WO2023132474A1

WO2023132474A1 - Device and method for risc-five architecture instruction extension for branch tagging extension

Info

Publication number: WO2023132474A1
Application number: PCT/KR2022/018593
Authority: WO
Inventors: 권동현; 박성환
Original assignee: 부산대학교 산학협력단
Priority date: 2022-01-06
Filing date: 2022-11-23
Publication date: 2023-07-13
Also published as: KR20230106427A

Abstract

The present invention relates to a device and a method for RISC-five architecture instruction extension for branch tagging extension to ensure the control-flow integrity of IoT devices and prevent a control-flow hijacking attack which is a typical security threat, the device comprising: a tag value storage instruction insertion unit configured to insert a setTag instruction for storage of a tag value into a location immediately before indirect branching when compiling a source code; a tag value comparison instruction insertion unit configured to insert a checkTag instruction for tag value comparison immediately after performing indirect branching; a tag value comparison unit configured to compare a value stored in a control state register at an entry point of a function with a value given to an instruction at the entry point of the function, so as to determine whether control-flow transmission to a correct destination has been performed; and an instruction execution unit configured to, through tag value comparison of the tag value comparison unit, allow an instruction execution when the values match, and execute an exception processing when the values do not match.

Description

Apparatus and method for extending risk five architecture instruction for branch tagging extension

The present invention relates to security of the Internet of Things, and specifically, a branch to ensure control-flow integrity of IoT devices and to prevent control-flow hijacking attacks, which are representative security threats. It relates to an apparatus and method for extending risk five architecture instructions for tagging extension.

Modern society is approaching the intelligent information society brought about by the 4th industrial revolution with the development of information and communication technology (ICT).

With the development of IoT technology, the people and things around us and things and things around us are connected through networks without being restricted by space, so that big data can be calculated and information can be sent and received.

However, threats generated in the existing communication environment, such as device loss and physical destruction, radio signal disturbance information leakage, data forgery and falsification, and denial of service, threaten the security of the IoT by violating the three elements of information security: confidentiality, integrity, and availability. can do.

In preparation for these threats, information protection technologies such as security and information leakage for the Internet of Things should be strengthened.

In this way, the recent Internet of Things (IoT) technology has gradually expanded its application range and can be found throughout real life. In this way, as IoT devices become closer to real life, a large amount of personal information is included, and accordingly, voices of concern about attacks targeting IoT devices are also increasing.

1 is a block diagram showing prior art Intel-CET and ARM-BTI security technologies.

Prior art includes technologies such as Intel-CET and ARM-BTI.

In the case of Intel-CET, the possibility of bypassing is high because it is determined based on only the target instruction, and in the case of ARM-BTI, a branch format is additionally used in addition to the target instruction, but it has 4 types of vulnerabilities.

Security technologies such as Intel-CET or ARM-BTI are provided for devices such as smartphones, home PCs, or server workstations, and various solutions using these functions are being developed. Due to problems such as memory overhead, it is difficult to mount it on low-performance devices such as IoT devices.

As the size of the embedded device industry grows, security issues are emerging. There are technologies to ensure the execution flow of programs, but they cannot be applied due to the limitations of embedded devices, and some applicable technologies cannot be supplemented due to lack of security. need.

Therefore, it is possible to increase the applicability to embedded devices, increase security, ensure control-flow integrity of IoT devices, and prevent control-flow hijacking attacks, which are representative security threats. The development of new technologies is required.

The present invention is to solve the problems of the IoT security technology of the prior art, to ensure control-flow integrity of IoT devices and to prevent control-flow hijacking attacks, which are representative security threats. Its purpose is to provide a device and method for extending the risk five architecture instruction for branch tagging extension so as to be prevented.

The present invention extends Risk-Five, an open instruction architecture, adds new instructions for verifying control flow integrity, and adds a dedicated control status register that can be accessed and read and written only through these instructions, thereby controlling code with low execution time overhead. An object of the present invention is to provide a device and method for extending a risk five architecture instruction for extending branch tagging to ensure flow integrity.

The present invention eliminates the need to modify the source code by modifying the compiler to insert the added instruction into a legal location, and enables the reuse of the existing source code, guaranteeing the control flow integrity of the code with a small execution time overhead, and the Internet of Things An object of the present invention is to provide a device and method for extending risk five architecture commands for one branch tagging extension to prevent control flow theft attacks targeting devices.

The present invention is an apparatus for extending a risk five architecture instruction for extending branch tagging so that an executable file produced by a compiler can ensure control flow integrity by utilizing an added function by being executed on a CPU to which an extended architecture is applied, and Its purpose is to provide a method.

The present invention utilizes the RISC-V architecture to add a new register, protect the value of the register through a dedicated instruction, and store the identification value for the destination to ensure CFI. Risk Five architecture instruction extension for branch tagging extension Its purpose is to provide an apparatus and method for

The present invention uses a method of allocating a new instruction to an unused HINT Instruction among existing instructions rather than adding a new instruction to add a dedicated instruction, thereby establishing a policy using the added functions and developing a compiler to apply these functions. An object of the present invention is to provide a device and method for extending risk five architecture instructions for branch tagging extension.

Other objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned above will be clearly understood by those skilled in the art from the description below.

In order to achieve the above object, the device for extending the risk five architecture command for branch tagging extension according to the present invention is a tag value storage command that inserts a setTag command for storing a tag value at a location immediately before an indirect branch when compiling source code. Insertion unit; Tag value comparison command insertion unit that inserts the checkTag command for tag value comparison immediately after indirect branch execution; Correct destination by comparing the value stored in the control status register at the entry point of the function with the value given to the command at the entry point of the function and a tag value comparison unit that determines whether or not control flow transmission has been performed; a command execution unit that permits execution of a command through comparison of the tag values of the tag value comparison unit, and handles an exception when they do not match.

Here, by extending Risk-Five, an open instruction architecture, a dedicated control status register that can be accessed and read and written only through newly added instructions is added to verify control flow integrity.

In addition, the control status register is a 32-bit register including four areas each consisting of 8 bits, and is characterized in that control flow integrity is guaranteed by comparing up to four verification values at the same time.

The tag value storage instruction inserting unit may perform an operation of writing a unique identification value according to an objective function to the first status register immediately before an indirect branch instruction.

In addition, it is characterized in that control flow integrity is guaranteed without an increase in execution time overhead by reusing existing source codes without modifying source codes by inserting instructions added by modifying the compiler.

In addition, it is characterized by using a method in which the executable file produced by the compiler is executed on a CPU with an extended architecture and a new instruction is allocated to an unused HINT Instruction among existing instructions.

In order to achieve another object, a method for extending a risk five architecture command for branch tagging extension according to the present invention includes a tag value storage command insertion step of inserting a setTag command to store a tag value at a location immediately before an indirect branch when compiling source code. ;Inserting a tag value comparison command to insert a checkTag command for tag value comparison right after indirect branching; Controlling to the correct destination by comparing the value stored in the control status register at the entry point of the function with the value given to the command at the entry point of the function A tag value comparison step of determining whether flow transfer is performed; a command execution step of permitting execution of a command if they match through the tag value comparison of the tag value comparison step and handling an exception if they do not match; characterized by including a.

In the step of inserting the tag value storage instruction, an operation of writing a unique identification value according to the objective function to the first status register is performed immediately before the indirect branch instruction.

As described above, the device and method for extending the risk five architecture command for branch tagging extension according to the present invention have the following effects.

First, it guarantees control-flow integrity of IoT devices and effectively blocks control-flow hijacking attacks, which are a representative security threat.

Second, by extending Risk-Five, an open instruction architecture, by adding new instructions for verifying control flow integrity, and by adding a dedicated control status register that can be accessed and read and written only through these instructions, the control flow of the code is reduced in execution time overhead. to ensure integrity.

Third, by modifying the compiler and inserting the added instruction into a legitimate location, the need to modify the source code is eliminated and the existing source code can be reused, ensuring the integrity of the control flow of the code with little execution time overhead and IoT device It can effectively block control flow stealing attacks targeting .

Fourth, the executable file produced by the compiler is executed on the CPU to which the extended architecture is applied, so that control flow integrity can be guaranteed by utilizing the added function.

Fifth, by using the RISC-V architecture, a new register is added, the value of the register is protected through a dedicated instruction, and the identification value for the destination is stored to ensure CFI.

Sixth, rather than adding a new instruction to add a dedicated instruction, it is easy to establish a policy using the added functions and develop a compiler to apply these functions by assigning a new instruction to the HINT Instruction that is not used among existing instructions. let it do

1 is a block diagram showing prior art Intel-CET and ARM-BTI security technologies

2 is a block diagram of a device for extending risk five architecture instructions for branch tagging extension according to the present invention.

3 is a detailed block diagram of a device for extending risk five architecture instructions for branch tagging extension according to the present invention.

Figure 4 is a block diagram showing an operation for risk five architecture instruction extension for branch tagging extension according to the present invention

5 is a flow chart illustrating a method for risk five architecture instruction extension for branch tagging extension according to the present invention;

Hereinafter, a preferred embodiment of a device and method for extending risk five architecture instructions for branch tagging extension according to the present invention will be described in detail.

Features and advantages of an apparatus and method for extending risk five architecture instructions for branch tagging extension according to the present invention will become clear through detailed description of each embodiment below.

Apparatus and method for extending risk five architecture commands for branch tagging extension according to the present invention ensure control-flow integrity of IoT devices and prevent control-flow hijacking attack, which is a representative security threat. attack) can be effectively prevented.

To this end, the present invention extends risk-five, an open instruction architecture, adds new instructions for verifying control flow integrity, and adds a dedicated control status register that can be accessed and read and written only through these instructions to reduce execution time overhead. It may include a configuration that allows to ensure the control flow integrity of the code.

The present invention eliminates the need to modify the source code by modifying the compiler to insert the added instruction into a legal location, and enables the reuse of the existing source code, guaranteeing the control flow integrity of the code with a small execution time overhead, and the Internet of Things It may include a configuration to prevent control flow hijacking attacks targeting the device.

The present invention may include a configuration for guaranteeing control flow integrity by utilizing functions added by executing an executable file produced by a compiler on a CPU to which an extended architecture is applied.

The present invention may include a configuration for adding a new register by utilizing the RISC-V architecture, protecting the value of the register through a dedicated instruction, and storing an identification value for a destination to ensure CFI.

The present invention may include a configuration using a method of allocating a new instruction to an unused HINT Instruction among existing instructions rather than adding a new instruction to add a dedicated instruction.

2 is a schematic diagram of the architecture of the present invention, and newly modified elements are represented by blue boxes.

As shown in FIG. 2, the present invention adds a separate register for storing an identification value and adds a dedicated command for controlling the corresponding register.

Adding a dedicated instruction uses a method of allocating a new instruction to an unused HINT Instruction among existing instructions, rather than adding a new instruction.

By modifying the compiler and inserting the added instructions into the proper place, the need to modify the source code is eliminated and the existing source code can be reused. Added functionality can be utilized to ensure control flow integrity.

The Risk Five architecture is an open architecture that anyone can freely use. It is a RISC (Reduced Instruction Set Computer) type command structure that has a simpler structure and lower power consumption than CISC, making it suitable for use in embedded devices.

As shown in FIG. 3, the apparatus for extending the risk five architecture command for branch tagging extension according to the present invention is a tag value storage command insertion unit for inserting a setTag command for storing a tag value at a position immediately before an indirect branch when compiling source code. (30), and a tag value comparison command inserting unit 31 for inserting a checkTag command for comparing tag values immediately after performing an indirect branch, and a value stored in the control status register at the entry point of the function and a command given to the command at the entry point of the function. The tag value comparison unit 32 that determines whether the control flow is transmitted to the correct destination by comparing the values, and through the comparison of the tag values of the tag value comparison unit 32, command execution is allowed if they match, and exception handling if they do not match. It includes a command execution unit 33 that does.

4 is a block diagram showing an operation for risk five architecture instruction extension for branch tagging extension according to the present invention.

As in FIG. 4, when compiling the source code, the setTag command for storing the tag value is inserted (Line 2-3) immediately before the indirect branch.

Insert checkTag command (Line 7~8) for tag value comparison immediately after indirect branching.

Through comparison of these tag values, if they match, execution is permitted, and if they do not match, exceptions are processed (lines 11 to 12).

Specifically, an operation of writing a unique identification value according to an objective function to the first state register as in

lines

2 and 3 immediately before an indirect branch instruction such as in line 4 is performed.

Then, as shown in

lines

7 and 8, it is determined whether control flow transfer to the correct destination has been performed by comparing the value stored in the control status register at the entry point of the function with the value given to the command at the entry point of the function.

The function goo in the 10th line indicates that control flow transmission is impossible because the tag value of area 0 in line 11 matches but the tag value of area 1 does not match C in line 12.

5 is a flow chart illustrating a method for risk five architecture instruction extension for branch tagging extension according to the present invention.

In the method for extending the risk five architecture command for branch tagging extension according to the present invention, first, when compiling the source code, the setTag command for storing the tag value is inserted at the position just before the indirect branch (S501).

Then, immediately after performing the indirect branch, the checkTag command for tag value comparison is inserted (S502).

Then, through tag value comparison, if they match, execution is permitted, and if they do not match, an exception is processed. (S503)

The present invention described above extends the risk-five, an open command architecture, adds a new command for verifying control flow integrity, and adds a dedicated control status register that can be accessed and read and written only through these commands.

The newly added register is a 32-bit register containing four areas of 8 bits each, and can ensure control flow integrity by comparing up to four verification values at the same time.

Through this, it is possible to guarantee the control flow integrity of the code with a small execution time overhead of 4.8% on average and to prevent control flow hijacking attacks targeting IoT devices.

The apparatus and method for extending the risk five architecture command for branch tagging extension according to the present invention described above guarantees control-flow integrity of IoT devices and prevents control-flow hijacking attacks, which are representative security threats. -flow hijacking attack).

The present invention extends Risk-Five, an open instruction architecture, adds new instructions for verifying control flow integrity, and adds a dedicated control status register that can be accessed and read and written only through these instructions, thereby controlling code with low execution time overhead. This is to ensure flow integrity.

As described above, it will be understood that the present invention is implemented in a modified form without departing from the essential characteristics of the present invention.

Therefore, the specified embodiments should be considered from an explanatory point of view rather than a limiting point of view, and the scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the equivalent range are considered to be included in the present invention. will have to be interpreted

Claims

a tag value storage command insertion unit for inserting a setTag command for storing a tag value at a location immediately before an indirect branch when compiling the source code;

a tag value comparison command insertion unit for inserting a checkTag command for tag value comparison immediately after performing an indirect branch;

a tag value comparison unit that determines whether the control flow transfer to the correct destination has been performed by comparing a value stored in the control status register at the entry point of the function with a value given to a command at the entry point of the function;

Device for risk five architecture command extension for branch tagging extension, characterized in that it comprises a; command execution unit that permits command execution through comparison of tag values of the tag value comparison unit and handles exceptions in case of inconsistency.
The branch tagging extension according to claim 1, characterized by adding a dedicated control status register that can be accessed, read, and written only through a newly added instruction to verify control flow integrity by extending Risk-Five, an open instruction architecture. Facility for risk five architecture instruction extensions.
3. The method of claim 2, wherein the control status register comprises:

Device for risk five architecture instruction extension for branch tagging extension, characterized by ensuring control flow integrity by comparing up to four verification values at the same time with a 32-bit register containing four areas composed of 8 bits each .
The method of claim 1, wherein the tag value storage command inserting unit comprises:

Apparatus for extending risk five architecture instructions for branch tagging extension, characterized in that an operation of writing a unique identification value according to the objective function to the first status register is performed immediately before the indirect branch instruction.
The branch tagging extension according to claim 1, characterized in that control flow integrity is guaranteed without an increase in runtime overhead by reusing an existing source code without modifying the source code by inserting an instruction added by modifying a compiler. Facility for risk five architecture instruction extension for .
The method of claim 5, wherein the executable file produced by the compiler is executed on a CPU with an extended architecture,

A device for extending risk five architecture instructions for branch tagging extension, characterized by using a method of allocating a new instruction to a HINT Instruction that is not used among existing instructions.
inserting a tag value storage command inserting a setTag command for tag value storage at a location immediately before an indirect branch when source code is compiled;

inserting a tag value comparison command for inserting a checkTag command for tag value comparison immediately after performing an indirect branch;

A tag value comparison step of determining whether control flow transfer to a correct destination has been performed by comparing a value stored in a control status register at a function entry point with a value given to a command at the function entry point;

A method for extending risk five architecture instructions for branch tagging extension, comprising: a command execution step of permitting command execution through comparison of tag values in the tag value comparison step and exception handling in case of mismatch; .
The method of claim 7, wherein the step of inserting a tag value storage command comprises:

A method for extending risk five architecture instructions for branch tagging extension, characterized in that an operation of writing a unique identification value according to the objective function to the first status register is performed immediately before the indirect branch instruction.
8. The branch tagging extension according to claim 7, characterized in that control flow integrity is ensured without an increase in execution time overhead by reusing an existing source code without source code modification by inserting an instruction added by modifying a compiler. A method for extending the risk five architecture instruction for .