Stack overflow attack defense method

Abstract

The invention discloses a stack overflow attack defense method, which belongs to the field of security guarantee of a computer system. The method comprises the following steps of: a) positioning a function with potential stack overflow defect in a program; b) before the function is executed, encrypting a return address to obtain first encrypted message by using a key register and storing the encrypted message; and c) before the function is returned, encrypting the return address to obtain second encrypted message by using the key register likewise, and if the first encrypted message and the second encrypted message are different, showing that the stack overflow attack exists. The method can be used for stack overflow attack defense, and is applicable in multiple fields of aerospace, finance, manufacture, communication, energy, medicinal treatment, education and the like.

Description

Technical field [0001] The invention relates to a technology for detecting buffer overflow in source code and enhancing the security of target code, in particular to a method for defending stack overflow attacks, belonging to the field of security protection of computer systems. Background technique [0002] Computer applications have penetrated into various fields such as aerospace, finance, manufacturing, communications, energy, medical care, education, and so on. People's work and life are increasingly dependent on computer software. People not only need computers to achieve more functions, but also put forward higher requirements for the security of computer systems. Since its first appearance in the 1980s (Spafford, E., TheInternet worm program: an anallyis. ACM SIGCOMM Computer Communication Review, 1989.19(1): p.57.), buffer overflow attacks have been a serious threat to computer system security . At present, with the development of viruses and malicious programs, the bu...

AI Technical Summary

Problems solved by technology

In this way, after the stack overflow attack occurs, the verification process of the jump address and the protection value cannot find that the integrity of the stack return address has been destroyed

Therefore, there are other defects in the program that may cause the attacker to read the memory content out of bounds. The existing stack overflow protection method will be invalid, and the attacker can successfully intercept the program control flow by bypassing the existing protection mechanism.

Images