2019-04-23 2023-07-21 上海隔镜信息科技有限公司 虚拟机监视器以及虚拟可信执行环境构建方法
CN110572382B (zh) * 2019-09-02 2021-05-18 西安电子科技大学 基于smote算法和集成学习的恶意流量检测方法
CN111163056B (zh) * 2019-12-06 2021-08-31 西安电子科技大学 一种针对MapReduce计算的数据保密方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170255416A1 (en) * 2016-03-04 2017-09-07 Mingwei Zhang Technologies to defeat secure enclave side-channel attacks using fault-oriented programming
CN109543401A (zh) * 2018-11-23 2019-03-29 中国人民解放军战略支援部队信息工程大学 基于控制流锁的sgx侧信道攻击防御方法
CN109829313A (zh) * 2019-02-28 2019-05-31 中国人民解放军战略支援部队信息工程大学 一种基于代码复用编程防御sgx侧信道攻击的方法及装置
CN109995505A (zh) * 2019-03-07 2019-07-09 西安电子科技大学 一种雾计算环境下数据安全去重系统及方法、云存储平台

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114357389A (zh) * 2021-12-31 2022-04-15 北京大学 一种基于llvm的指令加花混淆方法及装置
CN114357389B (zh) * 2021-12-31 2024-04-16 北京大学 一种基于llvm的指令加花混淆方法及装置
CN115329346A (zh) * 2022-10-09 2022-11-11 支付宝(杭州)信息技术有限公司 一种检测侧信道漏洞的方法和装置
CN116527729A (zh) * 2023-07-03 2023-08-01 厦门泛卓信息科技有限公司 一种基于Web3的分布式数据管理系统
CN116527729B (zh) * 2023-07-03 2023-09-05 厦门泛卓信息科技有限公司 一种基于Web3的分布式数据管理系统

Also Published As

Publication number Publication date
CN111865909B (zh) 2021-05-28
CN111865909A (zh) 2020-10-30

Similar Documents

Publication Publication Date Title
WO2021248665A1 (zh) Sgx侧信道攻击防御方法、系统、介质、程序及应用
Van Bulck et al. SGX-Step: A practical attack framework for precise enclave execution control
Chen et al. Detecting privileged side-channel attacks in shielded execution with Déjá Vu
Hähnel et al. {High-Resolution} Side Channels for Untrusted Operating Systems
Shih et al. T-SGX: Eradicating Controlled-Channel Attacks Against Enclave Programs.
Lee et al. Inferring fine-grained control flow inside {SGX} enclaves with branch shadowing
Gruss et al. Strong and efficient cache {Side-Channel} protection using hardware transactional memory
Maene et al. Hardware-based trusted computing architectures for isolation and attestation
Li et al. {CIPHERLEAKS}: Breaking Constant-time Cryptography on {AMD}{SEV} via the Ciphertext Side Channel
Strackx et al. Fides: Selectively hardening software application components against kernel-level or process-level malware
US10095862B2 (en) System for executing code with blind hypervision mechanism
US9756048B2 (en) System and methods for executing encrypted managed programs
Daniels et al. S μ v-the security microvisor: a virtualisation-based security middleware for the internet of things
Ammar et al. S $\mu $ μ V—The Security MicroVisor: A Formally-Verified Software-Based Security Architecture for the Internet of Things
Williams et al. CPU support for secure executables
Lu et al. Stopping memory disclosures via diversification and replicated execution
Jurczyk et al. Identifying and exploiting windows kernel race conditions via memory access patterns
Silva et al. Dynsgx: A privacy preserving toolset for dinamically loading functions into intel (r) sgx enclaves
Kim et al. SGX-LEGO: Fine-grained SGX controlled-channel attack and its countermeasure
Polychronou et al. A comprehensive survey of attacks without physical access targeting hardware vulnerabilities in iot/iiot devices, and their detection mechanisms
US20230058863A1 (en) Countermeasures against side-channel attacks on secure encrypted virtualization (sev)-secure nested paging (sev-snp) processors
Kumar et al. Hardware-assisted mechanisms to enforce control flow integrity: A comprehensive survey
Van Bulck Microarchitectural Side-Channel Attacks for Privileged Software Adversaries
Moon et al. Architectural supports to protect os kernels from code-injection attacks
Wang et al. DTrace: Fine-grained and efficient data integrity checking with hardware instruction tracing

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20940279

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20940279

Country of ref document: EP

Kind code of ref document: A1