WO2022011818A1 - 一种基于arm指针验证的内核敏感数据完整性保护方法 - Google Patents

一种基于arm指针验证的内核敏感数据完整性保护方法 Download PDF

Info

Publication number
WO2022011818A1
WO2022011818A1 PCT/CN2020/114971 CN2020114971W WO2022011818A1 WO 2022011818 A1 WO2022011818 A1 WO 2022011818A1 CN 2020114971 W CN2020114971 W CN 2020114971W WO 2022011818 A1 WO2022011818 A1 WO 2022011818A1
Authority
WO
WIPO (PCT)
Prior art keywords
sensitive data
sensitive
code
pac
operating system
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/114971
Other languages
English (en)
French (fr)
Inventor
申文博
杨昱天
周亚金
任奎
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Zhejiang University
Original Assignee
Zhejiang University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Zhejiang University filed Critical Zhejiang University
Publication of WO2022011818A1 publication Critical patent/WO2022011818A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes

Definitions

  • the invention relates to the field of computer system security, in particular to a protection method for the integrity of kernel sensitive data based on ARM pointer authentication (Pointer Authentication, PA).
  • ARM pointer authentication Pointer Authentication, PA
  • the operating system is the basis for the operation of the computer system, and any security problems on it will directly endanger the overall security of the system.
  • Attacks targeting operating systems have emerged in recent years, such as Stuxnet in 2010 and the WannaCry worm ransomware from 2017 to 2019.
  • According to the evolution of attack methods attacks on operating systems are mainly divided into three categories: code injection attacks, code reuse attacks, and uncontrolled data attacks.
  • operating system security has been greatly improved in the continuous confrontation between attackers and defenders.
  • mainstream operating systems have implemented hardware-based anti-code injection attack protection. . Due to its ubiquity, code reuse attacks have been widely studied by industry and academia, and some mature protection methods such as Control-Flow Integrity (CFI) have been deployed on practical software. , the effective attack surface of code reuse attacks is shrinking.
  • CFI Control-Flow Integrity
  • non-controlled data attacks can directly tamper with sensitive data in the system and provide attackers with illegal rights; however, the means of tampering with sensitive data are concealed and difficult to detect and monitor, posing a major threat to operating system security. . Due to the lack of dedicated hardware support, the current software-based sensitive data protection introduces excessive performance overhead, hindering its large-scale deployment.
  • the purpose of the embodiments of the present invention is to provide a kernel sensitive data integrity protection method based on ARM pointer verification, so as to solve the problem of excessive performance overhead introduced by software-based sensitive data protection.
  • the embodiment of the present invention provides a kernel sensitive data integrity protection method based on ARM pointer verification, including:
  • the identified sensitive pointers combined with the semantics of the operating system kernel code, identify all operations of reading and writing memory through sensitive pointers, among which the operation of writing memory through sensitive pointers is referred to as sensitive writing, and the operation of reading memory through sensitive pointers is referred to as sensitive reading;
  • the operating system kernel code As follows: insert the sensitive data PAC generation code StoreSign key (sensdata) after the sensitive write code, insert the sensitive data PAC verification code LoadAuth key after the sensitive read code (sensdata), where key represents the 128-bit PA key, and sensdata represents sensitive data.
  • the inserted PAC generation code is dynamically executed to generate the PAC of the sensitive data
  • the inserted PAC verification code is dynamically executed to verify the PAC of the sensitive data. , if the PAC verification is passed, the sensitive data is complete; otherwise, the integrity of the sensitive data is destroyed;
  • the PA key initialization code enables the PA feature of the ARM CPU and initializes the PA key with a random number
  • the sensitive data specified by the user in the operating system kernel code analyze the global variables in the operating system kernel code, and determine all the global variables in the operating system kernel that contain sensitive data;
  • the global sensitive data initialization code calls the StoreSign key (gsensdata) for all global sensitive data variables, where gsensdata represents global sensitive data .
  • receive sensitive data specified by the user in the operating system kernel code including:
  • Receive the attribute declaration __attribute__ provided by the compiler to specify the sensitive data in the operating system kernel, where the sensitive data is a single byte or a data block composed of multiple bytes.
  • point-to-point analysis is performed on user-specified sensitive data, including:
  • the CLA algorithm is used to analyze the sensitive data specified by the user based on the LLVM intermediate representation code of the entire kernel.
  • the steps of inserting the sensitive data PAC generating code StoreSign key (sensdata) after the sensitive writing code includes:
  • (5-4) Take PAC n-1 as the PAC of sensitive data, and store the sensitive data in a position adjacent to the high address of the sensitive data.
  • the step of inserting the PAC verification code LoadAuth key (sensdata) of the sensitive data after the sensitive reading code includes:
  • the operating system kernel can run normally; if the verification fails, the execution of the operating system is stopped, and an alarm is notified of the abnormality of the operating system kernel.
  • the beneficial effect of the present invention is that the present invention uses the pointing analysis technology to identify all sensitive pointers, which saves time and effort compared to manual analysis and can cover all sensitive pointers; Inserting PAC generation and PAC verification codes can protect the integrity of all sensitive data; the invention realizes protection based on the PA hardware characteristics of ARM, and greatly reduces performance overhead compared with software implementation.
  • FIG. 1 is a flowchart of a method for protecting the integrity of kernel sensitive data based on ARM pointer verification provided by an embodiment of the present invention
  • Figure 2 is a block chain pointer verification code generation algorithm for generating pointer verification codes for kernel sensitive data blocks.
  • FIG. 1 is a flowchart of a method for protecting the integrity of kernel sensitive data based on ARM pointer verification provided by an embodiment of the present invention
  • a method for protecting the integrity of kernel sensitive data based on ARM pointer verification provided in this embodiment the present embodiment Taking the protection of sensitive data of the Linux operating system kernel as an example, the method includes the following steps:
  • Step S101 receiving sensitive data specified by the user in the operating system kernel code
  • this embodiment modifies the front end of the LLVM compiler to support the new attribute declaration __attribute__((sensitive)); the user declares sensitive data through the new attribute declaration __attribute__((sensitive)), where the sensitive data is controlled by the kernel
  • the developer specifies that it can be data of any size at any location in memory, either a single byte or a data block composed of multiple bytes.
  • Step S102 point and analyze the sensitive data specified by the user, and identify all sensitive pointers that may point to the sensitive data;
  • this example uses the LTO compilation mode of LLVM to compile the intermediate representation (Intermediate Representation, IR) bytecode of the entire operating system kernel; the CLA algorithm (Heintze, N., & Tardieu, O) is used on the intermediate representation bytecode. .(2001).Ultra-fast aliasing analysis using CLA:A million lines of C code in a second.ACM SIGPLAN Notices, 36(5), 254-263.) Point analysis to the sensitive data declared in step S101, identify to all sensitive pointers that might point to sensitive data.
  • IR Intermediate Representation
  • Step S103 identify all operations of reading and writing memory through the sensitive pointer, wherein the operation of writing memory through the sensitive pointer is referred to as sensitive writing, and the operation of reading memory through the sensitive pointer is referred to as sensitive writing. read; specifically, including the following sub-steps:
  • Step S104 modify the operating system kernel code as follows: insert the PAC generation code StoreSign key (sensdata) of the sensitive data after the sensitive writing code, insert the PAC verification of the sensitive data after the sensitive reading code Code LoadAuth key (sensdata), where key represents a 128-bit PA key, and sensdata represents sensitive data.
  • Figure 2 illustrates the block chain PAC generation algorithm used in StoreSign key (sensdata) and LoadAuth key (sensdata), corresponding to sub-steps (5-1), (5-2), (5-3), (6-1) ), (6-2) and (6-3).
  • the step of generating the code StoreSign key (sensdata) from the PAC of the sensitive data includes the following sub-steps:
  • (5-4) Take PAC n-1 as the PAC of sensitive data, and store the sensitive data in a position adjacent to the high address of the sensitive data.
  • the step of LoadAuth key (sensdata) of the PAC verification code for sensitive data includes the following sub-steps:
  • the operating system kernel can run normally; if the verification fails, the execution of the operating system is stopped, and an alarm is notified of the abnormality of the operating system kernel.
  • Step S105 insert PA key initialization code keyinit() in operating system kernel startup code, this PA key initialization code opens the PA characteristic of ARM CPU and initializes PA key with random number;
  • PA key initialization code keyinit() is inserted after the boot_init_stack_canary() statement in start_kernel().
  • keyinit() should be located after the random number generator initialization function of the Linux operating system, because keyinit() needs to call the random number generator.
  • Step S106 according to the sensitive data specified by the user in the operating system kernel code, analyze the global variables in the operating system kernel code, and determine all the global variables in the operating system kernel that contain sensitive data;
  • the global variables declared in the bytecode are enumerated and the global variables containing sensitive data are recorded.
  • Step S107 insert the global sensitive data initialization code sensvar_init() after keyinit(), the global sensitive data initialization code calls the StoreSign key (gsensdata) on all global sensitive data variables, where gsensdata represents Globally sensitive data.
  • this step initializes the PAC for global sensitive data.
  • the global sensitive data has integrity by default during initialization.
  • the present invention directly generates the PAC corresponding to the global sensitive data when the operating system kernel starts, so that the global sensitive data can pass the LoadAuth key (sensdata) when it is read by the operating system kernel for the first time. Integrity verification.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Medical Informatics (AREA)
  • Storage Device Security (AREA)

Abstract

一种基于ARM指针验证的内核敏感数据完整性保护方法，利用通用指针验证码对操作系统内核中用户指定的敏感数据提供完整性保护。此方法包括如下步骤：(1)通过指向分析技术定位操作系统内核代码中所有对敏感数据的读写；(2)插入指针验证指令使得：向内存写入敏感数据前生成并写入指针验证码，从内存读入敏感数据后检查指针验证码；(3)修改操作系统内核启动代码，在启动早期初始化指针验证特性，随后初始化全局敏感数据的指针验证码。此方法利用指针验证技术高效地保护了操作系统内核敏感数据的完整性。

Description

一种基于ARM指针验证的内核敏感数据完整性保护方法 技术领域
本发明涉及计算机系统安全领域，尤其涉及一种基于ARM指针验证(Pointer Authentication,PA)的内核敏感数据完整性的保护方法。
背景技术
操作系统是计算机系统运行的基础，其上任何安全问题会直接危害系统整体安全。近年来，针对操作系统的攻击层出不穷，如2010年的震网病毒和2017到2019年的WannaCry蠕虫式勒索病毒。根据攻击手段的演化，对操作系统的攻击主要分为三类：代码注入攻击、代码重用攻击以及非控制数据攻击。与此同时，操作系统安全在攻击者和防护者的不断对抗中得到很大提升，随着抗代码注入攻击硬件安全特性的大规模部署，主流操作系统均已实现基于硬件的抗代码注入攻击防护。而代码重用攻击由于其普遍性，针对它的系统防护方法一直被工业界和学术界广泛研究，一些成熟的防护方法比如控制流完整性(Control-Flow Integrity,CFI)已经在实用的软件上部署，代码重用攻击的有效攻击面正日益收缩。
与前两类攻击相比，非控制数据攻击可以直接篡改系统中的敏感数据，为攻击者提供非法权限；然而对敏感数据的篡改手段隐蔽，难以被检测、监控，对操作系统安全构成重大威胁。由于缺乏专门硬件支持，目前基于软件实现的敏感数据保护引入性能开销过大，阻碍了其大规模部署。
发明内容
本发明实施例的目的是提供一种基于ARM指针验证的内核敏感数据完整性保护方法，以解决基于软件实现的敏感数据保护引入的性能开销过大的问题。
为了达到上述目的，本发明实施例所采用的技术方案如下：
本发明实施例提供一种基于ARM指针验证的内核敏感数据完整性保护方法，包括：
接收用户在操作系统内核代码中指定的敏感数据；
对用户指定的敏感数据进行指向分析，识别所有可能指向敏感数据的敏感指针；
根据识别到的敏感指针，结合操作系统内核代码的语义，识别所有通过敏感指针读写内存的操作，其中通过敏感指针写内存的操作简称敏感写，通过敏感指针读内存的操作简称敏感读；
根据识别出的敏感读写操作，对操作系统内核代码进行如下修改：在敏感写代码后插入敏感数据的PAC生成代码StoreSign key(sensdata)，在敏感读代码后插入敏感数据的PAC验证代码LoadAuth key(sensdata)，其中key表示128bit的PA密钥，sensdata表示敏感数据，当操作系统内核运行时，动态执行插入的PAC生成代码生成敏感数据的PAC，动态执行插入的PAC验证代码验证敏感数据的PAC，若PAC验证通过，则敏感数据完整，反之，则敏感数据完整性被破坏；
在操作系统内核启动代码中插入PA密钥初始化代码keyinit()，该PA密钥初始化代码开启ARM CPU的PA特性并用随机数初始化PA密钥；
根据用户在操作系统内核代码中指定的敏感数据，分析操作系统内核代码中的全局变量，确定操作系统内核中所有包含了敏感数据的全局变量；
根据确定的包含敏感数据的全局变量，在keyinit()之后插入全局敏感数据初始化代码sensvar_init()，该全局敏感数据初始化代码对所有全局敏感数据变量调用StoreSign key(gsensdata)，其中gsensdata表示全局敏感数据。
进一步地，接收用户在操作系统内核代码中指定的敏感数据，包括：
接收用户通过编译器提供的属性声明__attribute__指定操作系统内核中的敏感数据，其中敏感数据是单个字节，或是多个字节组成的数据块。
进一步地，对用户指定的敏感数据进行指向分析，包括：
在操作系统内核代码编译的LTO阶段，采用CLA算法基于整个内核的LLVM中间表示码对用户指定的敏感数据进行指向分析。
进一步地，结合操作系统内核代码的语义，识别所有通过敏感指针读写内存的操作，包括：
(4-1)在操作系统内核代码编译的LTO阶段，逐个扫描整个内核的LLVM中间表示码中的每条指令；
(4-2)如果当前指令为LOAD指令或是内存块拷贝函数，且其源操作数为敏感指针，则标记当前指令为敏感读指令；
(4-3)如果当前指令为STORE指令或是内存块拷贝函数，且其源操作数为敏感指针，则标记当前指令为敏感写指令。
进一步地，在敏感写代码后插入敏感数据的PAC生成代码StoreSign key(sensdata)的步骤，包括：
(5-1)将敏感数据分成以8字节为单位的数据块D 0，D 1，…，D n-1，其中n为数据块的数目；
(5-2)以第一块数据块D 0作为输入，以D 0所在的内存地址ADDR 0作为修饰符，用PA密 钥key计算得到PAC 0＝Sign key(D 0，ADDR 0)；
(5-3)依次以每块数据块为输入，以上一次迭代结果的PAC作为修饰符，迭代计算PAC i＝Sign key(D i，PAC i-1)(0＜i＜n)；
(5-4)将PAC n-1作为敏感数据的PAC，存入敏感数据高地址相邻的位置。
进一步地，在敏感读代码后插入敏感数据的PAC验证代码LoadAuth key(sensdata)的步骤，包括：
(6-1)将敏感数据分成以8字节为单位的数据块D 0，D 1，…，D n-1，其中n为数据块的数目；
(6-2)以第一块数据块D 0作为输入，以D 0所在的内存地址ADDR 0作为修饰符，用PA密钥key计算得到PAC 0＝Sign key(D 0，ADDR 0)；
(6-3)依次以每块数据块为输入，以上一次迭代结果的PAC作为修饰符，迭代计算PAC i＝Sign key(D i，PAC i-1)(0＜i＜n)；
(6-4)取出敏感数据高地址相邻位置保存的PAC并与PAC n-1进行比较，如果一致，则敏感数据完整，验证通过；如果不一致，则敏感数据完整性被破坏，验证失败；
(6-5)如果验证通过，则操作系统内核可以正常运行；如果验证失败，则停止操作系统的执行，并警报通知操作系统内核的异常。
根据以上技术方案，本发明的有益效果是，本发明利用指向分析技术识别所有的敏感指针，相比于人工分析省时省力且能覆盖所有的敏感指针；本发明在所有的敏感读写处自动插入PAC生成和PAC验证代码，能保护所有敏感数据的完整性；本发明基于ARM的PA硬件特性实现保护，相比于软件实现性能开销大幅降低。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本发明的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为本发明实施例提供的一种基于ARM指针验证的内核敏感数据完整性保护方法的流程图；
图2是针对内核敏感数据块生成指针验证码的块链式指针验证码生成算法。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的 附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
图1为本发明实施例提供的一种基于ARM指针验证的内核敏感数据完整性保护方法的流程图；本实施例提供的一种基于ARM指针验证的内核敏感数据完整性保护方法，本实施例以保护Linux操作系统内核的敏感数据为例来进行说明，该方法包括以下步骤：
步骤S101，接收用户在操作系统内核代码中指定的敏感数据；
具体地，本实施例修改了LLVM编译器的前端使其支持新的属性声明__attribute__((sensitive))；用户通过新的属性声明__attribute__((sensitive))声明敏感数据，其中敏感数据由内核开发者指定，可以是内存中任意位置任意大小的数据，既可以是单个字节，也可以是多个字节组成的数据块。
步骤S102，对用户指定的敏感数据进行指向分析，识别所有可能指向敏感数据的敏感指针；
具体地，本实例使用LLVM的LTO编译模式编译得到整个操作系统内核的中间表示(Intermediate Representation,IR)字节码；在中间表示字节码上采用CLA算法(Heintze,N.,& Tardieu,O.(2001).Ultra-fast aliasing analysis using CLA:A million lines of C code in a second.ACM SIGPLAN Notices,36(5),254-263.)对步骤S101中声明的敏感数据进行指向分析，识别到所有可能指向敏感数据的敏感指针。
步骤S103，根据识别到的敏感指针，结合操作系统内核代码的语义，识别所有通过敏感指针读写内存的操作，其中通过敏感指针写内存的操作简称敏感写，通过敏感指针读内存的操作简称敏感读；具体地，包括以下子步骤：
(4-1)根据步骤S102得到的整个操作系统内核的IR字节码，逐个扫描整个内核的LLVM中间表示码中的每条指令；
(4-2)如果当前指令为LOAD指令或是内存块拷贝函数，且其源操作数为敏感指针，则标记当前指令为敏感读指令；
(4-3)如果当前指令为STORE指令或是内存块拷贝函数，且其源操作数为敏感指针，则标记当前指令为敏感写指令。
步骤S104，根据识别出的敏感读写操作，对操作系统内核代码进行如下修改：在敏感写代码后插入敏感数据的PAC生成代码StoreSign key(sensdata)，在敏感读代码后插入敏感数据的PAC验证代码LoadAuth key(sensdata)，其中key表示128bit的PA密钥，sensdata表示敏感数据。图2说明了StoreSign key(sensdata)和LoadAuth key(sensdata)中使用的块链式PAC生成算法， 对应子步骤(5-1)、(5-2)、(5-3)、(6-1)、(6-2)和(6-3)。
其中，敏感数据的PAC生成代码StoreSign key(sensdata)的步骤，包括以下子步骤：
(5-1)将敏感数据分成以8字节为单位的数据块D 0，D 1，…，D n-1，其中n为数据块的数目；
(5-2)以第一块数据块D 0作为输入，以D 0所在的内存地址ADDR 0作为修饰符，用PA密钥key计算得到PAC 0＝Sign key(D 0，ADDR 0)；
(5-3)依次以每块数据块为输入，以上一次迭代结果的PAC作为修饰符，迭代计算PAC i＝Sign key(D i，PAC i-1)(0＜i＜n)；
(5-4)将PAC n-1作为敏感数据的PAC，存入敏感数据高地址相邻的位置。
其中，敏感数据的PAC验证代码LoadAuth key(sensdata)的步骤，包括以下子步骤：
(6-1)将敏感数据分成以8字节为单位的数据块D 0，D 1，…，D n-1，其中n为数据块的数目；
(6-2)以第一块数据块D 0作为输入，以D 0所在的内存地址ADDR 0作为修饰符，用PA密钥key计算得到PAC 0＝Sign key(D 0，ADDR 0)；
(6-3)依次以每块数据块为输入，以上一次迭代结果的PAC作为修饰符，迭代计算PAC i＝Sign key(D i，PAC i-1)(0＜i＜n)；
(6-4)取出敏感数据高地址相邻位置保存的PAC并与PAC n-1进行比较，如果一致，则敏感数据完整，验证通过；如果不一致，则敏感数据完整性被破坏，验证失败；
(6-5)如果验证通过，则操作系统内核可以正常运行；如果验证失败，则停止操作系统的执行，并警报通知操作系统内核的异常。
步骤S105，在操作系统内核启动代码中插入PA密钥初始化代码keyinit()，该PA密钥初始化代码开启ARM CPU的PA特性并用随机数初始化PA密钥；
具体地，PA密钥初始化代码keyinit()被插入到start_kernel()中的boot_init_stack_canary()语句之后。keyinit()应该位于Linux操作系统的随机数生成器初始化函数之后，因为keyinit()需要调用随机数生成器。
步骤S106，根据用户在操作系统内核代码中指定的敏感数据，分析操作系统内核代码中的全局变量，确定操作系统内核中所有包含了敏感数据的全局变量；
具体地，根据步骤S102得到的整个Linux操作系统内核的IR字节码，枚举字节码中声明的全局变量并记录其中包含敏感数据的全局变量。
步骤S107，根据确定的包含敏感数据的全局变量，在keyinit()之后插入全局敏感数据初始化代码sensvar_init()，该全局敏感数据初始化代码对所有全局敏感数据变量调用 StoreSign key(gsensdata)，其中gsensdata表示全局敏感数据。
具体地，本步骤为全局敏感数据初始化PAC。全局敏感数据在初始化时默认具有完整性，本发明在操作系统内核启动时直接生成全局敏感数据对应的PAC，使全局敏感数据在第一次被操作系统内核读取时能够通过LoadAuth key(sensdata)当中的完整性验证。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (6)

  1. 一种基于ARM指针验证的内核敏感数据完整性保护方法，其特征在于，包括：
    接收用户在操作系统内核代码中指定的敏感数据；
    对用户指定的敏感数据进行指向分析，识别所有可能指向敏感数据的敏感指针；
    根据识别到的敏感指针，结合操作系统内核代码的语义，识别所有通过敏感指针读写内存的操作，其中通过敏感指针写内存的操作简称敏感写，通过敏感指针读内存的操作简称敏感读；
    根据识别出的敏感读写操作，对操作系统内核代码进行如下修改：在敏感写代码后插入敏感数据的PAC生成代码StoreSign key(sensdata)，在敏感读代码后插入敏感数据的PAC验证代码LoadAuth key(sensdata)，其中key表示128bit的PA密钥，sensdata表示敏感数据，当操作系统内核运行时，动态执行插入的PAC生成代码生成敏感数据的PAC，动态执行插入的PAC验证代码验证敏感数据的PAC，若PAC验证通过，则敏感数据完整，反之，则敏感数据完整性被破坏；
    在操作系统内核启动代码中插入PA密钥初始化代码keyinit()，该PA密钥初始化代码开启ARM CPU的PA特性并用随机数初始化PA密钥；
    根据用户在操作系统内核代码中指定的敏感数据，分析操作系统内核代码中的全局变量，确定操作系统内核中所有包含了敏感数据的全局变量；
    根据确定的包含敏感数据的全局变量，在keyinit()之后插入全局敏感数据初始化代码sensvar_init()，该全局敏感数据初始化代码对所有全局敏感数据变量调用StoreSign key(gsensdata)，其中gsensdata表示全局敏感数据。
  2. 根据权利要求1所述一种基于ARM指针验证的内核敏感数据完整性保护方法，其特征在于，接收用户在操作系统内核代码中指定的敏感数据，包括：
    接收用户通过编译器提供的属性声明__attribute__指定操作系统内核中的敏感数据，其中敏感数据是单个字节，或是多个字节组成的数据块。
  3. 根据权利要求1所述一种基于ARM指针验证的内核敏感数据完整性保护方法，其特征在于，对用户指定的敏感数据进行指向分析，包括：
    在操作系统内核代码编译的LTO阶段，采用CLA算法基于整个内核的LLVM中间表示码对用户指定的敏感数据进行指向分析。
  4. 根据权利要求1所述一种基于ARM指针验证的内核敏感数据完整性保护方法，其特征在于，结合操作系统内核代码的语义，识别所有通过敏感指针读写内存的操作，包括：
    (4-1)在操作系统内核代码编译的LTO阶段，逐个扫描整个内核的LLVM中间表示码中的每条指令；
    (4-2)如果当前指令为LOAD指令或是内存块拷贝函数，且其源操作数为敏感指针，则标记当前指令为敏感读指令；
    (4-3)如果当前指令为STORE指令或是内存块拷贝函数，且其源操作数为敏感指针，则标记当前指令为敏感写指令。
  5. 根据权利要求1所述一种基于ARM指针验证的内核敏感数据完整性保护方法，其特征在于，在敏感写代码后插入敏感数据的PAC生成代码StoreSign key(sensdata)的步骤，包括：
    (5-1)将敏感数据分成以8字节为单位的数据块D 0，D 1，...，D n-1，其中n为数据块的数目；
    (5-2)以第一块数据块D 0作为输入，以D 0所在的内存地址ADDR 0作为修饰符，用PA密钥key计算得到PAC 0＝Sign key(D 0，ADDR 0)；
    (5-3)依次以每块数据块为输入，以上一次迭代结果的PAC作为修饰符，迭代计算PAC i＝Sign key(D i，PAC i-1)(0＜i＜n)；
    (5-4)将PAC n-1作为敏感数据的PAC，存入敏感数据高地址相邻的位置。
  6. 根据权利要求1所述一种基于ARM指针验证的内核敏感数据完整性保护方法，其特征在于，在敏感读代码后插入敏感数据的PAC验证代码LoadAuth key(sensdata)的步骤，包括：
    (6-1)将敏感数据分成以8字节为单位的数据块D 0，D 1，...，D n-1，其中n为数据块的数目；
    (6-2)以第一块数据块D 0作为输入，以D 0所在的内存地址ADDR 0作为修饰符，用PA密钥key计算得到PAC 0＝Sign key(D 0，ADDR 0)；
    (6-3)依次以每块数据块为输入，以上一次迭代结果的PAC作为修饰符，迭代计算PAC i＝Sign key(D i，PAC i-1)(0＜i＜n)；
    (6-4)取出敏感数据高地址相邻位置保存的PAC并与PAC n-1进行比较，如果一致，则敏感数据完整，验证通过；如果不一致，则敏感数据完整性被破坏，验证失败；
    (6-5)如果验证通过，则操作系统内核可以正常运行；如果验证失败，则停止操作系统的执行，并警报通知操作系统内核的异常。
PCT/CN2020/114971 2020-07-14 2020-09-14 一种基于arm指针验证的内核敏感数据完整性保护方法 Ceased WO2022011818A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010674762.5 2020-07-14
CN202010674762.5A CN111881485B (zh) 2020-07-14 2020-07-14 一种基于arm指针验证的内核敏感数据完整性保护方法

Publications (1)

Publication Number Publication Date
WO2022011818A1 true WO2022011818A1 (zh) 2022-01-20

Family

ID=73150796

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/114971 Ceased WO2022011818A1 (zh) 2020-07-14 2020-09-14 一种基于arm指针验证的内核敏感数据完整性保护方法

Country Status (2)

Country Link
CN (1) CN111881485B (zh)
WO (1) WO2022011818A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN119830281A (zh) * 2024-11-29 2025-04-15 清华大学 内存漏洞防护方法、装置、电子设备及存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113032737B (zh) * 2021-03-15 2021-11-30 清华大学 软件的保护方法、装置、电子设备及存储介质
CN119004443B (zh) * 2024-07-29 2025-11-04 浙江大学 一种针对内核文件系统中可攻击数据的识别和防护方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090249289A1 (en) * 2008-03-28 2009-10-01 Microsoft Corporation Detecting memory errors using write integrity testing
CN108573143A (zh) * 2017-03-10 2018-09-25 南京大学 基于程序插桩和动态信息验证的栈保护方法
CN109918903A (zh) * 2019-03-06 2019-06-21 西安电子科技大学 一种基于llvm编译器的程序非控制数据攻击防护方法
CN110717181A (zh) * 2019-09-09 2020-01-21 中国人民解放军战略支援部队信息工程大学 基于新型程序依赖图的非控制数据攻击检测方法及装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9021605B2 (en) * 2007-01-03 2015-04-28 International Business Machines Corporation Method and system for protecting sensitive data in a program
CN104809401B (zh) * 2015-05-08 2017-12-19 南京大学 一种操作系统内核完整性保护方法
CN107194252B (zh) * 2017-05-09 2019-11-22 华中科技大学 一种完全上下文敏感的程序控制流完整性保护方法和系统
US10528740B2 (en) * 2017-06-15 2020-01-07 International Business Machines Corporation Securely booting a service processor and monitoring service processor integrity
CN110069935B (zh) * 2019-03-20 2020-12-01 上海交通大学 基于标记内存的内部敏感数据保护方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090249289A1 (en) * 2008-03-28 2009-10-01 Microsoft Corporation Detecting memory errors using write integrity testing
CN108573143A (zh) * 2017-03-10 2018-09-25 南京大学 基于程序插桩和动态信息验证的栈保护方法
CN109918903A (zh) * 2019-03-06 2019-06-21 西安电子科技大学 一种基于llvm编译器的程序非控制数据攻击防护方法
CN110717181A (zh) * 2019-09-09 2020-01-21 中国人民解放军战略支援部队信息工程大学 基于新型程序依赖图的非控制数据攻击检测方法及装置

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
YUTIAN YANG; SONGBO ZHU; WENBO SHEN; YAJIN ZHOU; JIADONG SUN; KUI REN: "ARM Pointer Authentication based Forward-Edge and Backward-Edge Control Flow Integrity for Kernels", ARXIV.ORG, CORNELL UNIVERSITY LIBRARY, 201 OLIN LIBRARY CORNELL UNIVERSITY ITHACA, NY 14853, 23 December 2019 (2019-12-23), 201 Olin Library Cornell University Ithaca, NY 14853 , XP081565329 *
ZHANG XIAOZAN: "Non-control-data Protection in Programs", CHINESE DOCTORAL DISSERTATIONS FULL-TEXT DATABASE (ELECTRONIC JOURNAL), no. 2, 29 February 2020 (2020-02-29), XP055887107, DOI: 10.27389/d.cnki.gxadu.2019.001613 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN119830281A (zh) * 2024-11-29 2025-04-15 清华大学 内存漏洞防护方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN111881485B (zh) 2022-04-05
CN111881485A (zh) 2020-11-03

Similar Documents

Publication Publication Date Title
Cadar et al. Data randomization
US11784786B2 (en) Mitigating security vulnerabilities with memory allocation markers in cryptographic computing systems
CN111770206B (zh) 一种部署智能合约的方法、区块链节点和存储介质
Volckaert et al. Cloning your gadgets: Complete ROP attack immunity with multi-variant execution
Bigelow et al. Timely rerandomization for mitigating memory disclosures
US7254586B2 (en) Secure and opaque type library providing secure data protection of variables
CN109918903B (zh) 一种基于llvm编译器的程序非控制数据攻击防护方法
Akritidis et al. Preventing memory error exploits with WIT
Ruwase et al. A practical dynamic buffer overflow detector.
Denis-Courmont et al. Camouflage: Hardware-assisted CFI for the ARM Linux kernel
US20030126453A1 (en) Processor supporting execution of an authenticated code instruction
US20090249289A1 (en) Detecting memory errors using write integrity testing
WO2008002350A1 (en) Securing software by enforcing data flow integrity
WO1998011690A9 (en) Self-decrypting digital information system and method
Ismail et al. Tightly seal your sensitive pointers with {PACTight}
CN112100686B (zh) 一种基于arm指针验证的内核代码指针完整性保护方法
CN111881485A (zh) 一种基于arm指针验证的内核敏感数据完整性保护方法
JP2011170836A (ja) 情報処理装置及びプログラム、情報処理方法、記録媒体
JP7820886B2 (ja) 境界外参照を行うプログラムの安全な実行
CN117972799A (zh) 一种应用于arm处理器的指针保护方法、计算机系统
Duan et al. Refactoring the FreeBSD kernel with Checked C
JP2886969B2 (ja) プログラム変換方法
Younan et al. A methodology for designing countermeasures against current and future code injection attacks
Iyer et al. Preventing overflow attacks by memory randomization
Jurczyk Detecting kernel memory disclosure with x86 emulation and taint tracking

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20945542

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20945542

Country of ref document: EP

Kind code of ref document: A1