A pointer protection method applied to an ARM processor and a computer system

Abstract

The application provides a pointer protection method applied to an ARM processor, the ARM processor comprising a common memory and an isolated memory, the ARM processor being loaded with a protected executable file, the protected executable file being configured with pointer information, the method comprising: calculating a pointer verification value according to a preset encryption algorithm based on the pointer information configured in the protected executable file when the ARM processor executes the protected executable file, and storing the pointer verification value into the isolated memory, the pointer verification value indicating whether the pointer information is tampered when the protected executable file is executed; and storing the pointer information configured in the protected executable file into the common memory when the ARM processor executes the protected executable file. The application stores the information of the pointer in the common memory and stores the pointer verification value in the isolated memory, so that the pointer verification value is calculated and compared each time the protected pointer is accessed, the protected pointer is ensured not to be tampered by an attacker, and the security of the computer system is protected.

Description

Technical Field

[0001] This invention relates to the field of computer system security technology, specifically to pointer protection technology in computer system security technology, and more specifically, to a pointer protection method and computer system applied to ARM processors. Background Technology

[0002] In recent decades, IT technology has flourished, and computers have permeated every aspect of people's lives, playing a crucial role in various industries. As computer systems become increasingly complex, security vulnerabilities have also proliferated. Once these vulnerabilities are exploited by hackers, they can cause extremely serious security problems, resulting in significant losses of life and property. Most computer system security problems are caused by security vulnerabilities, with memory corruption vulnerabilities being one of the most common types. Memory corruption vulnerabilities are those that corrupt critical data in computer memory in specific ways. By exploiting memory corruption vulnerabilities, attackers can tamper with function return addresses, SEH (Search Engine Buffer) and other critical data, thereby hijacking the program's control flow. Memory corruption vulnerabilities mainly arise when programmers using non-memory-safe languages ​​(C, C++, etc.) make mistakes in managing the computer system's memory. Attackers typically exploit memory corruption vulnerabilities to tamper with pointers to hijack the program's control flow, either executing malicious code injected by the attacker or executing existing code snippets to launch ROP (Return on Memory) attacks.

[0003] To prevent security issues caused by memory corruption vulnerabilities, researchers have proposed different pointer protection techniques for different computer systems. For ARM-based computer systems, researchers have proposed a cryptographic pointer protection technique (encryption protection). This technique involves signing the pointer in memory in-situ (i.e., calculating a hash value) and verifying the signature during pointer dereferencing to ensure the pointer has not been tampered with by an attacker. This transforms the pointer security issue into a key security issue using signature technology, and then uses secure storage and other methods to ensure key security, thereby achieving pointer security. For x86-based computer systems, researchers have proposed a memory isolation-based pointer protection technique (isolation protection). This technique stores the pointer in a secure memory region (isolated memory), preventing attackers from accessing this isolated memory to achieve secure pointer storage.

[0004] While existing pointer protection techniques can mitigate security issues caused by memory corruption vulnerabilities to some extent, encryption protection technologies still face pointer substitution attacks, where attackers can use an existing signed pointer to replace the target's signed pointer to complete the attack. To address this issue, researchers have introduced Memory Tagging Extension (MTE) technology on ARM processor-based computer systems, building upon isolation protection techniques, to enhance program memory security. MTE technology can tag memory at 16-byte granularity, with a maximum of 16 tags (4 bits per tag). The tag information is stored contiguously in an array within isolated physical memory regions (tagged memory). MTE can also tag each pointer, with a maximum of 16 tags, stored in the high-order bits of the pointer. MTE provides two instructions, LDG and STG, to access tagged memory, thereby obtaining and modifying the tag value corresponding to each 16-byte memory object. During each memory access, MTE automatically compares the pointer's tag value with the corresponding tag value stored in the tagged memory. If they match, access is granted; otherwise, access is denied. While introducing MTE on ARM processor-based computer systems can enhance program memory security, the fact that pointers can be tagged with up to 16 different tags means that different pointers may have the same tag. This situation is called tag collision, and attackers can use tag collision to successfully attack the system, leading to security problems in the computer system.

[0005] In summary, although researchers have introduced MTE technology to enhance program memory security on ARM processors, the fact that MTE technology can only tag pointers with a maximum of 16 tags means that there may be situations where different pointers have the same tag (tag collision). When tag collision occurs, attackers can use the tag collision to successfully attack the system, leading to security problems in the computer system.

[0006] It should be noted that the background information presented here is only for illustrating relevant information about the present invention to aid in understanding the technical solutions of the present invention, and does not imply that the relevant information is necessarily prior art. In the absence of evidence indicating that the relevant information was disclosed before the filing date of this invention, the relevant information should not be considered prior art.

[0007] References:

[0008] [1]Liljestrand,H.,Nyman,T.,Wang,K.,Perez,C.C.,Ekberg,J.E.,&Asokan,N.(2019).{PAC}it up:Towards pointer integrity using{ARM}po interauthentication.In 28th USENIX Security Symposium(USENIX Secur ity 19)(pp.177-194).

[0009] [2]Liljestrand,H.,Nyman,T.,Gunn,L.J.,Ekberg,J.E.,&Asokan,N.(2021).{PACStack}:an authenticated call stack.In 30th USENIX SecuritySymposium(USENIX Security 21)(pp.357-374).

[0010] [3]Farkhani,R.M.,Ahmadi,M.,&Lu,L.(2021).{PTAuth}:Temporal MemorySafety via Robust Points-to Authentication.In 30th USENIX Sec urity Symposium(USENIX Security 21)(pp.1037-1054).

[0011] [4]Ismail,M.,Quach,A.,Jelesnianski,C.,Jang,Y.,&Min,C.(2022).Ti ghtlySeal Your Sensitive Pointers with{PACTight}.In 31st USENIX Sec uritySymposium(USENIX Security 22)(pp.3717-3734).

[0012] [5]Kuznetzov,V.,Szekeres,L.,Payer,M.,Candea,G.,Sekar,R.,&Song,D.(2018).Code-pointer integrity.In The Continuing Arms Race:Code-Reuse Attacksand Defenses(pp.81-116).

[0013] [6]Vahldiek-Oberwagner,A.,Elnikety,E.,Duarte,N.O.,Sammler,M.,Druschel,P.,&Garg,D.(2019).{ERIM}:Secure,Efficient In-process Isolati on withProtection Keys({{{{{MPK}}}}}).In 28th USENIX Security Sy mposium(USENIXSecurity 19)(pp.1221-1238).

[0014] [7]GWang,Z.,Wu,C.,Xie,M.,Zhang,Y.,Lu,K.,Zhang,X.,...&Yang,M.(2020,May).Seimi:Efficient and secure smap-enabled intra-process memoryisolation.In 2020IEEE Symposium on Security and Privacy(SP)(pp.592-607).IEEE.

[0015] [8]Xie,M.,Wu,C.,Zhang,Y.,Xu,J.,Lai,Y.,Kang,Y.,...&Wang,Z.(2022,November).CETIS:Retrofitting Intel CET for generic and efficient intra-process memory isolation.In Proceedings of the 2022ACM SIGSAC Conference onComputer and Communications Security(pp.2989-3002). Summary of the Invention

[0016] Therefore, the purpose of this invention is to overcome the shortcomings of the prior art and provide a pointer protection method and a computer system applicable to ARM processors.

[0017] The objective of this invention is achieved through the following technical solution:

[0018] According to a first aspect of the present invention, a pointer protection method for an ARM processor is provided. The ARM processor includes general-purpose memory and isolated memory. A protected executable file is loaded on the ARM processor. The protected executable file contains pointer information. The method includes: calculating a pointer verification value based on the pointer information configured therein according to a preset encryption algorithm when the ARM processor executes the protected executable file, and storing the pointer verification value in the isolated memory. The pointer verification value indicates whether the pointer information has been tampered with when the protected executable file is executed; and storing the pointer information configured therein in the protected executable file in general-purpose memory when the ARM processor executes the protected executable file.

[0019] In some embodiments of the present invention, the pointer information includes the pointer value, pointer metadata, and pointer index, wherein the pointer value points to a storage address in ordinary memory; the pointer metadata indicates information about the pointer's runtime, including boundary values ​​and random values; the pointer index indicates the position of the corresponding metadata entry in the metadata table, each metadata entry in the metadata table is used to store the pointer's metadata, and each metadata entry is configured with a metadata entry validity bit, the metadata entry validity bit indicating whether the pointer's metadata stored in its corresponding metadata entry in the metadata table is valid.

[0020] In some embodiments of the present invention, the method includes: storing the valid bits of the metadata table entry in isolated memory.

[0021] In some embodiments of the present invention, the value of the valid bit of the metadata entry is 0 or 1, wherein one value indicates that the metadata of the pointer stored in the metadata entry of the corresponding metadata table is valid, and the other value indicates that the metadata of the pointer stored in the metadata entry of the corresponding metadata table is invalid.

[0022] In some embodiments of the present invention, the protected executable file is obtained by encrypting the source code to be processed by pointers in the following manner: obtaining the source code to be processed and parsing it to obtain an intermediate representation of the source code to be processed; analyzing the intermediate representation of the source code to be processed to identify the pointers to be protected and their corresponding operation instructions; and adding a preset protection function to the intermediate representation of the source code to be processed based on the pointers to be protected and their corresponding operation instructions to generate a protected executable file.

[0023] In some embodiments of the present invention, the preset protection functions include pointer encryption protection function, pointer verification protection function, pointer propagation protection function, and pointer release protection function.

[0024] In some embodiments of the present invention, the pointer encryption protection function encrypts the pointer to be protected in the following manner: reads the value and metadata of the pointer to be protected, calculates the pointer verification value of the pointer to be protected according to a preset encryption algorithm, and stores it in the isolated memory.

[0025] In some embodiments of the present invention, the pointer verification protection function verifies the pointer to be protected in the following manner: reads the value and metadata of the pointer to be protected and recalculates the pointer verification value of the pointer to be protected using a preset encryption algorithm, and compares the recalculated pointer verification value of the pointer to be protected with the pointer verification value of the pointer to be protected stored in isolated memory to see if they are equal. If they are equal, it indicates that the pointer to be protected can be used normally; if they are not equal, it indicates that the pointer to be protected cannot be used normally.

[0026] In some embodiments of the present invention, the pointer propagation function propagates the pointer to be protected in the following manner: it reads the value, metadata and index of the pointer to be protected, copies them and stores them in a new storage address in ordinary memory, and copies the pointer verification value of the pointer to be protected read in isolated memory and stores it in a new storage address in isolated memory.

[0027] In some embodiments of the present invention, the pointer release protection function releases the pointer to be protected in the following manner: clearing the data at the position of the metadata table entry corresponding to the metadata of the pointer to be protected indicated by the index of the pointer to be protected, and setting the value of the valid bit of the metadata table entry of the pointer to be protected stored in the isolated memory to invalidate the metadata of the pointer to be protected stored in the metadata table entry corresponding to it.

[0028] Preferably, the preset encryption algorithm is the QARMA algorithm.

[0029] According to a second aspect of the present invention, a computer system is provided, the system comprising: a compiler for performing pointer encryption on source code to be processed to generate a protected executable file; and an ARM processor for executing the protected executable file generated by the compiler; wherein the computer system is configured to perform pointer protection using the method described in the first aspect of the present invention.

[0030] Compared with the prior art, the advantages of the present invention are: (1) the pointer information is stored in ordinary memory and the pointer verification value is stored in isolated memory, and each pointer has a unique pointer verification value, which can effectively avoid pointer verification value collision and thus avoid pointer substitution attack; (2) each time the pointer is accessed, only the pointer verification value needs to be calculated and compared to ensure that the pointer has not been tampered with, without introducing additional performance overhead; (3) since the pointer verification value is stored in isolated memory, the attacker can only replace the value of the pointer and cannot replace the pointer verification value, which can effectively protect the security of the computer system and prevent the occurrence of memory corruption vulnerabilities; (4) the size of the pointer verification value is only 16 bits, which can save a lot of memory space compared to directly storing the pointer in isolated memory. Attached Figure Description

[0031] The embodiments of the present invention will be further described below with reference to the accompanying drawings, wherein:

[0032] Figure 1 This is a schematic flowchart of a pointer protection method applied to an ARM processor according to an embodiment of the present invention;

[0033] Figure 2 This is a schematic diagram illustrating an example of the storage of a pointer in ordinary memory and isolated memory according to an embodiment of the present invention;

[0034] Figure 3 This is a schematic diagram of the process by which the pointer verification protection function verifies the pointer to be protected according to an embodiment of the present invention;

[0035] Figure 4 This is a schematic diagram of the encoder architecture according to an embodiment of the present invention. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the invention.

[0037] To make it easier to understand, let's first briefly introduce the encryption protection technology based on ARM processors and the isolation protection technology based on x86 processors.

[0038] I. Encryption Protection Technology

[0039] Encryption Protection Technology: Pointer Authentication (PA), introduced on ARM processors, is a typical encryption protection technology. In this technology, a signature value for the pointer is calculated based on the original pointer value and context information using an encryption algorithm. This signature value is then appended to the unused high-order bits of the pointer. When the pointer is used, this calculation process is repeated to calculate the pointer's signature value and compare it with the signature value stored in the high-order bits. This determines whether the pointer has been tampered with. If they match, the pointer has not been tampered with; otherwise, the pointer authentication technology triggers an abnormal termination of program execution. While pointer authentication technology can prevent security issues caused by memory corruption vulnerabilities to a certain extent, it still faces pointer substitution attacks. This means that an attacker can use an existing signed pointer to replace the target signed pointer to complete the attack.

[0040] To address this issue, researchers have proposed using more complex runtime information in pointer signing to reduce the set of interchangeable pointers (theoretically, only pointers with the same runtime information can be interchanged during signing), thereby maximizing pointer security. For example, the PARTS (Pointer Authentication Run-Time Safety) technology proposed in reference [1] is used to protect two types of pointers: function return addresses and function pointers. Based on existing pointer verification technologies, PARTS adds function ID (function-id) as additional runtime information to function return address protection and type ID (type-id) as additional runtime information to function pointers. The PACStack technology proposed in reference [2] goes a step further in protecting function return addresses by using function call stack information as context information in the protection of function return address pointers, which is then incorporated into the pointer signing operation. Although both the PARTS technology proposed in reference [1] and the PACStack technology proposed in reference [2] introduce complex runtime information to alleviate pointer substitution attack problems, they do not fundamentally address the issue of pointer substitution attacks and cannot fully guarantee temporal and spatial security. Reference [3] proposed the PTAuth technique, which introduces a random value as runtime information of the pointer. In the PTAuth technique, after each memory allocation, the system will store a random value in a specific memory area and use it as runtime information for all subsequent pointers pointing to that memory area. Although the random value introduced by the PTAuth technique proposed in Reference [3] can protect the timing security of pointers, the attack model assumed by the PTAuth technique only grants the attacker read access to the specific memory area and the ordinary memory area, resulting in weak protection. Reference [4] proposed the PACTight technique, which follows the idea of ​​the PTAuth technique, retains the random value as part of the pointer runtime information, and adds the pointer address to the runtime information. After introducing the pointer address as pointer information, simple pointer replacement will be difficult to achieve. However, PACTight technology uses the pointer's value to index the stored random value, which allows for pointer reuse over time. This means that when an attacker attempts to reuse a new pointer using an old pointer at the same address at different times, the old pointer can use its value to index the corresponding random value. At this point, the old pointer can be verified using its address and the corresponding random value, meaning the attacker can complete the attack. Therefore, PACTight technology cannot completely guarantee temporal security. In summary, even with highly complex runtime information used in pointer signing, PA-based pointer integrity technology still has security issues, and using complex runtime information also incurs greater performance overhead.

[0041] II. Isolation and Protection Technology

[0042] Isolation protection technology: The pointer integrity technology (Code Pointer Integrity, CPI) proposed in reference [5] is a typical isolation protection technology. CPI technology ensures the integrity of sensitive pointers, that is, the pointer and the data pointer pointing to the pointer (e.g., the structure pointer containing the function pointer). CPI technology stores the metadata information (e.g., the starting position and size) of the sensitive pointer and the object it points to in an isolated memory area that is inaccessible to attackers. It also dynamically maintains the contents of the isolated memory area when the pointer is created, propagated, calculated and destroyed. Each pointer operation is strictly checked to ensure that it points to the correct object. Each time the pointer is dereferenced, CPI technology judges whether the pointer in the ordinary memory area has been modified based on the information stored in the isolated memory area. The use of memory isolation mechanism is the key to security. CPI technology uses information hiding technology to achieve efficient memory isolation, that is, the isolated memory is hidden in a huge unallocated address space. There are no pointers pointing to the isolated memory area in the ordinary memory area. Attackers can only locate the location of the isolated memory area by trial and error, and incorrect trial and error will cause the program to crash. While CPI (Code Pointer Imaging) technology can prevent security issues caused by memory corruption vulnerabilities to some extent, the information hiding techniques it employs are no longer secure or effective. Attackers can use crash suppression, side-channeling, and other methods to continuously probe memory until they locate the isolated memory location. In other words, while CPI technology, based on isolated code pointer protection mechanisms, is theoretically secure, it requires the use of secure and reliable strong memory isolation techniques to achieve memory isolation.

[0043] To improve the security of CPI technology, researchers have proposed different memory isolation mechanisms based on the hardware mechanisms provided by the X86 processor and built more secure CPI technologies accordingly. For example, the MPK (Memory Protection Keys) hardware mechanism based on the X86 processor proposed in Reference [6] is used to implement memory isolation. Under MPK protection, each virtual page is assigned a 4-bit ID, which divides the entire memory space of the process into 16 domains. The read and write permissions of each domain are stored by the PKRU register, and binary detection is used to ensure that all instructions that update the PKRU register are safe, thereby ensuring the security of the isolation area divided by the MPK mechanism. Reference [7] proposes to use the SMAP (Supervisor-mode Access Prevention) hardware mechanism of the X86 processor to implement memory isolation. SMAP is used to prevent privileged access to data in the user memory space, and SMAP is used in reverse to put user code into the privileged level to run. This ensures that the user's sensitive data is still stored in the user memory space. However, under the protection of SMAP, even if the attacker can inject code, he cannot modify the data in the user memory space. That is, the data in the user space can be regarded as being isolated and protected. Reference [8] proposes to modify the shadow stack in the CET (Control-flow Enforcement Technology) hardware mechanism of the X86 processor to achieve memory isolation, that is, to construct an efficient isolation area using the shadow stack: CET allocates pages dedicated to the shadow stack by inserting unique flag bits in the R / W bit and Dirty bit of the page table entry, and designs a special WRSS instruction to modify the page marked as the shadow stack (protecting the security of all WRSS instructions when used, and using the shadow stack in the CET hardware mechanism to achieve more general isolation).

[0044] As mentioned in the background section, although researchers have introduced MTE technology to enhance program memory security on ARM processors, MTE technology can only tag pointers with a maximum of 16 tags. This means that there may be situations where different pointers have the same tag (tag collision). When tag collision occurs, attackers can use tag collision to successfully attack the system, which can lead to security problems in the computer system.

[0045] To address the aforementioned issues, the inventors conducted a detailed analysis of MTE (Memory Tagging Extension) technology. MTE provides strong memory isolation guarantees. Specifically, MTE technology comprises two mechanisms: Memory Tagging, which tags memory at 16-byte granularity, allowing for up to 16 different tags (each tag being 4 bits), with the tag information stored contiguously in an isolated physical memory region (called tagged memory) as an array; and Pointer Tagging, which tags each pointer, also allowing for up to 16 different tags, with the tag information stored in the high-order bits of the pointer. In addition to these two mechanisms, MTE technology provides two instructions, LDG and STG, for accessing tagged memory to retrieve and modify the tag value corresponding to each 16-byte memory object. During each memory access, MTE automatically compares the pointer's tag value with the tag value of the target memory object. If they match, access is granted normally; otherwise, access is rejected. Generally speaking, MTE (Memory Safety) technology is used to enhance the memory safety of a program: adjacent objects are set to different labels, and out-of-bounds access to pointers will trigger an exception; after an object is released, its memory label is set to a different value, and dereferencing a dangling pointer will trigger an exception.

[0046] Analysis of MTE technology reveals that the Pointer Tagging and Memory Tagging mechanisms are decoupled. This means we can use only the Memory Tagging mechanism to tag memory, eliminating the need to check the tag's correctness during pointer access, while still allowing the use of LDG / STG memory access instructions. Leveraging this characteristic, we can consider storing the pointer to be protected directly in the tagged memory. Since the tagged memory cannot be accessed by any instructions other than LDG / STG, this effectively protects the pointer. Therefore, the inventors propose storing the pointer to be protected directly in the tagged memory. Each time the pointer needs to be accessed, LDG / STG memory access instructions are used to retrieve or update the pointer's value. This prevents attackers from successfully attacking the system using tag collisions.

[0047] While it is theoretically possible to directly store the pointer to be protected in the tag memory, the inventors discovered two shortcomings in this method of storage during practical applications. Firstly, there is the performance overhead. This is because LDG / STG memory access instructions can only access 4 bits of data at a time, and the latency of each access is greater than that of ordinary memory access instructions. This means that if the pointer to be protected is directly stored in the tag memory, accessing the tag memory using LDG / STG memory access instructions to retrieve the pointer requires accessing at least 8 bytes of tag memory (the size of a pointer), which requires 16 LDG / STG memory access instructions (8*8=64 bits, 64 / 4=16 instructions), introducing a very large performance overhead. Another aspect is the memory layout issue. This is because tags are stored contiguously in tag memory as arrays. There is a linear correspondence between every 16-byte ordinary memory object and the 4-bit tag value in tag memory. We can array the ordinary memory and tag memory, with each item in the ordinary memory object array and the tag memory array having a one-to-one correspondence (16 bytes of ordinary memory correspond to 4 bits of tag memory). Based on this correspondence, the LDG / STG memory access instruction is used to read and write the corresponding 4-bit tag value given the address of a 16-byte ordinary memory object (the ordinary memory address to tag memory address is automatically converted by the hardware). If, according to the existing hardware mapping relationship, the pointer to be protected is used to continuously obtain 16 tag values ​​(16*4=64 bits) at the address of ordinary memory using the LDG / STG memory access instruction as an isolated pointer to be protected, then the 64 bits of isolated memory correspond to 256 bytes (16*16=256 bits) of ordinary memory. This means that there can only be one pointer in the 256 bytes of ordinary memory; otherwise, the two pointers to be protected stored in the tag memory will overlap. If you want to store the pointers to be protected in isolated memory by discretization to avoid memory layout problems, you need to introduce an additional dynamic mapping algorithm, which will bring additional performance overhead.

[0048] Based on the above analysis, the inventors realized that directly storing the pointer to be protected in the tagged memory would incur performance overhead and memory layout issues. To address this problem, the inventors propose a novel pointer verification scheme to protect pointers and prevent security vulnerabilities in computer systems. This scheme reduces performance overhead by compressing the amount of data accessed in a single tagged memory session and employing a direct hardware tag mapping method. The core idea is to store some information of the pointer to be protected in ordinary memory, while storing the pointer verification value in isolated memory (based on MTE technology, dividing memory into ordinary and isolated memory areas). Each time the pointer to be protected is accessed, the pointer verification value is calculated and compared to ensure that the pointer has not been tampered with by an attacker. Furthermore, to improve the calculation efficiency of the pointer verification value, the pointer verification technology PA introduced by ARM processors is used to calculate the pointer verification value. The calculated pointer verification value is only 16 bits (at this point, the size of 16 bits of isolated memory corresponds to 64 bytes of ordinary memory, meaning that only one pointer to be protected can be stored in 64 bytes of ordinary memory), saving a significant amount of memory space.

[0049] According to the new pointer verification scheme, such as Figure 1 As shown, this invention provides a pointer protection method applied to an ARM processor. The ARM processor includes general-purpose memory and isolated memory. A protected executable file is loaded on the ARM processor. The protected executable file contains pointer information. The method includes: when the ARM processor executes the protected executable file, calculating a pointer verification value based on the pointer information configured therein according to a preset encryption algorithm, and storing the pointer verification value in the isolated memory. The pointer verification value indicates whether the pointer information has been tampered with when the protected executable file is executed; and storing the pointer information configured therein in the general-purpose memory when the ARM processor executes the protected executable file. Compared to existing pointer protection technologies, the present invention stores pointer information in ordinary memory and pointer verification values ​​in isolated memory. Each pointer has a unique verification value calculated from the pointer information, effectively preventing pointer verification value collisions and thus pointer substitution attacks. Each time a pointer is accessed, only the pointer verification value needs to be calculated and compared to ensure the pointer has not been tampered with, without introducing additional performance overhead. Since the pointer verification value is stored in isolated memory, attackers can only replace the pointer value and not the pointer verification value, effectively protecting the security of the computer system and preventing memory corruption vulnerabilities. The pointer verification value is only 16 bits in size, saving a significant amount of memory space compared to directly storing the pointer in isolated memory.

[0050] The pointer verification value is stored in isolated memory. Attackers can only replace the pointer value but not the pointer verification value, which can effectively protect the pointer. Furthermore, the pointer verification value is obtained through pointer information. Different pointers have different pointer verification values, which can effectively avoid tag collisions and thus prevent pointer replacement attacks. Moreover, the pointer verification value is only 16 bits in size, which can save a lot of memory space compared to directly storing the pointer to be protected in isolated memory.

[0051] To better understand this invention, the following detailed description of the invention's solution, in conjunction with specific embodiments and accompanying drawings, covers pointer information, source code pointer encryption, protection functions, and computer systems.

[0052] I. Pointer Information

[0053] According to one embodiment of the present invention, the pointer information includes the pointer value, pointer metadata, and pointer index, wherein the pointer value points to a storage address in ordinary memory; the pointer metadata indicates information about the pointer's runtime, including boundary values ​​and random values; the pointer index indicates the position of the pointer metadata entry in the metadata table, each metadata entry in the metadata table is used to store the pointer metadata, and each metadata entry is configured with a metadata entry validity bit, the metadata entry validity bit indicating whether the pointer metadata stored in its corresponding metadata entry in the metadata table is valid.

[0054] According to one embodiment of the present invention, the method further includes: storing the valid bit of the metadata entry in isolated memory. Storing the valid bit of the metadata entry in isolated memory can further confirm whether the pointer information has been tampered with by an attacker; that is, when it is necessary to dereference the pointer, the validity of the pointer metadata stored in the corresponding metadata entry in the metadata table is determined based on the value of the valid bit of the metadata entry stored in isolated memory.

[0055] According to one embodiment of the present invention, the value of the valid bit of the metadata entry is 0 or 1, wherein one value indicates that the metadata of the pointer stored in the metadata entry of the corresponding metadata table is valid, and the other value indicates that the metadata of the pointer stored in the metadata entry of the corresponding metadata table is invalid.

[0056] To more intuitively understand how pointer information and the pointer verification value calculated based on that information are stored in ordinary memory and isolated memory, respectively, we will... Figure 2 The example shown illustrates how a pointer is stored in both regular memory and isolated memory. Figure 2In the diagram, the left side of the dashed line represents ordinary memory, and the right side represents isolated memory. Ordinary memory stores the pointer's value, its metadata, and its index. Here, `ptr` represents the pointer; `value` represents the pointer's value; the pointer's metadata includes boundary values ​​and a 64-bit random value; and `index` indicates the pointer's location within the metadata table corresponding to its metadata entry. Isolated memory stores the valid bit (indicating whether the metadata of the pointer stored in the corresponding metadata entry is valid) and the pointer verification value (`pac`), indicating whether the pointer information has been tampered with.

[0057] II. Source Code Pointer Encryption

[0058] According to one embodiment of the present invention, the protected executable file is obtained by encrypting the source code to be processed through pointer encryption in the following manner: obtaining the source code to be processed and parsing it to obtain an intermediate representation of the source code to be processed; analyzing the intermediate representation of the source code to be processed to identify the pointers to be protected and their corresponding operation instructions; and adding a preset protection function to the intermediate representation of the source code to be processed based on the pointers to be protected and their corresponding operation instructions to generate the protected executable file. It should be noted that the type of pointer to be protected is determined by the actual application, and the present invention does not impose specific limitations. For example, the pointer to be protected can be a sensitive pointer, which can be a code pointer and a data pointer pointing to a code pointer, such as a structure pointer containing function pointers.

[0059] III. Protection Functions

[0060] According to one embodiment of the present invention, the preset protection functions include a pointer encryption protection function, a pointer verification protection function, a pointer propagation protection function, and a pointer release protection function. It should be noted that the preset protection functions also include a pointer creation protection function.

[0061] According to an embodiment of the present invention, the pointer creation protection function creates the pointer to be protected in the following manner: selecting an unused metadata entry in the metadata table and filling the boundary value of the pointer to be protected and a randomly generated 64-bit random value into the metadata entry, and using the sequence of the metadata entry as the index of the pointer to be protected so that the metadata entry can be correctly found from the metadata table based on the index.

[0062] According to an embodiment of the present invention, the pointer encryption protection function encrypts the pointer to be protected in the following manner: reads the value and metadata of the pointer to be protected, calculates the pointer verification value of the pointer to be protected according to a preset encryption algorithm, and stores it in the isolated memory.

[0063] According to an embodiment of the present invention, the pointer verification protection function verifies the pointer to be protected in the following manner: It reads the value and metadata of the pointer to be protected and recalculates the pointer verification value of the pointer to be protected using a preset encryption algorithm. It then compares the recalculated pointer verification value with the pointer verification value of the pointer to be protected stored in isolated memory. If they are equal, it indicates that the pointer to be protected can be used normally; otherwise, it indicates that the pointer to be protected cannot be used normally. It should be noted that when verifying the pointer to be protected, the pointer verification protection function also needs to verify whether the pointer to be protected is out of bounds: it reads the metadata of the pointer to be protected to obtain a boundary value, and determines whether the pointer to be protected is out of bounds based on the obtained boundary value. If the pointer to be protected is not out of bounds, it indicates that the pointer to be protected can be used normally; if the pointer to be protected is out of bounds, it indicates that the pointer to be protected cannot be used normally. To better understand the pointer verification protection function, Figure 3 The execution process of the pointer verification protection function shown is explained in detail using this example. Figure 3 The pointer verification protection function verifies the pointer to be protected as follows: First, it reads the metadata of the pointer to be protected to obtain the boundary value. Based on the obtained boundary value, it determines whether the pointer to be protected is out of bounds. If the pointer to be protected is out of bounds, it means that the pointer to be protected can be used abnormally, and the pointer verification protection function will report an error and terminate the program. If the pointer to be protected is not out of bounds, it reads the value and metadata of the pointer to be protected and recalculates the pointer verification value of the pointer to be protected using a preset encryption algorithm. It then compares the recalculated pointer verification value of the pointer to be protected with the pointer verification value of the pointer to be protected stored in the isolated memory to see if they are equal. If they are equal, it indicates that the pointer to be protected can be used normally; if they are not equal, it indicates that the pointer to be protected cannot be used normally, and the pointer verification protection function will report an error and terminate the program.

[0064] According to one embodiment of the present invention, the pointer propagation function propagates the pointer to be protected as follows: it reads the value, metadata, and index of the pointer to be protected, copies them, and stores them at a new storage address in ordinary memory; it also copies the pointer verification value of the pointer to be protected, read from isolated memory, and stores it at a new storage address in isolated memory. It should be noted that the value, metadata, and index of the pointer to be protected stored in ordinary memory can be propagated directly together, while the pointer verification value of the pointer to be protected stored in isolated memory needs to be copied separately to the new storage address.

[0065] According to one embodiment of the present invention, the pointer release protection function releases the pointer to be protected in the following manner: clearing the data at the position of the metadata table entry corresponding to the metadata of the pointer to be protected, as indicated by the index of the pointer to be protected, and setting the value of the valid bit of the metadata table entry of the pointer to be protected stored in isolated memory to invalidate the metadata of the pointer to be protected stored in the corresponding metadata table entry. It should be noted that the protection functions mentioned in the foregoing embodiments are implementation principles during specific code execution.

[0066] According to one embodiment of the present invention, the preset encryption algorithm is the QARMA algorithm. It should be noted that in both the pointer encryption protection function and the pointer verification protection function, the verification value of the pointer to be protected is calculated using the preset encryption algorithm based on the value of the pointer to be protected and its metadata. However, in practical applications, other pointer-related parameters can also be used to calculate the pointer verification value, such as the pointer index and pointer type information; the present invention does not impose any special limitations. It should also be noted that, in addition to the QARMA algorithm, the preset encryption algorithm can also use hash algorithms, digital signature algorithms, random number generation algorithms, and other encryption algorithms; the present invention does not impose any specific limitations.

[0067] IV. Computer System

[0068] Based on the foregoing embodiments, the present invention also proposes a computer system, the system comprising: a compiler for performing pointer encryption on source code to be processed to generate a protected executable file; and an ARM processor for executing the protected executable file generated by the compiler; wherein the computer system is configured to perform pointer protection using the method described in the foregoing embodiments.

[0069] According to one embodiment of the present invention, the compiler may employ the LLVM (Low Level Virtual Machine) compiler framework, which is a modular, reusable collection of compiler and toolchain technologies. Most of the logic in the LLVM compiler handles compilation optimization and code generation, and these functions are composed of a series of passes. The present invention employs... Figure 4 The demonstrated coding architecture processes the source code, by Figure 4As can be seen, the encoder is based on the LLVM (Low Level Virtual Machine) compiler architecture, and also adds intermediate pointer analysis Pass and compiler-rt static library (these two parts constitute LLVM IR). The compiler operates as follows: First, it performs clang front-end processing on the source code, parsing it to obtain an intermediate representation. Then, it uses a mid-level pointer analysis pass to analyze this intermediate representation to identify pointers to be protected and their corresponding instructions. This pass iterates through each instruction in each basic block of each function within the intermediate representation, determining if each instruction corresponds to the pointer to be protected. If not, it checks if it's the last instruction; if so, it exits the analysis, otherwise it continues analyzing the remaining instructions. If it is, it records the instruction in a pointer allocation table so that, during subsequent processing, the corresponding protection function is selected from the compiler-rt static library at the appropriate time point based on the different instructions in the table. Finally, based on the pointers to be protected and their corresponding instructions, the compiler adds preset protection functions stored in the compiler-rt static library to the intermediate representation of the source code for LLVM back-end processing to generate the protected executable file.

[0070] The beneficial effects of the present invention are as follows: (1) The pointer information is stored in ordinary memory, the pointer verification value is stored in isolated memory, and each pointer has a unique pointer verification value, which can effectively avoid pointer verification value collision and thus avoid pointer substitution attacks; (2) Each time the pointer is accessed, only the pointer verification value needs to be calculated and compared to ensure that the pointer has not been tampered with, without introducing additional performance overhead; (3) Since the pointer verification value is stored in isolated memory, the attacker can only replace the value of the pointer and cannot replace the pointer verification value, which can effectively protect the security of the computer system and prevent the occurrence of memory corruption vulnerabilities; (4) The pointer verification value is only 16 bits in size, which can save a lot of memory space compared to directly storing the pointer in isolated memory.

[0071] It should be noted that although the steps are described in a specific order above, it does not mean that the steps must be executed in the above specific order. In fact, some of these steps can be executed concurrently, or even in a different order, as long as the required function can be achieved.

[0072] This invention can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of the invention.

[0073] Computer-readable storage media can be tangible devices that hold and store instructions for use by an instruction execution device. Computer-readable storage media can be, for example, including but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof.

[0074] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A pointer protection method applied to an ARM processor, the ARM processor including general-purpose memory and isolated memory, wherein a protected executable file is loaded on the ARM processor, and the protected executable file is configured with pointer information, characterized in that, The method includes: When the ARM processor executes the protected executable file, it calculates a pointer verification value based on the pointer information configured therein according to a preset encryption algorithm, and stores the pointer verification value in isolated memory. The pointer verification value indicates whether the pointer information has been tampered with when the protected executable file is executed. When the ARM processor executes the protected executable file, the pointer information configured therein is stored in ordinary memory; The pointer information includes the pointer's value, pointer metadata, and pointer index. The pointer's value points to a storage address in ordinary memory; the pointer's metadata indicates information about the pointer's runtime, including boundary values ​​and random values; the pointer's index indicates the position of the corresponding metadata entry in the metadata table, each metadata entry in the metadata table stores the pointer's metadata, and each metadata entry is configured with a metadata entry validity bit, which indicates whether the pointer's metadata stored in its corresponding metadata entry is valid; Specifically, the valid bits of the metadata entries are stored in isolated memory; Among them, based on MTE technology, memory is divided into ordinary memory area and isolated memory area.

2. The method according to claim 1, characterized in that, The valid bit of the metadata entry has a value of 0 or 1. One value indicates that the metadata of the pointer stored in the metadata entry in the corresponding metadata table is valid, and the other value indicates that the metadata of the pointer stored in the metadata entry in the corresponding metadata table is invalid.

3. The method according to claim 2, characterized in that, The protected executable file is obtained by encrypting the source code to be processed using pointer encryption in the following manner: Obtain the source code to be processed and parse it to obtain an intermediate representation of the source code; The intermediate representation of the source code to be processed is analyzed to identify the pointers to be protected and their corresponding operation instructions; Based on the pointer to be protected and its corresponding operation instructions, a preset protection function is added to the intermediate representation of the source code to be processed to generate a protected executable file.

4. The method according to claim 3, characterized in that, The preset protection functions include pointer encryption protection function, pointer verification protection function, pointer propagation protection function, and pointer release protection function.

5. The method according to claim 4, characterized in that, The pointer encryption protection function encrypts the pointer to be protected in the following manner: The value and metadata of the pointer to be protected are read, and the pointer verification value of the pointer to be protected is calculated according to the preset encryption algorithm and stored in the isolated memory.

6. The method according to claim 5, characterized in that, The pointer verification protection function verifies the pointer to be protected in the following manner: The value and metadata of the pointer to be protected are read, and the pointer verification value of the pointer to be protected is recalculated using a preset encryption algorithm. The recalculated pointer verification value of the pointer to be protected is then compared with the pointer verification value of the pointer to be protected stored in isolated memory. If they are equal, it indicates that the pointer to be protected can be used normally; if they are not equal, it indicates that the pointer to be protected cannot be used normally.

7. The method according to claim 6, characterized in that, The pointer propagation function propagates the pointer to be protected in the following manner: The value, metadata, and index of the pointer to be protected are read, copied, and stored at a new storage address in ordinary memory. The pointer verification value of the pointer to be protected read from the isolated memory is copied and stored at a new storage address in the isolated memory.

8. The method according to claim 7, characterized in that, The pointer release protection function releases the pointer to be protected in the following manner: Clear the data at the location of the metadata entry in the metadata table corresponding to the metadata of the pointer to be protected, as indicated by the index of the pointer to be protected, and set the value of the valid bit of the metadata entry of the pointer to be protected stored in the isolated memory to invalidate the metadata of the pointer to be protected stored in the metadata entry of the corresponding metadata table.

9. The method according to claim 8, characterized in that, The preset encryption algorithm is the QARMA algorithm.

10. A computer system, characterized in that, The system includes: A compiler is used to perform pointer encryption on the source code to generate a protected executable file; An ARM processor is used to execute the protected executable file generated by the compiler. The computer system is configured to perform pointer protection using the method described in any one of claims 1-9.

11. A computer-readable storage medium, characterized in that, It stores a computer program that can be executed by a processor to implement the steps of the method according to any one of claims 1 to 9.

12. An electronic device, characterized in that, include: One or more processors; as well as Memory, wherein the memory is used to store executable instructions; The one or more processors are configured to implement the steps of the method according to any one of claims 1 to 9 by executing the executable instructions.

Images