Cryptographic algorithm program vulnerability detection method and system, storage medium

Abstract

The invention relates to the technical field of information security, and provides a cryptographic algorithm program loophole detection method, system, and storage medium. The method includes: parsing the assembly file and the configuration file of the cryptographic algorithm program; constructing the program object according to the parsed assembly file and the configuration file; executing the corresponding instruction of the program object according to the instruction classification information, and executing the first instruction Establish the initial allocation set of the safe type system during the process, monitor the execution of each instruction during the execution of the corresponding instructions of the program object, and compare the final allocation set of the safe type system with the specified allocation after all instructions are executed The partial order relationship of the set to determine whether there is information leakage in the cryptographic algorithm program. The invention has high accuracy rate of loophole detection, strong implementability and good expansibility, and is suitable for different types of cryptographic algorithm programs running on the instruction set framework.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a method for detecting a leak in a cryptographic algorithm program, a system for detecting a leak in a cryptographic algorithm program, and a storage medium. Background technique [0002] With the wide application of different open source cryptographic algorithm libraries (such as openssl, libnacl) in all walks of life, cryptographic algorithm security issues have received widespread attention. In many cases, even if the design of the cryptographic algorithm system is secure, inappropriate cryptographic algorithm implementation will lead to serious security problems. Among them, the static time vulnerability is a relatively hidden and harmful one among many security problems. The source of its leakage is branch operations (case statements), conditional statements, or processor instructions with unfixed running times during the encryption and decryption proces...

AI Technical Summary

Problems solved by technology

The problems that exist in the vulnerability detection process of high-level programming languages ​​are: the accuracy of vulnerability detection cannot be guaranteed when the behavior of the compiler cannot be predicted, and it is difficult to implement when the source code cannot be obtained

For the vulnerability detection of assembly language, there is only a detection model for the AVR8-bit architecture, which has not been applied to actual detection scenarios, and does not have good scalability

Images