program non-control data attack protection method based on an LLVM compiler

Abstract

The invention provides a program non-control data attack protection method based on an LLVM compiler, and the method comprises the steps: compiling a program source code into an intermediate code fora 64-bit application program which is widely applied at present, carrying out the static analysis of the intermediate code, obtaining a directivity analysis result, and obtaining non-control data which needs to be protected; meanwhile, carrying out instruction instrumentation on the basis of the intermediate code, so that non-control data of the program are prevented from being maliciously tampered. According to the method, the defects of an original static analysis method are overcome, the analysis accuracy is improved, and the security threat caused by malicious tampering of program non-control data by an attacker is solved by utilizing relatively low space and time complexity.

Description

technical field [0001] The invention belongs to the field of software security and relates to protection against malicious attacks, in particular to an LLVM compiler-based protection method for program non-control data attacks, which can be used to protect the safe operation of programs. Background technique [0002] Since many programs are written in unsafe languages, such as C or C++, they are vulnerable to attacks based on memory safety. For example, an attacker can use a buffer overflow vulnerability to overwrite a function return address or program branch variable data in memory, thereby changing the execution flow of the program. [0003] In response to attacks, in recent years, industry researchers have proposed many protection mechanisms to defend against attacks based on memory safety. However, the analysis found that most of the existing protection mechanisms provide protection for program control data (such as function pointers and function return addresses), so ...

AI Technical Summary

Problems solved by technology

If the non-control data in the program is tampered with, it will also cause very serious problems, such as enabling the attacker to obtain higher privileges (such as root privileges under the Linux system), stealing user privacy data, opening backdoor vulnerabilities, etc. non-controlling data in the program for protection

Most of the existing non-control data protection technologies are aimed at 32-bit applications, such as Data-flow Integrity [Castro et al., USENIX OSDI2006] and Write Integrity Testing [Akritidis et al., IEEE S&P 2008] proposed by Microsoft Corporation, and Due to the lack of accuracy of the pointer analysis method used, there may be some errors in the analysis results, which will affect the protection effect

At the same time, most of the existing non-control data protection technologies provide protection for the entire virtual address space of the program, which has poor portability and high performance overhead.

Images