Method for defending Spectre v1 attack by using binary instrumentation

Abstract

The invention discloses a method for defending Spectre v1 attacks on an ARM framework by using binary instrumentation, which comprises the following implementation steps of: acquiring disassembling information of a target binary file, analyzing the disassembling information, identifying code snippets which are easily attacked by Spectre v1, adding the code snippets which are easily attacked by Spectre v1 into a code snippet set, and performing binary instrumentation to defend Spectre v1 attacks. Whether the code snippet set is empty or not is judged, a defense instruction is constructed according to the code snippets prone to attack under the non-empty condition, and the defense instruction is inserted into the target binary file through a binary instrumentation tool. The method is used for defending Spectrev1 attacks, source codes are not needed, the method is suitable for commercial software and closed source systems, system complexity is not increased, and development cost is low.

Description

Technical Field

[0001] The present invention belongs to the field of processor information security technology, and further relates to a method for defending Spectre v1 attacks by using binary instrumentation in the field of computer malware detection or processing technology. The present invention can be used to defend against Spectre v1 attacks at the ARM architecture software level, and the main target of protection is vulnerable binary files. Background Art

[0002] At present, for hardware devices that are widely used in information devices, especially systems that have been widely deployed, it is unrealistic to make modifications to existing hardware. The use of serialization or speculation blocking instructions or disabling branch prediction will cause the processor's speculative execution efficiency to drop significantly, thus having a negative impact on system performance. The Spectre v1 attack is an attack that exploits a vulnerability in the processor's speculative execution mechanism. The attack exploits the CPU's speculative execution and side channel leaks, and trains the branch predictor to make incorrect predictions, thereby reading sensitive data that should have been restricted. Because the attack occurs in the speculative execution stage rather than the actual execution stage, traditional security protection measures are difficult to prevent data leakage. This feature makes Spectre v1 a type of vulnerability that is difficult to detect and defend against.

[0003] China Electronics Technology Shentai Information Technology Co., Ltd. disclosed a method involving disrupting the speculative execution of Spectre attacks on superscalar processors in its patent document "Method for disrupting the speculative execution of Spectre attacks on superscalar processors" (application number: 202311344301.1, authorization announcement number: CN 117077152B, application date: October 18, 2023). The implementation steps of the method are as follows: step 1: code detection marking; code detection is performed on the input source code to detect possible speculative execution bypasses and mark them; step 2: filter branch closures; for the possible speculative execution bypasses marked in step 1, filter out specific branch instructions, close the branch prediction unit at the location, and perform secondary marking at the same time; step 3: increase access delay; remove the secondary mark in the step 1 mark, detect the specific instructions after the branch instruction at the remaining mark, and increase the access delay of its Dcache. This method combines multiple means of detecting, closing the branch predictor and delaying cache access, and comprehensively defends against the two core mechanisms of Spectre attacks, namely, incorrect branch prediction and cache side channel leakage. By filtering branches and turning off the branch prediction unit, speculative execution can be directly blocked, while by increasing the cache access delay, attackers can be effectively prevented from using side channels to obtain information. However, this detection method still has three shortcomings: first, it needs to be operated on the basis of source code, which cannot be applied to many commercial software and closed-source systems; second, although turning off the branch prediction unit can eliminate the hidden dangers of Spectre attacks, it may cause the processor pipeline to pause and instructions to be reordered, resulting in higher program overhead; third, increasing the Dcache access delay can greatly reduce the risk of sensitive data brought by Spectre attacks, but it will cause the system to wait longer each time data is read or written, which will directly lead to a decrease in data processing speed and further increase program overhead.

[0004] The Institute of Information Engineering of the Chinese Academy of Sciences disclosed a method and system for resisting Spectre attacks based on flush operations in its patent application "A method and system for resisting Spectre attacks based on flush operations" (application number: 202010633770.5, application publication number: CN 111898127A, application date: July 2, 2020). The implementation steps of this method are: execute the flush operation of the process and record the current process information; calculate the time interval between two adjacent flush operations of the current process, and determine whether the time interval is within the malicious flush time range. If so, it is determined to be a malicious flush operation; if the number of malicious flush operations is greater than a threshold, it is determined to be a malicious process; turn off the branch prediction function, hibernate the malicious process, and prevent the CPU from speculative execution to resist Spectre attacks based on flush operations. This method can monitor and record the flush operation of the process in real time, monitor whether the process performs malicious flush behavior, and if it is detected as a malicious process, temporarily disable branch prediction to prevent the CPU from speculative execution. It can not only resist the Spectre attack based on flush operation launched by attackers, but also ensure the normal use of the flush function of the system. However, this method still has shortcomings: this method requires the introduction of a specially designed Flush-Detector API in the system, and relies on the coordination of hardware (such as timers and branch prediction registers) with the kernel layer, which means that the existing system architecture needs to be modified, which increases the complexity of the system and has a high cost of developing defense measures. Summary of the invention

[0005] The purpose of the present invention is to address the deficiencies of the above-mentioned prior art and propose a method for defending against Spectre v1 attacks on the ARM architecture by using binary instrumentation, so as to solve the problems that the prior art cannot be applied to many commercial software and closed-source systems, has high program overhead, increases system complexity and has high cost for developing defense measures.

[0006] The idea of ​​achieving the purpose of the present invention is: the present invention disassembles the code segment of the target binary file, identifies the vulnerable code segment, and then uses the binary plugging technology to insert defense instructions into the code segment vulnerable to Spectre v1 attack, thereby realizing defense against Spectre v1 attack. The present invention implements defense measures starting from the binary file, disassembles the target binary file to identify the vulnerable code segment and directly inserts instructions into the binary file through binary plugging. These methods can operate directly on the binary file without source code, solving the problem that the prior art requires source code and cannot be applied to commercial software and closed source systems. The present invention uses a method of inserting instructions at the vulnerable code of the target binary file to defend against Spectre v1 attacks. The inserted instructions are used to check the index after the jump branch to prevent the Spectre v1 attack from speculative execution, and the branch prediction unit will not be closed and the Dcache access delay will not be increased, solving the problem of high program overhead in the prior art. In addition, the present invention only modifies the target binary file at the software level, automatically identifies vulnerable code and inserts instructions, which is an automated method at the software level, independent of the system level, does not require software and hardware collaboration, does not require any modification to the system architecture, and does not increase the complexity of the system and the development cost of defense measures. This solves the problem that the existing technology requires modifications on the system, resulting in increased system complexity and high defense development costs.

[0007] The implementation steps of the present invention are:

[0008] Step 1, obtain the disassembly information of the target binary file;

[0009] Step 2: Analyze the disassembly information, identify the code snippets vulnerable to Spectre v1 attacks, and add the code snippets vulnerable to Spectre v1 attacks to the code snippet collection:

[0010] Step 3, determine whether the code snippet set is empty. If so, the target binary file does not contain code snippets that are vulnerable to Spectrev1 attacks; otherwise, execute step 4;

[0011] Step 4: construct defense instructions based on the code snippet vulnerable to Spectre v1 attack;

[0012] Step 5: Use binary instrumentation to insert defense instructions into the target binary file.

[0013] Compared with the prior art, the present invention has the following advantages:

[0014] First, the present invention adopts the method of disassembly and binary plugging, which can directly operate on the target binary file without the need for source code, and can be applied to commercial software and closed-source systems. Compared with the traditional method that requires defense from the source code, the problem that the traditional method requires source code and leads to limited application is overcome, so that the present invention has the advantage of being able to implement defense measures directly on the target binary file without being restricted by the source code.

[0015] Second, the present invention adopts the method of inserting instructions to defend against Spectre v1 attacks. By inserting instructions to check the index, the overhead caused by the inserted instructions is low. This overcomes the problem of the prior art that the branch prediction unit needs to be turned off, and the Dcache access delay increases, resulting in higher program overhead. This allows the present invention to still achieve defense against Spectre v1 attacks while having a low impact on program performance.

[0016] 3. Since the defense measures of the present invention are based on the software level and do not involve the system architecture and underlying hardware, the defense against Spectre v1 attacks can be completed without modifying the system design, the complexity of the system will not be increased, and the development cost of the defense measures is low. This overcomes the problems of increased system complexity and high development cost of the defense measures in the prior art, so that the present invention can achieve defense against Spectre v1 attacks without affecting the system and with low development costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0018] Combine the following Figure 1 The present invention is further described in detail with reference to two embodiments.

[0019] Embodiment 1:

[0020] Step 1: Get the disassembly information of the target binary file.

[0021] The disassembly tool used in the embodiment of the present invention is Capstone. The target binary file in the embodiment is an executable file under the ARMv8 architecture. The method in the Capstone framework is called by the Python language to disassemble the binary information in the executable file, obtain the disassembly information in the executable file, and obtain the assembly code from the obtained disassembly information.

[0022] Step 2: Analyze the disassembly information, identify the code snippets vulnerable to Spectre v1 attack, and add the code snippets vulnerable to Spectre v1 attack to the code snippet collection.

[0023] The embodiment of the present invention uses Python language to write a program to analyze the disassembly information, obtains a set of vulnerable code snippets through the following steps, and adds the code snippets vulnerable to Spectre v1 attack to the code snippet set.

[0024] The first step is to initialize an empty collection named vulnerable_code_segments to store code segments in executable files that are vulnerable to Spectre v1 attacks.

[0025] The second step is to select an unselected assembly instruction from the assembly code one by one.

[0026] The third step is to determine whether the selected instruction is a comparison instruction, that is, to determine whether the instruction format of the selected instruction conforms to the "CMP <reg> <reg>"(reg indicates the register operated by the instruction)" assembly code format, and its next instruction is a jump instruction, that is, to determine whether the next instruction format of the selected instruction conforms to "B{cond} <label>"(cond represents the jump condition code, label represents the jump destination) This format, if yes, it is considered that the selected instruction has a conditional branch and executes the fourth step, otherwise, executes the second step.

[0027] The fourth step is to traverse the two branches in the conditional branch and identify the load instructions in the branch, that is, the ones that meet the "LDR <reg>,[<reg_adr> ]" (reg indicates the target register of the instruction operation, reg_adr indicates the register storing the memory address) format. If there is a load instruction in one or both branches, the code fragment from the comparison instruction to the end of the branch is considered to be vulnerable to Spectre v1 attack. After adding this part of the code fragment to vulnerable_code_segments, execute the fifth step.

[0028] The fifth step is to determine whether all assembly instructions have been traversed. If so, execute the sixth step, otherwise, execute the second step.

[0029] Step 6: Get a set of vulnerable code snippets.

[0030] Step 3: Determine whether the code segment set vulnerable_code_segments is empty. If so, the executable file does not contain code segments vulnerable to Spectre v1 attacks; otherwise, proceed to step 4.

[0031] Step 4: Construct defense instructions based on the vulnerable code snippet.

[0032] The first step is to initialize a new collection defense_instructions, which is used to store information about defense instructions.

[0033] The second step is to select an unselected assembly code snippet from the defense_instructions set one by one.

[0034] The third step is to use the general registers X9 and X10 under the ARM architecture to construct register assignment instructions. Set all bits of the X10 register to 1, and the assembly instruction is "MOV X10, 0xFFFFFFFFFFFFFFFF", set all bits of the X9 register to 0, and the assembly instruction is "MOV X9, 0x0", and set the address inserted by the register assignment instruction "MOV X10, 0xFFFFFFFFFFFFFFFF, MOVX9, 0x0" to the previous instruction address of the comparison instruction.

[0035] The fourth step is to identify the conditional jump code {cond} of the jump instruction in the assembly code fragment.

[0036] Step 5: Construct a conditional selection instruction based on the jump condition code {cond}. The constructed conditional selection instructions are "CSEL X10, X10, X9, {~cond}" and "CSEL X10, X10, X9, {cond}". Set the address where the instruction "CSEL X10, X10, X9, {~cond}" (~cond indicates the condition code opposite to cond) is inserted to the jump instruction "B{cond} <label>"The address of the next instruction of "CSEL X10,X10,X9,{cond}" is set as the address of the next instruction of the jump destination "label".

[0037] Step 6: According to the load instruction "LDR <reg>,[<reg_adr> ]" constructs an index check instruction to load the register storing the memory address in the instruction<reg_adr> Perform AND operation with general register X10 and store the result in register<reg_adr> In the<reg_adr><reg_adr> <x10>", and the index check instruction "AND<reg_adr><reg_adr> <x10>The inserted address is set to the address of the instruction preceding the load instruction.

[0038] In the seventh step, register assignment instructions, conditional selection instructions, index check instructions and their insertion address information are added to the information set of storage defense instructions.

[0039] Step 5: Insert the defense instructions into the target binary file.

[0040] This embodiment uses a binary static instrumentation tool Retrowrite to insert instructions to be inserted into corresponding positions in the executable file according to instruction information in the defense_instructions set, thereby completing instrumentation of the target binary file. < / reg> < / label> < / reg> < / label> < / reg> < / reg>

Claims

1. A method for defending against Spectre v1 attacks using binary instrumentation, characterized in that: The disassembly and binary instrumentation method is used to directly operate on the target binary file and check the index by inserting instructions. The specific steps of this method include the following: Step 1, obtain the disassembly information of the target binary file; Step 2: Analyze the disassembly information, identify the code snippets vulnerable to Spectre v1 attacks, and add the code snippets vulnerable to Spectre v1 attacks to the code snippet collection; Step 3: Determine whether the code snippet set is empty. If so, the target binary file does not contain code snippets that are vulnerable to Spectre v1 attacks. Otherwise, go to step 4. Step 4: construct defense instructions based on the code snippet vulnerable to Spectre v1 attack; Step 5: Use binary instrumentation to insert defense instructions into the target binary file.

2. The method for defending against Spectre v1 attacks using binary instrumentation according to claim 1, characterized in that: Obtaining the disassembly information of the target binary file in step 1 refers to using a binary disassembly tool to disassemble the binary information in the target binary file and obtaining the assembly code from the obtained disassembly information.

3. The method for defending against Spectre v1 attacks using binary instrumentation according to claim 1, characterized in that: The steps to identify code snippets vulnerable to Spectre v1 described in step 2 are as follows: The first step is to initialize a collection of code snippets that are vulnerable to Spectre v1 attacks. The second step is to select an unselected assembly instruction from the assembly code in turn; The third step is to determine whether there is a conditional branch in the selected instruction. If so, execute the fourth step, otherwise, execute the second step; Step 4: traverse the two branches of the conditional branch and identify the load instructions in the branches, that is, the instructions used to load data from the memory to the register. If there are load instructions in one or both branches, the code snippet from the comparison instruction to the end of the branch is determined to be vulnerable to Spectre v1 attack. After adding this part of the code snippet to the code snippet set, execute step 5. Step 5: Determine whether all assembly instructions have been traversed. If so, execute step 6; otherwise, execute step 2. Step 6: Get a collection of code snippets that are vulnerable to Spectre v1 attacks.

4. The method for defending against Spectre v1 attacks using binary instrumentation according to claim 3, characterized in that: The conditional branch refers to an instruction that satisfies the following conditions at the same time: Condition 1, the selected instruction is a comparison instruction; Condition 2: The next instruction after the selected instruction is a jump instruction.

5. The method for defending against Spectre v1 attacks using binary instrumentation according to claim 1, characterized in that: The defense instructions in step 4 include register assignment instructions, conditional selection statements, and index check statements.

6. The method for defending against Spectre v1 attacks using binary instrumentation according to claim 1, characterized in that: The steps to construct defense instructions based on the vulnerable code snippet described in step 4 are as follows: The first step is to initialize an information set for storing defense instructions; The second step is to select an unselected assembly code snippet from the set of code snippets vulnerable to Spectre v1 attack. The third step is to select two general registers that are not used in the context, construct a register assignment instruction, set all bits of one register R1 to 1, set all bits of the other register R2 to 0, and set the address where the register assignment instruction is inserted to the address of the previous instruction of the comparison instruction; Step 4, identifying the jump condition code of the jump instruction in the assembly code fragment; Step 5: Construct two conditional selection instructions based on the jump condition code: For each of the two conditional selection instructions, the instruction's final selection result storage register is set to R1, the value source register when the condition is met is set to R1, and the value source register when the condition is not met is set to R2; For the first instruction of the two conditional selection instructions, set its condition code opposite to the jump condition code and insert it into the position of the next instruction of the jump instruction; For the second instruction of the two conditional selection instructions, set its condition code to be the same as the jump condition code and insert it into the position of the next instruction of the jump destination; Step 6: construct corresponding index check instructions based on the load instructions in the code snippet. Construct corresponding index check instructions for the load instructions in the two branches. That is, perform an AND operation on the register storing the memory address in the load instruction and the R1 register, and store the result in the register storing the memory address. Then set the address where the index check instruction is inserted to the instruction address before the load instruction. In the seventh step, register assignment instructions, conditional selection instructions, index check instructions and their insertion address information are added to the information set of storage defense instructions.

7. The method for defending against Spectre v1 attacks using binary instrumentation according to claim 1, characterized in that: The binary instrumentation method described in step 5 inserts the defense instruction into the target binary file, which means that the binary instrumentation tool is used to insert the instruction to be inserted into the corresponding position of the target binary file according to the instruction information in the information set storing the defense instruction, thereby completing the instrumentation of the target binary file.

Images