WO2022193629A1 - 软件的保护方法、装置、电子设备及存储介质 - Google Patents

软件的保护方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2022193629A1
WO2022193629A1 PCT/CN2021/123329 CN2021123329W WO2022193629A1 WO 2022193629 A1 WO2022193629 A1 WO 2022193629A1 CN 2021123329 W CN2021123329 W CN 2021123329W WO 2022193629 A1 WO2022193629 A1 WO 2022193629A1
Authority
WO
WIPO (PCT)
Prior art keywords
sensitive data
read
software
data
memory
Prior art date
Application number
PCT/CN2021/123329
Other languages
English (en)
French (fr)
Inventor
张超
谭闻德
李媛
刘莹
吴建平
Original Assignee
清华大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 清华大学 filed Critical 清华大学
Priority to EP21931204.8A priority Critical patent/EP4310702A1/en
Publication of WO2022193629A1 publication Critical patent/WO2022193629A1/zh
Priority to US18/467,252 priority patent/US20240004967A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/40—Transformation of program code
    • G06F8/41—Compilation
    • G06F8/43—Checking; Contextual analysis
    • G06F8/433—Dependency analysis; Data or control flow analysis
    • G06F8/434—Pointers; Aliasing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/121—Restricting unauthorised execution of programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/121—Restricting unauthorised execution of programs
    • G06F21/125—Restricting unauthorised execution of programs by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/30—Creation or generation of source code
    • G06F8/37—Compiler construction; Parser generation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/40—Transformation of program code
    • G06F8/41—Compilation

Definitions

  • the present invention relates to computer technology, and in particular, to a software protection method, device, electronic device and storage medium.
  • the present invention provides a software protection method, device, electronic device and storage medium.
  • the present invention provides a method for protecting software, including: identifying sensitive data in software source code, and determining a use point of the sensitive data; setting the sensitive data in the compiled product of the software source code In the read-only section, the sensitive data is stored in the read-only area when the software is running; at the use point of the sensitive data, a check code is inserted, wherein the check code is used to check the read data when the software is running Whether the sensitive data is in the read-only area, and determine whether to continue to run the software according to the result of the check.
  • the identifying sensitive data in the software source code, and determining the use point of the sensitive data includes: identifying data with a special marker as the sensitive data; determining whether the sensitive data is related to the sensitive data The location where the associated memory read instruction is located is the use point of the sensitive data, wherein the memory read instruction is used to read the sensitive data through a pointer.
  • the method before the identifying the data with a special marker as the sensitive data, the method further includes: identifying an instruction containing a sensitive operation in the software source code according to a preset rule, and using the special marker mark the data used by the instruction; associate the data with the memory read instruction.
  • the method further includes: marking the memory read instruction with the special marker; inserting a check code at the usage point of the sensitive data, including: reading the marked memory Before the instruction, the check code is inserted; or the marked memory read instruction is modified into a memory read code including the check code.
  • the setting of the sensitive data in the read-only section of the compiled product of the software source code includes: identifying a legal value set of the sensitive data, forming a whitelist, and placing the whitelist The data in the list is set in the read-only section of the compiled product of the software source code; the sensitive data is set as the data in the white list.
  • determining whether to continue to run the software according to the check result includes: if the read sensitive data is in the read-only area, continue to run the software; if the read sensitive data is not in the read-only area In the area, the running software is blocked.
  • the checking code is generated based on the characteristics of different processors, hardware or operating systems.
  • the present invention provides a software protection device, comprising: an identification module for identifying sensitive data in software source code and determining a usage point of the sensitive data; a processing module for setting the sensitive data in the In the read-only section of the compiled product of the software source code, so that the sensitive data is stored in the read-only area when the software is running; the inserting module is used for inserting the checking code at the usage point of the sensitive data, wherein all the The checking code is used to check whether the read sensitive data is in the read-only area when the software is running, and determine whether to continue to run the software according to the checking result.
  • the present invention provides an electronic device, comprising: at least one processor and a memory; the memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one The processor performs the method of any one of the first aspects.
  • the present invention provides a readable storage medium, where computer-executable instructions are stored in the readable storage medium, and when a processor executes the computer-executable instructions, the method according to any one of the first aspects is implemented .
  • the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements the method according to any one of the first aspects.
  • the software protection method, device, electronic device and storage medium provided by the present invention identify sensitive data in the software source code and determine the use point of the sensitive data; set the sensitive data in the compiled product of the software source code In the read-only section of the software, the sensitive data is stored in the read-only area when the software is running; at the use point of the sensitive data, a check code is inserted, wherein the check code is used to check the read data when the software is running. Whether the retrieved sensitive data is in the read-only area, and whether to continue to run the software is determined according to the check result; that is, in this embodiment of the present invention, by inserting a check code at the point of use of the sensitive data, the software can check to be read by calling the check code when running. Whether the retrieved sensitive data is in the read-only area, so as to realize the integrity verification of the sensitive data, and thus prevent the sensitive data from being damaged while the performance overhead is small.
  • Fig. 1 is the schematic diagram that the sensitive data of the prior art is destroyed
  • FIG. 2 is a schematic diagram of three mechanisms for verifying the integrity of sensitive data in the prior art
  • FIG. 3 is a schematic flowchart of a software protection method provided by the present invention.
  • FIG. 5 is a schematic diagram of a protection method for software provided by the present invention.
  • FIG. 6 is a schematic structural diagram of a software protection device provided by the present invention.
  • FIG. 7 is a schematic structural diagram of an electronic device provided by the present invention.
  • sensitive operations include but are not limited to: program control flow jump (program counter update), sensitive API calls (such as system() function, SQL query, etc.), security checks (various whitelist checks, etc.), key business operations ( Such as transfer, password decryption, etc.).
  • the operands of sensitive operations, that is, sensitive data include but are not limited to: operands of program control flow jumps (function return addresses, function pointers, etc.), parameters of sensitive API calls (commands executed by the system() function, SQL queries) statement parameters), the whitelist configuration used for security checks, the number of operations of key business operations (such as the recipient address of the transfer operation, the ciphertext input of the decryption operation), and so on.
  • FIG. 1 is a schematic diagram of sensitive data being destroyed in the prior art.
  • sensitive data such as a possible value of 1
  • the malicious value is used at the point of use of the sensitive information.
  • an attacker can corrupt function pointers or function return addresses to hijack program control flow, or corrupt parameters of sensitive API functions such as system() or execve() to perform dangerous operations (such as command injection attacks, SQL injection attacks), which are The most popular and harmful type of attack today.
  • Attackers can also compromise the whitelist configuration used in security checks, such as user identifiers (uid), conditional flags, or other metadata (such as configuration information, policy information, or shadow memory), etc., to bypass deployed security protections measures or launch data-oriented attacks. Attackers can also destroy the operands of key business operations, such as hijacking the recipient address of the transfer operation, decrypting the target ciphertext, and so on.
  • FIG. 2 is a schematic diagram of three mechanisms for verifying the integrity of sensitive data in the prior art.
  • the first type of mechanism ensures that illegal memory writes do not occur by performing safety checks at data definition points (memory writes). Solutions such as SoftBound and AddressSanitizer implement boundary checking or timing checking at the software level, providing strong data flow integrity protection, but with high performance overhead.
  • MPX Memory Protection EXtension
  • MTE Memory Tagging Extension
  • the second type of mechanism provides data flow integrity protection by isolating sensitive data such as code pointers and preventing potentially harmful memory write operations from destroying sensitive data.
  • the HDFI Hardware-Assisted Data-flow Isolation, hardware-assisted data flow isolation
  • IMIX In-Process Memory Isolation Extension, In-Process Memory Isolation Extension
  • the memory isolation extension associates each memory page with a 1-bit memory tag, thereby providing strong data flow isolation and security guarantees.
  • Intel MPK Memory Protection Keys, memory protection keys
  • ARM DACR Domain Access Control Register, domain access control register
  • Intel SMAP Supervisor Mode Access Prevention, privileged access prevention
  • Intel SMEP Supervisor Mode Execution Prevention, privileged execution prevention
  • ARM PAN Primaryvileged Access never, privileged access prevention
  • RISC-V SUM Supervisor User Memory, privileged Hardware features such as state user memory access
  • the third type of mechanism protects sensitive operations by verifying data integrity at the point of use, ensuring that operands used by sensitive operations have not been tampered with.
  • the ARM PA Pointer Authentication
  • the ARM PA Pointer Authentication mechanism realizes the integrity verification of sensitive data based on the block cipher algorithm. It has been initially applied in products such as Apple mobile phones, and has achieved good protection effects, but its performance overhead is large.
  • Schemes such as StackGuard verify the integrity of the return address by placing Canary/Cookie on the stack and verifying whether the Canary/Cookie is destroyed before the function returns, but its defense strength is low.
  • the technical idea of the present invention is: by inserting a check code at the sensitive data usage point, the software can check whether the sensitive data to be read is in the read-only area through the called check code during running, so as to realize the sensitive data Data integrity verification, which in turn protects sensitive data from corruption with low performance overhead.
  • FIG. 3 is a schematic flowchart of a software protection method provided by the present invention.
  • the protection methods of the software include:
  • Step 101 Identify sensitive data in the software source code, and determine the usage point of the sensitive data.
  • the execution body of the present invention is a compiler in an electronic device, such as an LLVM/Clang compiler, and this embodiment can be implemented by extending the compiler.
  • the extended compiler compiles it.
  • the extended compiler identifies sensitive operations provided by the user or sensitive operations described by predefined rules.
  • sensitive operations include: program control flow jump (program counter update), sensitive API calls (such as system() function, SQL query, etc.), security checks (various whitelist checks, etc.), key business operations (such as transfers, password decryption, etc.); the extended compiler automatically identifies the call points for these sensitive operations in the software (that is, the use points of sensitive data), and the sensitive data used by the sensitive operations.
  • the step S101 includes: identifying data with a special marker as the sensitive data; determining that the location of a memory read instruction associated with the sensitive data is a usage point of the sensitive data, Wherein, the memory read instruction is used to read the sensitive data through a pointer.
  • sensitive data is marked with special markers.
  • users can mark data (or called Value objects) on the LLVM Compiler Intermediate Representation (LLVM IR) through a software-provided interface (for example, named ROLoad- md flag); this data can then be associated with certain LLVM IR memory read instructions, indicating that the data read by these IR memory read instructions needs to be protected.
  • LLVM IR LLVM Compiler Intermediate Representation
  • the method before the identifying the data with a special marker as the sensitive data, the method further includes: identifying an instruction containing a sensitive operation in the software source code according to a preset rule, and marking it with the special marker data used by the instruction; associate the data with the memory read instruction.
  • Step 102 Set the sensitive data in the read-only section of the compiled product of the software source code, so that the sensitive data is stored in the read-only area when the software is running.
  • the sensitive data can be set in the read-only section of the compiled product of the software source code, so that the compiled product (that is, the executable file) can place the sensitive data in the read-only memory area of the software process when the compiled product (that is, the executable file) is loaded and run. .
  • the step S102 includes: identifying a legal value set of sensitive data, forming a whitelist, and setting the data in the whitelist in the read-only section of the compiled product of the software source code; Set the sensitive data as data in the whitelist.
  • the extended compiler automatically identifies a set (whitelist) of valid operand values for sensitive data.
  • whitelists consist of a series of immutable data. Examples of these whitelists include, but are not limited to: C++ software virtual function tables, function pointer tables customized by software developers, formatted strings and hardcoded configuration information, whitelist policies for security checks, and collections for transfer operations Addresses, initiators of sensitive operations, etc.
  • the method proposed in the present invention automatically identifies the whitelist information through program analysis or a user-specified manner.
  • the whitelist is not explicitly defined in the software source code, for example, the targets of indirect control flow transfer can be calculated at compile time or runtime, but they are not directly written in the software source code. , for these cases, the present invention precomputes these whitelists at compile time. That is to say, the user can create a whitelist file and specify the whitelist information in the file, so that the LLVM Pass can obtain the whitelist information after reading the corresponding file; the source code can also be analyzed based on the LLVM Pass, and parts can be automatically identified and constructed.
  • Whitelist of sensitive data such as virtual function table of C++ software, etc.
  • the extended compiler places this immutable whitelisted data in a tamper-resistant area to keep it safe from corruption (or pollution).
  • the present invention selects a read-only page in the memory as a tamper-proof area, that is, the present invention can place the whitelist data in a read-only section in the executable file. To achieve protection, after the executable file is loaded and run, the data is stored in the read-only memory area of the process.
  • the present invention changes the use of sensitive data in the software to memory access to the whitelist data placed in the read-only memory, and automatically modifies the software to ensure correctness.
  • Step 103 Insert a check code at the use point of the sensitive data, wherein the check code is used to check whether the read sensitive data is in the read-only area when the software is running, and determine whether to continue according to the check result. Run the software.
  • the extended compiler inserts checking code at the point of use of sensitive data, calls the checking code when the software is running, and verifies the read-only attribute of the sensitive data; if the runtime verification is successful, the software continues to execute; at runtime If the verification fails, the blocking software continues to execute. That is, the present invention can restrict that only data from tamper-resistant (read-only memory) areas can be used at sensitive data use points, and can prevent contaminated or corrupted data (non-read-only data) from being used at sensitive data use points , which mitigates memory attacks and protects sensitive software operations.
  • the method further includes: marking the memory read instruction with the special marker; the step S103 includes: inserting the check code before the marked memory read instruction; or The memory read instructions marked above are modified to memory read codes including check codes.
  • the extended compiler analyzes the software source code in detail, and analyzes each instruction to determine whether the instruction has a sensitive operation (including but not limited to virtual function calls, etc.). If an instruction has a sensitive operation, the LLVM Pass analyzes the source of its operand, finds the corresponding IR memory read instruction, and marks the instruction with ROLoad-md; then modifies all IR memory read instructions marked by ROLoad-md one by one, and The check code is inserted before the marked memory read instruction; or the marked memory read instruction is modified into a memory read code including the check code.
  • a sensitive operation including but not limited to virtual function calls, etc.
  • the checking code is generated based on the characteristics of different processors, hardware or operating systems.
  • the extended compiler builds and generates function codes that can verify the read-only property of the data.
  • the hardware features of some platforms may provide permission settings and checks for read-only memory pages, and some operating systems provide access permission information for memory pages or provide read-only memory address ranges, etc. These features or information can be used to check whether the target data is in read-only memory area.
  • the extended compiler can construct corresponding functional codes to verify the read-only properties of sensitive data.
  • the sensitive data in the software is identified, and the use point of the sensitive data is determined; the sensitive data is set in the read-only section of the compiled product of the software source code, so that the software Sensitive data is stored in the read-only area at runtime; at the point of use of the sensitive data, a check code is inserted, wherein the check code is used to check whether the read sensitive data is in the read-only area when the software is running , and determine whether to continue to run the software according to the inspection result; that is, the present invention inserts the inspection code at the sensitive data usage point, so that the software can check whether the sensitive data to be read is in the read-only area through the invoked inspection code when it is running, In this way, the integrity verification of sensitive data is realized, and the sensitive data is prevented from being damaged while the performance overhead is small.
  • FIG. 4 is a schematic flowchart of another software protection method provided by the present invention. As shown in FIG. 4 , the software protection method includes:
  • Step 201 Identify sensitive data in the software source code, and determine the usage point of the sensitive data.
  • Step 202 Set the sensitive data in the read-only section of the compiled product of the software source code, so that the sensitive data is stored in the read-only area when the software is running.
  • Step 203 Insert an inspection code at the usage point of the sensitive data.
  • Step 204 when the software is running, determine whether the read sensitive data is in the read-only area according to the check code.
  • step 205 If yes, go to step 205; if not, go to step 206.
  • Step 204 continue to run the software.
  • Step 205 blocking the running software.
  • Steps 201, 202, and 203 in this embodiment are respectively similar to the implementation of inserting check codes at the use points of the sensitive data in steps 101, 102, and 103 in the previous embodiment, and will not be performed here. Repeat.
  • this embodiment further defines a specific implementation manner of judging whether to continue running the software.
  • the software continues to run; if the read sensitive data is not in the read-only area, the software is blocked from running.
  • the run-time verification of the read-only attribute fails, it means that the operand of the sensitive operation of a certain sensitive instruction (that is, the sensitive data) is not in the read-only memory area of the process.
  • Hardware features of the target platform or features provided by the operating system to block the process from continuing to execute such as sending a segmentation fault signal to the process, SIGSEGV) to ensure that only data in read-only memory areas can be accessed by such sensitive instructions or sensitive operations. use.
  • the verification of read-only attributes and the blocking of processes can be accomplished by the same hardware feature of the target platform or the same feature provided by the operating system.
  • FIG. 5 is a schematic diagram of a software protection method provided by the present invention.
  • sensitive data such as possible value 1, possible value 2... possible value N, etc.
  • the software runs through the pointer to read; under normal circumstances, the software runs through the pointer to obtain the sensitive data stored in the read-only area; when an attacker attacks the pointer, it is possible to point the pointer to the attacker.
  • the desired area but in this embodiment, because the check code detects that the sensitive data is not read in the read-only area, a segmentation fault signal will be issued to block the continued operation of the software.
  • the read sensitive data is in the read-only area, continue to run the software; if the read sensitive data is not in the read-only area, block the running software, that is, through the verification Whether the read sensitive data is in the read-only area, realize the integrity verification of the sensitive data, and then prevent the sensitive data from being damaged while the performance overhead is small.
  • FIG. 6 is a schematic structural diagram of a software protection device provided by the present invention. As shown in FIG. 6 , the protection device includes:
  • the identification module 10 is used to identify the sensitive data in the software source code and determine the usage point of the sensitive data; the processing module 20 is used to set the sensitive data in the read-only section of the compiled product of the software source code, so that the sensitive data is stored in the read-only area when the software is running; the inserting module 30 is used for inserting a check code at the usage point of the sensitive data, wherein the check code is used for checking the read code when the software is running Check whether the acquired sensitive data is in the read-only area, and determine whether to continue running the software according to the check result.
  • the identifying module 10 is specifically configured to: identify data with a special marker as the sensitive data; determine that the location of a memory read instruction associated with the sensitive data is the sensitive data A point of use of data, wherein the memory read instruction is used to read the sensitive data through a pointer.
  • the identifying module 10 is further configured to: identify an instruction containing a sensitive operation in the software source code according to a preset rule, and use the special marker to mark the data used by the instruction;
  • the data is associated with a memory read instruction.
  • the identifying module 10 is further configured to: mark the memory read instruction with the special marker; the inserting module 30 is specifically configured to: insert the marked memory read instruction before the marked memory read instruction the check code; or modify the marked memory read instruction into a memory read code including the check code.
  • the processing module 20 is specifically configured to: identify a legal value set of sensitive data, form a white list, and set the data in the white list in the compiled product of the software source code. Read-only section; set the said sensitive data as data in the whitelist.
  • determining whether to continue to run the software according to the check result includes: if the read sensitive data is in the read-only area, continue to run the software; if the read sensitive data is not in the read-only area In the area, the running software is blocked.
  • the checking code is generated based on the characteristics of different processors, hardware or operating systems.
  • the software protection device is used to identify sensitive data in the software source code and determine the use point of the sensitive data through the identification module; the processing module is used to set the sensitive data in the software source code.
  • the sensitive data is stored in the read-only area when the software is running; the insertion module is used for inserting checking code at the usage point of the sensitive data, wherein the checking code is used in the When the software is running, check whether the read sensitive data is in the read-only area, and determine whether to continue to run the software according to the check result, that is, the present invention inserts the check code at the use point of the sensitive data, so that when the software is running, through the calling
  • the checking code checks whether the sensitive data to be read is in the read-only area, so as to realize the integrity verification of the sensitive data, and thus prevent the sensitive data from being damaged while the performance overhead is small.
  • FIG. 7 is a schematic diagram of the hardware structure of an electronic device provided by the present invention, as shown in FIG. 7 , including:
  • At least one processor 701 executes the computer-executed instructions stored in the memory 702 , so that the at least one processor 701 executes the above method, wherein the processor 701 and the memory 702 are connected through a bus 703 .
  • the processor may be a central processing unit (English: Central Processing Unit, CPU for short), or other general-purpose processors, digital signal processors (English: Digital Signal Processor, referred to as: DSP), application specific integrated circuit (English: Application Specific Integrated Circuit, referred to as: ASIC) and so on.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in conjunction with the invention can be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the memory may include high-speed RAM memory, and may also include non-volatile storage NVM, such as at least one disk memory.
  • the bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. .
  • ISA Industry Standard Architecture
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into address bus, data bus, control bus and so on.
  • the buses in the drawings of the present application are not limited to only one bus or one type of bus.
  • the present invention also provides a readable storage medium, where computer-executable instructions are stored in the readable storage medium, and when the processor executes the computer-executable instructions, the above method is implemented.
  • the above-mentioned readable storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM) , Erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Magnetic or Optical Disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read only memory
  • EPROM Erasable Programmable Read Only Memory
  • PROM Programmable Read Only Memory
  • ROM Read Only Memory
  • Magnetic Memory Flash Memory
  • Magnetic or Optical Disk Magnetic Disk
  • An exemplary readable storage medium is coupled to the processor such that the processor can read information from, and write information to, the readable storage medium.
  • the readable storage medium can also be an integral part of the processor.
  • the processor and the readable storage medium may be located in an application specific integrated circuit (Application Specific Integrated Circuits, ASIC for short).
  • ASIC Application Specific Integrated Circuits
  • the processor and the readable storage medium may also exist in the device as discrete components.
  • the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements the above method.
  • the computer program is stored in the memory 702 and configured to be executed by the processor 701 to implement the above method.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Technology Law (AREA)
  • Multimedia (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)

Abstract

本发明提供的软件的保护方法、装置、电子设备及存储介质，通过识别软件源代码中的敏感数据，并确定敏感数据的使用点；将所述敏感数据设置在所述软件源代码的编译产物的只读节中，以使软件运行时将敏感数据存储在只读区内；在所述敏感数据的使用点，插入检查代码，其中，所述检查代码用于在软件运行时，检查所读取的敏感数据是否在只读区内，并根据检查结果确定是否继续运行软件；即本发明通过在敏感数据使用点插入检查代码，使得软件在运行时，通过调用的检查代码检查要读取的敏感数据是否在只读区内，从而实现对敏感数据的完整性验证，进而在性能开销较小的同时防御敏感数据被破坏。

Description

软件的保护方法、装置、电子设备及存储介质
本申请要求于2021年03月15日提交中国专利局、申请号为202110289668.2、申请名称为“软件的保护方法、装置、电子设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及计算机技术，尤其涉及一种软件的保护方法、装置、电子设备及存储介质。
背景技术
计算机软件一直以来面临着严重的安全威胁，其中内存破坏漏洞是一种最为广泛存在的安全威胁，这些漏洞常被攻击者利用，用于破坏敏感操作所使用的敏感数据，进而劫持或者破坏敏感操作。
现有技术中，针对上述威胁，最根本性的防御方案是确保敏感数据的完整性，一种常见的机制就是基于块密码算法实现对敏感数据的完整性验证，但是这种方式性能开销较大。
发明内容
针对上述问题，本发明提供了一种软件的保护方法、装置、电子设备及存储介质。
第一方面，本发明提供了一种软件的保护方法，包括：识别软件源代码中的敏感数据，并确定敏感数据的使用点；将所述敏感数据设置在所述软件源代码的编译产物的只读节中，以使软件运行时将敏感数据存储在只读区内；在所述敏感数据的使用点，插入检查代码，其中，所述检查代码用于在软件运行时，检查所读取的敏感数据是否在只读区内，并根据检查结果确定是否继续运行软件。
在其他可选的实施方式中，所述识别软件源代码中的敏感数据，并确定敏感数据的使用点，包括：识别带有特殊标记符的数据为所述敏感数据；确定与所述敏感数据关联的内存读指令所在位置为所述敏感数据的使用点，其 中，所述内存读指令用于通过指针读取所述敏感数据。
在其他可选的实施方式中，所述识别带有特殊标记符的数据为所述敏感数据之前，还包括：根据预设规则识别软件源代码中包含敏感操作的指令，并利用所述特殊标记符标记所述指令所使用的数据；将所述数据与内存读指令关联。
在其他可选的实施方式中，所述方法还包括：利用所述特殊标记符标记所述内存读指令；所述在所述敏感数据的使用点，插入检查代码，包括：在标记的内存读指令之前，插入所述检查代码；或者将所述标记的内存读指令修改为包含检查代码在内的内存读代码。
在其他可选的实施方式中，所述将所述敏感数据设置在所述软件源代码的编译产物的只读节中，包括：识别敏感数据的合法取值集合，构成白名单，并将白名单中的数据设置在所述软件源代码的编译产物的只读节中；将所述敏感数据设置为白名单中的数据。
在其他可选的实施方式中，所述根据检查结果确定是否继续运行软件，包括：若所读取的敏感数据在只读区内，则继续运行软件；若所读取的敏感数据不在只读区内，则阻断运行软件。
在其他可选的实施方式中，所述检查代码基于不同处理器、硬件或操作系统的特性生成。
第二方面，本发明提供一种软件的保护装置，包括：识别模块，用于识别软件源代码中的敏感数据，并确定敏感数据的使用点；处理模块，用于将所述敏感数据设置在所述软件源代码的编译产物的只读节中，以使软件运行时将敏感数据存储在只读区内；插入模块，用于在所述敏感数据的使用点，插入检查代码，其中，所述检查代码用于在软件运行时，检查所读取的敏感数据是否在只读区内，并根据检查结果确定是否继续运行软件。
第三方面，本发明提供一种电子设备，包括：至少一个处理器和存储器；所述存储器存储计算机执行指令；所述至少一个处理器执行所述存储器存储的计算机执行指令，使得所述至少一个处理器执行如第一方面任一项所述的方法。
第四方面，本发明提供一种可读存储介质，所述可读存储介质中存储有计算机执行指令，当处理器执行所述计算机执行指令时，实现如第一方面任 一项所述的方法。
第五方面，本发明提供一种计算机程序产品，包括计算机程序，该计算机程序被处理器执行时，实现如第一方面任一项所述的方法。
本发明提供的软件的保护方法、装置、电子设备及存储介质，通过识别软件源代码中的敏感数据，并确定敏感数据的使用点；将所述敏感数据设置在所述软件源代码的编译产物的只读节中，以使软件运行时将敏感数据存储在只读区内；在所述敏感数据的使用点，插入检查代码，其中，所述检查代码用于在软件运行时，检查所读取的敏感数据是否在只读区内，并根据检查结果确定是否继续运行软件；即本发明实施例通过在敏感数据使用点插入检查代码，使得软件在运行时，通过调用的检查代码检查要读取的敏感数据是否在只读区内，从而实现对敏感数据的完整性验证，进而在性能开销较小的同时防御敏感数据被破坏。
附图说明
图1是现有技术的敏感数据被破坏的示意图；
图2是现有技术中验证敏感数据完整性的三种机制的示意图；
图3为本发明提供的一种软件的保护方法的流程示意图；
图4为本发明提供的另一种软件的保护方法的流程示意图；
图5为本发明提供的一种软件的保护方法示意图；
图6为本发明提供的一种软件的保护装置的结构示意图；
图7为本发明提供的一种电子设备的结构示意图。
具体实施方式
为使本发明示例的目的、技术方案和优点更加清楚，下面将结合本发明示例中的附图，对本发明示例中的技术方案进行清楚、完整地描述。
计算机软件一直以来面临着严重的安全威胁，其中内存破坏漏洞是一种最为广泛存在的安全威胁。这些漏洞常被攻击者利用，用于破坏敏感操作的操作数(即敏感数据)，进而劫持或者破坏敏感操作。
其中，敏感操作包括但不限于：程序控制流跳转(程序计数器更新)、敏感API调用(如system()函数、SQL查询等)、安全检查(各种白名单 检查等)、关键业务操作(如转账、密码解密等)。而敏感操作的操作数，即敏感数据，包括但不限于：程序控制流跳转的操作数(函数返回地址、函数指针等)、敏感API调用的参数(system()函数执行的命令、SQL查询的语句参数)、安全检查使用的白名单配置、关键业务操作的操作数(如转账操作的收款地址、解密操作的密文输入)等等。
敏感数据被破坏后，攻击者即可发动各种各样的攻击。图1是现有技术的敏感数据被破坏的示意图，如图1所示，当敏感数据，例如可能值1被攻击者破坏后变为恶意值，恶意值就被使用在敏感信息使用点。例如，攻击者可以破坏函数指针或函数返回地址来劫持程序控制流，或者破坏system()或execve()等敏感API函数的参数来执行危险操作(如命令注入攻击、SQL注入攻击)，这些是当前最流行且危害最大的攻击类型。攻击者同样可以破坏安全检查中使用的白名单配置，例如用户标识符(uid)、条件标志或其他元数据(如配置信息、策略信息、或影子内存)等，来绕过已部署的安全防护措施或发起面向数据的攻击。攻击者还可以破坏关键业务操作的操作数，如劫持转账操作的收款地址、解密目标密文等等。
针对敏感数据被破坏进而导致敏感操作被劫持这一威胁，最根本性的防御方案需要确保数据流完整性(Data-Flow Integrity，简称：DFI)，即确保软件的数据流图(定义点与使用点之间的关系)在运行时不被违反，保障敏感信息使用点不被破坏。数据有其定义点和使用点，根据防御部署阶段不同，数据流完整性机制可以分为三类：一是在定义点阻止恶意内存读写操作的机制；二是将敏感数据流与普通数据流相互隔离的机制；三是在使用点验证数据完整性并检测攻击的机制。图2是现有技术中验证敏感数据完整性的三种机制的示意图。
第一类机制通过在数据定义点(内存写操作)进行安全检查，确保不会出现非法的内存写。SoftBound、AddressSanitizer等方案在软件层面实现了边界检查或者时序检查，提供了较强的数据流完整性保护，但是其性能开销高。MPX(Memory Protection EXtension，内存保护扩展)是Intel的一个硬件扩展，其被设计用来高效地进行边界检查，从而阻止越界类型的内存破坏攻击，提供空间上的内存安全保护。ARM提出的MTE(Memory Tagging Extension，内存标签扩展)硬件机制将每个内存字与相应的标签 关联，可以被用来实现空间上的和时间上的内存安全保护。这两种方案性能开销较高，相关特性目前从硬件中已移除或者尚未实现。
第二类机制通过隔离代码指针等敏感数据，阻断存在潜在危害的内存写操作破坏敏感数据，来提供数据流完整性保护。HDFI(Hardware-Assisted Data-flow Isolation，硬件辅助的数据流隔离)方案将每个内存字或每若干个内存字与一个1位的内存标签关联，而IMIX(In-Process Memory Isolation Extension，进程内内存隔离扩展)方案将每个内存页与一个1位的内存标签关联，从而提供较强的数据流隔离和安全保证。Intel MPK(Memory Protection Keys，内存保护键)与ARM DACR(Domain Access Control Register，域访问控制寄存器)将内存页分为若干键(keys)或域(domains)，并为用户提供控制寄存器调整内存页的权限来实现数据流隔离。Intel SMAP(Supervisor Mode Access Prevention，特权态访问阻止)、Intel SMEP(Supervisor Mode Execution Prevention，特权态执行阻止)、ARM PAN(Privileged Access Never，特权访问阻止)、RISC-V SUM(Supervisor User Memory，特权态用户内存访问)等硬件特性提供了内核态与用户态的隔离。这些方案的防御强度通常不够高。
第三类机制通过在使用点验证数据完整性，确保敏感操作所使用的操作数未被篡改，保护敏感操作。ARM PA(Pointer Authentication，指针验证)机制基于块密码算法实现了对敏感数据的完整性验证，在苹果手机等产品中得到初步应用，取得了较好的防护效果，但是其性能开销较大。StackGuard等方案通过在栈上放置Canary/Cookie，并在函数返回之前验证Canary/Cookie是否被破坏，来验证返回地址的完整性，但是其防御强度较低。
针对上述问题，本发明的技术构思在于：通过在敏感数据使用点插入检查代码，使得软件在运行时，通过调用的检查代码检查要读取的敏感数据是否在只读区内，从而实现对敏感数据的完整性验证，进而在性能开销较小的同时防御敏感数据被破坏。
第一方面，本发明示例提供了一种软件的保护方法，图3为本发明提供的一种软件的保护方法的流程示意图。
如图3所示，该软件的保护方法包括：
步骤101、识别软件源代码中的敏感数据，并确定敏感数据的使用点。
需要说明的是，本发明的执行主体为电子设备中的编译器，例如LLVM/Clang编译器，可通过对编译器扩展实现本实施例。
具体来说，对于待保护的软件源代码，扩展后的编译器对其进行编译，在编译过程中，扩展后的编译器识别用户提供的敏感操作或预定义规则刻画的敏感操作。常见的敏感操作包括：程序控制流跳转(程序计数器更新)、敏感API调用(如system()函数、SQL查询等)、安全检查(各种白名单检查等)、关键业务操作(如转账、密码解密等)；扩展后的编译器自动识别软件中对这些敏感操作的调用点(即敏感数据的使用点)，以及敏感操作所使用的敏感数据。
作为可选的实施例，所述步骤S101，包括：识别带有特殊标记符的数据为所述敏感数据；确定与所述敏感数据关联的内存读指令所在位置为所述敏感数据的使用点，其中，所述内存读指令用于通过指针读取所述敏感数据。
具体来说，敏感数据通过特殊标记符进行标记，比如用户可以通过软件提供的接口为LLVM编译器中间表示(LLVM IR)上的数据(或称为Value对象)打上特殊标记(例如命名为ROLoad-md标记)；然后可以将这些数据与某些LLVM IR内存读指令关联，表示这些IR内存读指令所读取的数据需要被保护。
作为可选的实施例，所述识别带有特殊标记符的数据为所述敏感数据之前，还包括：根据预设规则识别软件源代码中包含敏感操作的指令，并利用所述特殊标记符标记所述指令所使用的数据；将所述数据与内存读指令关联。
具体来说，在软件源代码编译过程中，逐渐扫描每一行指令，根据预先定义的规则或者用户提供的目标操作，自动识别软件中包含敏感操作的指令，并用特殊标记符(例如ROLoad-md)对所述指令所使用的数据进行标记，并将所述数据与内存读指令关联。
步骤102、将所述敏感数据设置在所述软件源代码的编译产物的只读节中，以使软件运行时将敏感数据存储在只读区内。
具体来说，可以将敏感数据设置在软件源代码的编译产物的只读节中， 从而使得编译产物(即可执行文件)在装载运行时，将敏感数据放置在软件进程的只读内存区内。
作为可选的实施例，所述步骤S102，包括：识别敏感数据的合法取值集合，构成白名单，并将白名单中的数据设置在所述软件源代码的编译产物的只读节中；将所述敏感数据设置为白名单中的数据。
具体来说，扩展后的编译器自动识别敏感数据合法操作数取值集合(白名单)。需要说明的是，大多数敏感数据的使用点上实质上含有一些白名单，这些白名单由一系列不可变的数据组成。这些白名单的例子包括但不限于：C++软件的虚函数表、软件开发者自定义的函数指针表、格式化字符串以及硬编码的配置信息、安全检查的白名单策略、转账操作的收款地址、敏感操作的发起人等。优选的，本发明提出的方法通过程序分析或者用户指定的方式，自动识别这些白名单信息。在某些情况下，白名单没有在软件源代码中显式地定义，例如，间接控制流转移的目标可以在编译期或运行时被计算出来，但它们并没有直接地写明在软件源代码中，对于这些情况，本发明在编译时预计算这些白名单。也就是说，用户可以创建白名单文件，在文件中指定白名单信息，使得LLVM Pass读取对应的文件后能够获得白名单信息；还可以基于LLVM Pass对源代码进行分析，自动识别并构建部分敏感数据的白名单，例如C++软件的虚函数表等。
进而，扩展后的编译器将这些不可变的白名单数据放置在防篡改的区域内来使其免受破坏(或污染)。优选的，基于性能和易用性考虑，本发明选择内存中的只读页作为防篡改的区域，也就是说，本发明可以通过将白名单数据放置在可执行文件中只读节(section)来实现保护，该可执行文件被装载运行后，这些数据就存储于进程的只读内存区中。
另外，本发明会将软件中对敏感数据的使用改为对放置在只读内存中白名单数据的内存访问，自动修改软件确保正确性。
步骤103、在所述敏感数据的使用点，插入检查代码，其中，所述检查代码用于在软件运行时，检查所读取的敏感数据是否在只读区内，并根据检查结果确定是否继续运行软件。
具体来说，扩展后的编译器在敏感数据使用点插入检查代码，在软件运行时调用检查代码，对敏感数据的只读属性进行验证；如果运行时验证 成功，则继续执行软件；在运行时的验证失败，则阻断软件继续执行。也就是说，本发明能够限定只有来自防篡改(只读内存)区域的数据可在敏感数据使用点被使用，能够阻止被污染或破坏的数据(非只读数据)在敏感数据使用点被使用，以此缓解内存攻击，从而保护软件的敏感操作。
作为可选的实施例，所述方法还包括：利用所述特殊标记符标记所述内存读指令；所述步骤S103，包括：在标记的内存读指令之前，插入所述检查代码；或者将所述标记的内存读指令修改为包含检查代码在内的内存读代码。
具体来说，扩展后的编译器，对软件源代码进行详细分析，逐条指令分析判断该指令是否存在敏感操作(包括但不限于虚函数调用等)。若某指令存在敏感操作，则该LLVM Pass分析其操作数的来源，找到相应的IR内存读指令，使用ROLoad-md标记该指令；然后逐条修改所有被ROLoad-md标记的IR内存读指令，并在标记的内存读指令之前，插入所述检查代码；或者将所述标记的内存读指令修改为包含检查代码在内的内存读代码。
作为可选的实施方式，所述检查代码基于不同处理器、硬件或操作系统的特性生成。
具体来说，根据目标平台的硬件特性或者操作系统提供的特性等功能，扩展后的编译器构建并生成可验证数据只读属性的功能代码。例如，部分平台的硬件特性可能提供只读内存页的权限设置及检查，部分操作系统提供内存页的访问权限信息或提供只读内存地址范围等，这些特性或者信息都可以用于检查目标数据是否处于只读内存区。基于这些特性，扩展后的编译器能够构建相应功能代码，实现对敏感数据只读属性的验证。
本实施例提供的软件的保护方法，通过识别软件中的敏感数据，并确定敏感数据的使用点；将所述敏感数据设置在所述软件源代码的编译产物的只读节中，以使软件运行时将敏感数据存储在只读区内；在所述敏感数据的使用点，插入检查代码，其中，所述检查代码用于在软件运行时，检查所读取的敏感数据是否在只读区内，并根据检查结果确定是否继续运行软件；即本发明通过在敏感数据使用点插入检查代码，使得软件在运行时，通过调用的检查代码检查要读取的敏感数据是否在只读区内，从而实现对 敏感数据的完整性验证，进而在性能开销较小的同时防御敏感数据被破坏。
结合前述的各实现方式，图4为本发明提供的另一种软件的保护方法的流程示意图，如图4所示，该软件的保护方法包括：
步骤201、识别软件源代码中的敏感数据，并确定敏感数据的使用点。
步骤202、将所述敏感数据设置在所述软件源代码的编译产物的只读节中，以使软件运行时将敏感数据存储在只读区内。
步骤203、在所述敏感数据的使用点，插入检查代码。
步骤204、在软件运行时，根据检查代码判断所读取的敏感数据是否在只读区内。
若是，则执行步骤205；若否，则执行步骤206。
步骤204、继续运行软件。
步骤205、阻断运行软件。
本实施方式中的步骤201、步骤202以及步骤203分别与前述实施方式中的步骤101、步骤102以及步骤103的在所述敏感数据的使用点，插入检查代码的实现方式类似，在此不进行赘述。
与前述实施方式不同的是，本实施例进一步限定了判断是否继续运行软件的具体实现方式。在本实施方式中，若所读取的敏感数据在只读区内，则继续运行软件；若所读取的敏感数据不在只读区内，则阻断运行软件。
具体来说，若运行时验证只读属性失败，说明某敏感指令的敏感操作的操作数(即敏感数据)不在进程的只读内存区中，此时本发明认为该进程执行发生异常，并使用目标平台的硬件特性或者操作系统提供的特性来阻断该进程继续执行(例如向该进程发送一个段错误信号，SIGSEGV)，以确保只有只读内存区域的数据能够被此类敏感指令或敏感操作使用。可选的，只读属性的验证和进程的阻断可以由目标平台的同一个硬件特性或者操作系统提供的同一个特性完成。
为了更直观的了解本发明，图5为本发明提供的一种软件的保护方法示意图；如图5所示，敏感数据(例如可能值1、可能值2……可能值N等)存储在只读内存区中，软件运行时是通过指针读取的；正常情况下，软件运行时通过指针获取存储在只读区的敏感数据；当攻击者攻击指针时， 有可能将指针指向存储在攻击者希望的区域，但本实施例会因为检查代码检测到敏感数据不是在只读区域内读取的，会发出段错误信号，阻断软件的继续运行。
在前述实施方式的基础上，通过若所读取的敏感数据在只读区内，则继续运行软件；若所读取的敏感数据不在只读区内，则阻断运行软件，即通过验证要读取的敏感数据是否在只读区内，实现对敏感数据的完整性验证，进而在性能开销较小的同时防御敏感数据被破坏。
第二方面，本发明示例提供了一种软件的保护装置，图6为本发明提供的一种软件的保护装置的结构示意图，如图6所示，该保护装置包括：
识别模块10，用于识别软件源代码中的敏感数据，并确定敏感数据的使用点；处理模块20，用于将所述敏感数据设置在所述软件源代码的编译产物的只读节中，以使软件运行时将敏感数据存储在只读区内；插入模块30，用于在所述敏感数据的使用点，插入检查代码，其中，所述检查代码用于在软件运行时，检查所读取的敏感数据是否在只读区内，并根据检查结果确定是否继续运行软件。
在其他可选的实施方式中，所述识别模块10，具体用于：识别带有特殊标记符的数据为所述敏感数据；确定与所述敏感数据关联的内存读指令所在位置为所述敏感数据的使用点，其中，所述内存读指令用于通过指针读取所述敏感数据。
在其他可选的实施方式中，所述识别模块10，还用于：根据预设规则识别软件源代码中包含敏感操作的指令，并利用所述特殊标记符标记所述指令所使用的数据；将所述数据与内存读指令关联。
在其他可选的实施方式中，所述识别模块10还用于：利用所述特殊标记符标记所述内存读指令；所述插入模块30，具体用于：在标记的内存读指令之前，插入所述检查代码；或者将所述标记的内存读指令修改为包含检查代码在内的内存读代码。
在其他可选的实施方式中，所述处理模块20，具体用于：识别敏感数据的合法取值集合，构成白名单，并将白名单中的数据设置在所述软件源代码的编译产物的只读节中；将所述敏感数据设置为白名单中的数据。
在其他可选的实施方式中，所述根据检查结果确定是否继续运行软件，包括：若所读取的敏感数据在只读区内，则继续运行软件；若所读取的敏感数据不在只读区内，则阻断运行软件。
在其他可选的实施方式中，所述检查代码基于不同处理器、硬件或操作系统的特性生成。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的软件的保护装置的具体工作过程以及相应的有益效果，可以参考前述方法示例中的对应过程，在此不再赘述。
本发明提供的软件的保护装置，通过识别模块，用于识别软件源代码中的敏感数据，并确定敏感数据的使用点；处理模块，用于将所述敏感数据设置在所述软件源代码的编译产物的只读节中，以使软件运行时将敏感数据存储在只读区内；插入模块，用于在所述敏感数据的使用点，插入检查代码，其中，所述检查代码用于在软件运行时，检查所读取的敏感数据是否在只读区内，并根据检查结果确定是否继续运行软件，即本发明通过在敏感数据使用点插入检查代码，使得软件在运行时，通过调用的检查代码检查要读取的敏感数据是否在只读区内，从而实现对敏感数据的完整性验证，进而在性能开销较小的同时防御敏感数据被破坏。
第三方面，本发明示例提供了一种电子设备，图7为本发明提供的一种电子设备的硬件结构示意图，如图7所示，包括：
至少一个处理器701和存储器702。
在具体实现过程中，至少一个处理器701执行所述存储器702存储的计算机执行指令，使得至少一个处理器701执行如上的方法，其中，处理器701、存储器702通过总线703连接。
处理器701的具体实现过程可参见上述方法实施例，其实现原理和技术效果类似，本实施例此处不再赘述。
在上述的图7所示的实施例中，应理解，处理器可以是中央处理单元(英文：Central Processing Unit，简称：CPU)，还可以是其他通用处理器、数字信号处理器(英文：Digital Signal Processor，简称：DSP)、专用集成电路(英文：Application Specific Integrated Circuit，简称：ASIC) 等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合发明所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
存储器可能包含高速RAM存储器，也可能还包括非易失性存储NVM，例如至少一个磁盘存储器。
总线可以是工业标准体系结构(Industry Standard Architecture，简称：ISA)总线、外部设备互连(Peripheral Component Interconnect，简称：PCI)总线或扩展工业标准体系结构(Extended Industry Standard Architecture，简称：EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，本申请附图中的总线并不限定仅有一根总线或一种类型的总线。
第四方面，本发明还提供了一种可读存储介质，所述可读存储介质中存储有计算机执行指令，当处理器执行所述计算机执行指令时，实现如上方法。
上述的可读存储介质可以是由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)、电可擦除可编程只读存储器(EEPROM)、可擦除可编程只读存储器(EPROM)、可编程只读存储器(PROM)、只读存储器(ROM)、磁存储器、快闪存储器、磁盘或光盘。可读存储介质可以是通用或专用计算机能够存取的任何可用介质。
一种示例性的可读存储介质耦合至处理器，从而使处理器能够从该可读存储介质读取信息，且可向该可读存储介质写入信息。当然，可读存储介质也可以是处理器的组成部分。处理器和可读存储介质可以位于专用集成电路(Application Specific Integrated Circuits，简称：ASIC)中。当然，处理器和可读存储介质也可以作为分立组件存在于设备中。
第五方面，本发明提供一种计算机程序产品，包括计算机程序，该计算机程序被处理器执行时，实现如上方法。
其中，计算机程序存储在存储器702中，并配置为由处理器701执行以实现如上方法。
本领域普通技术人员可以理解：实现上述各方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成。前述的程序可以存储于一计算机可读取存储介质中。该程序在执行时，执行包括上述各方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (11)

  1. 一种软件的保护方法，其特征在于，包括：
    识别软件源代码中的敏感数据，并确定敏感数据的使用点；
    将所述敏感数据设置在所述软件源代码的编译产物的只读节中，以使软件运行时将敏感数据存储在只读区内；
    在所述敏感数据的使用点，插入检查代码，其中，所述检查代码用于在软件运行时，检查所读取的敏感数据是否在只读区内，并根据检查结果确定是否继续运行软件。
  2. 根据权利要求1所述的方法，其特征在于，所述识别软件源代码中的敏感数据，并确定敏感数据的使用点，包括：
    识别带有特殊标记符的数据为所述敏感数据；
    确定与所述敏感数据关联的内存读指令所在位置为所述敏感数据的使用点，其中，所述内存读指令用于通过指针读取所述敏感数据。
  3. 根据权利要求2所述的方法，其特征在于，所述识别带有特殊标记符的数据为所述敏感数据之前，还包括：
    根据预设规则识别软件源代码中包含敏感操作的指令，并利用所述特殊标记符标记所述指令所使用的数据；
    将所述数据与内存读指令关联。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：利用所述特殊标记符标记所述内存读指令；
    所述在所述敏感数据的使用点，插入检查代码，包括：在标记的内存读指令之前，插入所述检查代码；
    或者将所述标记的内存读指令修改为包含检查代码在内的内存读代码。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述将所述敏感数据设置在所述软件源代码的编译产物的只读节中，包括：
    识别敏感数据的合法取值集合，构成白名单，并将白名单中的数据设置在所述软件源代码的编译产物的只读节中；
    将所述敏感数据设置为白名单中的数据。
  6. 根据权利要求5所述的方法，其特征在于，所述根据检查结果确定是否继续运行软件，包括：
    若所读取的敏感数据在只读区内，则继续运行软件；
    若所读取的敏感数据不在只读区内，则阻断运行软件。
  7. 根据权利要求1-4任一项所述的方法，其特征在于，所述检查代码基于不同处理器、硬件或操作系统的特性生成。
  8. 一种软件的保护装置，其特征在于，包括：
    识别模块，用于识别软件源代码中的敏感数据，并确定敏感数据的使用点；
    处理模块，用于将所述敏感数据设置在所述软件源代码的编译产物的只读节中，以使软件运行时将敏感数据存储在只读区内；
    插入模块，用于在所述敏感数据的使用点，插入检查代码，其中，所述检查代码用于在软件运行时，检查所读取的敏感数据是否在只读区内，并根据检查结果确定是否继续运行软件。
  9. 一种电子设备，其特征在于，包括：至少一个处理器和存储器；
    所述存储器存储计算机执行指令；
    所述至少一个处理器执行所述存储器存储的计算机执行指令，使得所述至少一个处理器执行如权利要求1至7任一项所述的方法。
  10. 一种可读存储介质，其特征在于，所述可读存储介质中存储有计算机执行指令，当处理器执行所述计算机执行指令时，实现如权利要求1至7任一项所述的方法。
  11. 一种计算机程序产品，包括计算机程序，其特征在于，该计算机程序被处理器执行时，实现上述权利要求1至7任一项所述的方法。
PCT/CN2021/123329 2021-03-15 2021-10-12 软件的保护方法、装置、电子设备及存储介质 WO2022193629A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21931204.8A EP4310702A1 (en) 2021-03-15 2021-10-12 Software protection method and apparatus, electronic device, and storage medium
US18/467,252 US20240004967A1 (en) 2021-03-15 2023-09-14 Software protection method and apparatus, electronic device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110289668.2 2021-03-15
CN202110289668.2A CN113032737B (zh) 2021-03-15 2021-03-15 软件的保护方法、装置、电子设备及存储介质

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/467,252 Continuation US20240004967A1 (en) 2021-03-15 2023-09-14 Software protection method and apparatus, electronic device, and storage medium

Publications (1)

Publication Number Publication Date
WO2022193629A1 true WO2022193629A1 (zh) 2022-09-22

Family

ID=76471788

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/123329 WO2022193629A1 (zh) 2021-03-15 2021-10-12 软件的保护方法、装置、电子设备及存储介质

Country Status (4)

Country Link
US (1) US20240004967A1 (zh)
EP (1) EP4310702A1 (zh)
CN (1) CN113032737B (zh)
WO (1) WO2022193629A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113032737B (zh) * 2021-03-15 2021-11-30 清华大学 软件的保护方法、装置、电子设备及存储介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20010007131A1 (en) * 1997-09-11 2001-07-05 Leonard J. Galasso Method for validating expansion roms using cryptography
CN104011733A (zh) * 2012-08-09 2014-08-27 英特尔公司 在系统预引导期间具有改进的只读存储器锁定的安全数据保护
CN104981812A (zh) * 2013-03-07 2015-10-14 英特尔公司 在对等监控中支持可靠性、可用性、以及可服务性(ras)流的机制
CN111381879A (zh) * 2018-12-31 2020-07-07 华为技术有限公司 一种数据处理方法及装置
CN111881485A (zh) * 2020-07-14 2020-11-03 浙江大学 一种基于arm指针验证的内核敏感数据完整性保护方法
CN112395587A (zh) * 2019-08-15 2021-02-23 新唐科技股份有限公司 计算机系统及强制自行认证方法
CN113032737A (zh) * 2021-03-15 2021-06-25 清华大学 软件的保护方法、装置、电子设备及存储介质

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9021605B2 (en) * 2007-01-03 2015-04-28 International Business Machines Corporation Method and system for protecting sensitive data in a program
CN102222194A (zh) * 2011-07-14 2011-10-19 哈尔滨工业大学 Linux主机计算环境安全保护的模块及方法
CN102880461B (zh) * 2012-08-29 2015-11-25 华为技术有限公司 一种编译链接方法及装置
CN102930185B (zh) * 2012-11-28 2015-07-29 中国人民解放军国防科学技术大学 运行时程序安全关键数据的完整性验证方法及装置
CN103955362A (zh) * 2014-04-03 2014-07-30 广东工业大学 一种基于Xen的操作系统内核监控方法
CN105426223B (zh) * 2015-12-25 2019-01-04 百度在线网络技术（北京）有限公司 应用加载方法和装置
EP3355218A1 (en) * 2017-01-26 2018-08-01 Gemalto Sa Method to secure a software code
CN108920253B (zh) * 2018-06-20 2022-05-17 成都灵跃云创科技有限公司 一种无代理的虚拟机监控系统和监控方法
EP3696698A1 (en) * 2019-02-18 2020-08-19 Verimatrix Method of protecting a software program against tampering
CN111400702B (zh) * 2020-03-24 2023-06-27 上海瓶钵信息科技有限公司 一种虚拟化的操作系统内核保护方法
CN112100686B (zh) * 2020-08-28 2022-04-08 浙江大学 一种基于arm指针验证的内核代码指针完整性保护方法

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20010007131A1 (en) * 1997-09-11 2001-07-05 Leonard J. Galasso Method for validating expansion roms using cryptography
CN104011733A (zh) * 2012-08-09 2014-08-27 英特尔公司 在系统预引导期间具有改进的只读存储器锁定的安全数据保护
CN104981812A (zh) * 2013-03-07 2015-10-14 英特尔公司 在对等监控中支持可靠性、可用性、以及可服务性(ras)流的机制
CN111381879A (zh) * 2018-12-31 2020-07-07 华为技术有限公司 一种数据处理方法及装置
CN112395587A (zh) * 2019-08-15 2021-02-23 新唐科技股份有限公司 计算机系统及强制自行认证方法
CN111881485A (zh) * 2020-07-14 2020-11-03 浙江大学 一种基于arm指针验证的内核敏感数据完整性保护方法
CN113032737A (zh) * 2021-03-15 2021-06-25 清华大学 软件的保护方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN113032737A (zh) 2021-06-25
EP4310702A1 (en) 2024-01-24
CN113032737B (zh) 2021-11-30
US20240004967A1 (en) 2024-01-04

Similar Documents

Publication Publication Date Title
Shanbhogue et al. Security analysis of processor instruction set architecture for enforcing control-flow integrity
Chiueh et al. RAD: A compile-time solution to buffer overflow attacks
US7577992B2 (en) Software security based on control flow integrity
US7603704B2 (en) Secure execution of a computer program using a code cache
US7886148B2 (en) Secure execution of a computer program
Abadi et al. A theory of secure control flow
US20160098556A1 (en) Preventing stack buffer overflow attacks
KR20080072952A (ko) 메모리 페이지를 프로그램과 연관시키기 위한 페이지컬러링
US7251735B2 (en) Buffer overflow protection and prevention
US20080133858A1 (en) Secure Bit
US20210224380A1 (en) Verifying stack pointer
US20240004967A1 (en) Software protection method and apparatus, electronic device, and storage medium
US8645704B2 (en) Protecting caller function from undesired access by callee function
US20230418768A1 (en) Sensitive data reading method and apparatus, electronic device, and storage medium
Piromsopa et al. Survey of protections from buffer-overflow attacks
US11194899B2 (en) Apparatus and methods for transitioning between a secure area and a less-secure area
US8261065B2 (en) Protecting caller function from undesired access by callee function
Liu et al. A buffer overflow detection and defense method based on RISC-V instruction set extension
Moon et al. Architectural supports to protect OS kernels from code-injection attacks and their applications
Lehniger et al. Combination of ROP Defense Mechanisms for Better Safety and Security in Embedded Systems
KR20210057239A (ko) 안티 디버깅 무력화 장치 및 그 방법
Kuzuno et al. Protection Mechanism of Kernel Data Using Memory Protection Key
Karwayun et al. War of Control Hijacking: Attacks and Defenses
Wang et al. Libra: An Adaptive Method for Protecting Memory from Arbitrary Overwrite.
Healey et al. Ensuring Critical Data Integrity via Information Flow Signatures

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21931204

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2021931204

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2021931204

Country of ref document: EP

Effective date: 20231016