A password code-oriented automated program sensitive data protection method

Abstract

An automatic program sensitive data protection method oriented to cipher code. The original key material and plaintext ciphertext taint are manually marked on the program source code by marking statements in advance, and the program source code is converted into the LLVM intermediate language through the LLVM compiler. code; perform static sensitive data flow analysis on the cipher code on the LLVM intermediate language code, and obtain the sensitive buffer in the code and the corresponding code for operating the sensitive buffer; determine the to-be-modified according to the output results of the static analysis stage The allocation of buffers and the memory access instructions that need to be executed in a high-privilege state, and isolation operations are performed on this basis, and the intermediate language obtained from the transformation is compiled and linked to the required runtime library, and the final output is compiled to get the final output. Protected binary program. The invention can automatically help to determine the data structures and sensitive data such as derived key material, intermediate buffer and the like that need to be protected.

Description

technical field [0001] The invention relates to a technology in the field of information security, in particular to a password code-oriented automatic program sensitive data protection method. Background technique [0002] It is a very important task to protect sensitive data in a program from being leaked by some malicious attackers through program memory vulnerabilities, especially for some programs that use passwords. Memory corruption vulnerability is a typical type of vulnerability in system software written by C program. Depending on the target of memory corruption, such attacks can be further classified into control-flow-oriented attacks and data-flow-oriented attacks. If the target of the attacker to overwrite is program control flow related data, such as function return address and function pointer, it is called a control flow oriented attack; if the attacker overwrites or reads the program non-control flow related data , such as cryptographic keys or authenticati...

AI Technical Summary

Problems solved by technology

For in-process memory isolation, there are already many existing technologies that provide support for the basic primitives of isolation, but the existing technologies cannot automatically identify sensitive data

In fact, developers cannot make good use of memory isolation primitives to isolate sensitive data in programs, such as potentially sensitive data generated in cryptographic program logic, because this is a complex and cumbersome task, and manual implementation will be extremely easy omission or error

Images