Stack buffer overflow attack defense method and system based on dynamic shadow stack

Abstract

The invention belongs to the technical field of stack buffer overflow attack defense, and particularly relates to a stack buffer overflow attack defense method and system based on a dynamic shadow stack, and the method comprises the steps: applying for a large enough storage space in a process address space for storing shadow stack contents; dividing the content of the shadow stack into a plurality of shares for scattered storage by adopting a secret sharing method; a random number stream is generated based on a random factor generated by software and a shift feedback register, a storage address of a shadow stack which changes randomly is generated during each time of function calling, namely, a storage address of shares of the shadow stack which changes randomly is generated, and the shares are stored in specified positions of a storage space in a scattered mode. According to the method, dual protection of the shadow stack is achieved mainly through shadow stack content scattered storage and shadow stack address randomization, the attack difficulty is greatly increased, and therefore the security of the shadow stack is improved.

Description

technical field [0001] The invention belongs to the technical field of stack buffer overflow attack defense, in particular to a stack buffer overflow attack defense method and system based on a dynamic shadow stack. Background technique [0002] Since stack buffer overflow attacks need to overwrite the contents of the stack, the direct method to detect stack buffer overflow attacks is to check whether the contents of the stack have been tampered with, and the representative method is StackGuard. This method is to implant a piece of special data in the stack as a "sentinel", and the "sentinel" is located between the attack occurrence point and the storage location of the return address. In this way, when the attacker overwrites the contents of the stack by continuously injecting illegal data, the "sentinel" will also be overwritten. Therefore, by checking whether the "sentinel" has been tampered with, it is possible to obtain whether the return address has been tampered with...

AI Technical Summary

Problems solved by technology

Take ParallelShadow Stack as an example: As an important implementation method of the shadow stack, the position of the parallel shadow stack is separated from the normal stack by a fixed offset. When the address of the normal stack is leaked, the position of the shadow stack is also exposed, which exists like the return address Possibility of being tampered with by an attacker

Images