ARM (Advanced RISC Machines) CoreSight-based trusted SDN (Software Defined Network) software switch control flow integrity protection method

Abstract

The invention discloses a trusted SDN (Software Defined Network) software switch control flow integrity protection method based on ARM (Advanced RISC Machines) CoreSight. A current control flow integrity protection scheme needs to depend on customized hardware or a simulation instruction set, and has the defects of poor deployment compatibility or large performance overhead, and the method utilizes an ARM CoreSight component widely existing in an ARM architecture chip, realizes non-intrusive acquisition of control flow information of a program under the condition of not influencing program operation in a switch, and improves the safety of the switch. Therefore, the integrity of the program control flow is protected. The control function of the ARM CoreSight component is configured to a trusted secure world, so that program control flow information recorded by the CoreSight component is not tampered by programs in an untrusted common world, meanwhile, the recorded control flow information is analyzed in the secure world, a program control flow diagram is rebuilt, and the program control flow diagram is compared with an expected control flow diagram in static analysis, so that the control flow information of the CoreSight component is determined. Therefore, the control flow integrity of the protected program in the software switch is ensured.

Description

Technical Field

[0001] The present invention specifically relates to a trusted SDN software switch control flow integrity protection method based on ARM CoreSight, belonging to the technical field of switch control. Background Art

[0002] In recent years, SDN (Software-defined Networking) software switches have been deployed on a large scale in cloud computing, data center networks, and other fields due to their flexible deployment capabilities of network resources. At the same time, their security has also received increasing attention. Attackers can construct malicious messages to hijack the control flow of software switches and achieve attack goals such as occupying computing nodes, causing huge security risks.

[0003] The current control flow integrity protection schemes mainly include hardware protection (HCFI architecture) and virtual instruction sets (KCoFI system). HCFI is based on the integrity protection extension provided by a specific hardware instruction set. In actual software switch applications, it lacks corresponding hardware support and is difficult to be widely used. KCoFI protects programs by simulating a virtual instruction set with control flow integrity extension on the existing system. The virtual instruction set is simulated by the program, and the performance overhead is very large. If it is applied in a software switch, it will cause a large transmission delay. Therefore, it is necessary to design an efficient and practical control flow integrity protection method for software switches.

[0004] ARM CoreSight is an embedded system monitoring and debugging tool integrated in the ARM IP core (Intellectual Property Core), which is widely present in ARM architecture chips. Currently, ARM CoreSight is mostly used for development and debugging, and can provide program tracking data, hardware-level breakpoints, memory access and other functions in a non-invasive manner, so that developers can analyze the running status of the program through these data. In order to achieve a highly compatible and deployable protection solution for the control flow of a trusted SDN software switch, and not to generate excessive additional overhead for the operation of the program, the present invention designs and discloses a trusted SDN software switch control flow integrity protection method based on ARMCoreSight, which realizes non-invasive protection of the trusted SDN software switch control flow and ensures the security of the running status of its trusted SDN software switch program. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to solve the deficiencies in the prior art and provide a trusted SDN software switch control flow integrity protection method based on ARMCoreSight to protect the trusted SDN software switch program control flow in the switch from being hijacked, avoid malicious use of the switch after being attacked, and ensure the security of the switch and its data.

[0006] The present invention discloses an ARM CoreSight-based SDN software switch control flow integrity protection method, which comprises the following steps in sequence:

[0007] (1) Code static analysis:

[0008] During the compilation of the trusted SDN software switch code, static analysis is performed on the intermediate instructions generated by the program compilation to create a legal pointer set for each indirect function call in the code. The legal pointer set is saved in the secure world of the trusted SDN software switch, isolated from the ordinary world, to ensure the integrity of the legal pointer set.

[0009] (2) Compile-time code instrumentation:

[0010] When compiling the trusted SDN software switch program, the function call and return position are inserted, and the recording instructions of the STM component in ARM CoreSight are inserted, so that the software switch program can report the function call stack information to the STM component in real time when it is running. The STM component is allocated to the secure world and isolated from the ordinary world to ensure the integrity of the recorded function call stack information.

[0011] (3) Runtime forward control flow integrity check:

[0012] During the normal operation of the trusted SDN software switch, the ETM component in ARM CoreSight is allocated to the secure world, and the message recording the jump information during operation is obtained from the ETM component to reconstruct the control flow of the software switch program. It is determined whether the relative jump in the control flow conforms to the legal pointing set generated in step (1). If it does not conform, the program is stopped in time to ensure the integrity of the program's forward control flow.

[0013] (4) Runtime backward control flow integrity check:

[0014] During the normal operation of the switch, the shadow function call stack is constructed through the STM component message generated by the plug-in in (2). When the trusted SDN software switch program function returns, the return address is checked to see if it is consistent with the shadow function call stack record. If there is any inconsistency, the program is stopped in time to ensure the backward integrity of the control flow.

[0015] Furthermore, in step (1), the control flow integrity protection method of the SDN software switch based on ARM CoreSight is characterized in that: in step (1), the trusted SDN software switch program is compiled using the LLVM compiler, LLVMIR is obtained as a unified intermediate language, LLVM IR is statically analyzed using the MLTA technology, and the corresponding legal pointer set is calculated for each indirect function call in the program source code. The legal instruction set is recorded in the secure world memory of the trusted SDN software switch, and TZASC is used to ensure that the secure world memory cannot be accessed by programs in the ordinary world.

[0016] Furthermore, in step (2), the LLVM compiler is used to automatically implement code instrumentation. The function prologue and epilogue are inserted at the backend stage where LLVM converts IR into the corresponding machine code. By configuring the backend Pass to customize the function prologue and epilogue, the STM component report instruction fragment is inserted at the function call and return positions of the trusted SDN software switch program code, respectively, to record the function expected return address and function return event, respectively.

[0017] Furthermore, in step (3), the target address of the indirect jump is obtained from the ATOM event issued by the ETM component when the trusted SDN software switch is running, and the target address of the direct jump is obtained in combination with the ETM jump broadcast function. By introducing the concept of absolute basic blocks and combining the code to generate basic blocks to infer the state machine, the occurrence address of the indirect jump is inferred from the target address in the ATOM event and the ETM jump broadcast, and the occurrence address of the indirect jump and the target address are checked to see if they meet the legal pointing set in step (1) to ensure the forward control flow integrity of the program.

[0018] Furthermore, in step (4), the STM message is generated by the STM component report instruction fragment inserted in step (2) when the trusted SDN software switch is running, and the STM message is saved in the secure world of the trusted SDN software switch. A shadow function call stack is maintained in the secure world through the STM message. When the function returns, it is checked whether it conforms to the return address in the shadow function call stack to ensure (1) code static analysis:

[0019] During the compilation of the software switch code, static analysis is performed on the intermediate instructions generated by the program compilation to create a legal pointer set for each indirect function call in the code. The legal pointer set is saved in the secure world of the trusted SDN software switch, isolated from the ordinary world, to ensure the integrity of the legal pointer set.

[0020] An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the program, the control flow integrity protection method of a trusted SDN software switch based on ARM CoreSight is implemented.

[0021] A computer-readable storage medium stores computer instructions, which, when executed by a processor, implement the control flow integrity protection method of a trusted SDN software switch based on ARM CoreSight.

[0022] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0023] (1) The present invention is based on the implementation of components in ARM CoreSight. CoreSight components are widely present in ARM architecture chips, are easy to deploy and have strong compatibility, and are applicable to many switch platforms. Compared with solutions such as customized hardware and simulated instruction sets, the present invention has the advantages of strong practicality, easy deployment and low performance overhead.

[0024] (2) The design of the present invention utilizes the ETM component in ARM CoreSight to non-invasively obtain the control flow information of the trusted SDN software switch. The inserted code logic is simple and does not require privilege level switching when ensuring the integrity of the backward control flow. It has the advantages of very little additional overhead and does not affect the program running efficiency.

[0025] (3) The present invention uses ARM CoreSight to achieve comprehensive monitoring of the control flow of the trusted SDN software switch control program, effectively preventing the program control flow from being hijacked by attackers. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a TypeDive analysis flow chart in the embodiment;

[0027] Figure 2 It is a schematic diagram of an absolute basic block in the embodiment;

[0028] Figure 3 It is a schematic diagram of the protection instance architecture in the embodiment. DETAILED DESCRIPTION

[0029] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0030] A program control flow integrity protection method based on ARM CoreSight of the present invention comprises the following steps in sequence:

[0031] (1) Code static analysis:

[0032] During the compilation of the software switch code, static analysis is performed on the intermediate instructions generated by the program compilation to create a legal pointer set for each indirect function call in the code. The legal pointer set is saved in the secure world of the trusted SDN software switch, isolated from the ordinary world, to ensure the integrity of the legal pointer set.

[0033] (2) Compile-time code instrumentation:

[0034] When compiling a trusted SDN software switch, the function call and return positions are instrumented, and the recording instructions of the STM component in ARM CoreSight are inserted, so that the software switch program can report the function call stack information to the STM component in real time when it is running. The STM component is allocated to the secure world and isolated from the ordinary world to ensure the integrity of the recorded function call stack information.

[0035] (3) Runtime forward control flow integrity check:

[0036] During the normal operation of the trusted SDN software switch, the ETM component in ARM CoreSight is allocated to the secure world, and the message recording the jump information during operation is obtained from the ETM component to reconstruct the control flow of the software switch program. It is determined whether the relative jump in the control flow conforms to the legal pointing set generated in step (1). If it does not conform, the program is stopped in time to ensure the integrity of the program's forward control flow.

[0037] (4) Runtime backward control flow integrity check:

[0038] During the normal operation of the switch, the shadow function call stack is constructed through the STM component message generated by the plug-in in (2). When the trusted SDN software switch program function returns, the return address is checked to see if it is consistent with the shadow function call stack record. If there is any inconsistency, the program is stopped in time to ensure the backward integrity of the control flow.

[0039] Embodiment 1:

[0040] The ARM CoreSight-based trusted SDN software switch control flow integrity protection method in this implementation includes the following steps:

[0041] 1. Program static analysis:

[0042] In order to obtain the legal pointing set of the control flow of the trusted SDN software switch program, the present invention uses the indirect call analysis tool TypeDive to complete the static analysis of the program. TypeDive is built based on the MLTA (Multi-layer Type Analysis) technology, and the design of this technology comes from the following observation: function pointers are always stored in objects with multi-layer types, and before each indirect function call, function pointers are loaded layer by layer from objects with the same multi-layer type. By matching the function pointer with the multi-layer type of the function, the target of the indirect call can be effectively refined for the C / C++ program.

[0043] like Figure 1As shown in Figure 1, TypeDive receives the intermediate representation (IR) of the program in the form of bytecode as input and outputs the target of each indirect call. TypeDive consists of two main stages: ① type analysis stage; ② target parsing stage. Among them, ① type analysis stage will completely scan the entire IR and collect type-related information. TypeDive first collects all address-taken functions and identifies all address-taking operations, such as static initialization or storage instructions of global variables. Subsequently, the address-taking operations are analyzed to identify the multi-layer type of the memory object. For example, for bainit=dpif_init(), the multi-layer type of the memory object is bafptr_t (fptr_t is the function pointer type of init), and the multi-layer type will be further divided into multiple double-layer types, such as fptr_r (first layer), A.fptr_r (second layer), BA (third layer), which is used to achieve target propagation. TypeDive adds type information to the type-function confinement map, where the key is a hash of the double-level type and the value is a set of related functions. Next, TypeDive tries to build a propagation relationship between types, such as *p=a, and adds the type relationship of the two operands to the type-propagation map. The key of the type propagation map is the type of the value object a, and the value is the type of the pointer object p. The last module of the first phase is to collect potential type escapes and add them to the escaped-type set. If all indirect call targets constrained by a type cannot be determined, the type will be considered an escape. For example, when a primitive type is converted to a composite type, the target of the composite type also becomes undeterminable. In this case, the composite type will be considered an escape; based on the information collected in phase ①, TypeDive resolves the jump target for each indirect call in phase ②. For each indirect call input, TypeDive first identifies the multi-layer types of the corresponding function pointer and disassembles it into multiple double-layer types. It then uses the first-layer type matching to initialize the target set, and then iterates layer by layer to refine its jump target set. In each layer of iteration, TypeDive will find all types that have a propagation relationship with the current type, merge the target sets of these types with the current target set, and intersect the current target set with the target set of the previous layer. Until each layer of iteration is completed, or a type escape is encountered, the final target set of the current indirect call can be returned.

[0044] 2. Code instrumentation during program compilation

[0045] Since the ETM's tracing information only records the trusted SDN software switch program jump behavior and the corresponding jump target address, this leads to the following problems: ① ETM cannot directly obtain the expected return address of the function when calling the function; ② It is difficult to distinguish function return events from other jump events from the ETM's tracing information. The present invention introduces the STM plug-in tracing capability and combines the ETM's control flow tracing capability to complete the construction of the shadow stack mechanism for use in protecting the program's backward control flow integrity at runtime.

[0046] For problem ①, the STM instrumentation tracking capability can be used to insert a code snippet to record the expected return address of the function when the function is called. For problem ②, this paper inserts a springboard function T into the trusted SDN software switch program, and replaces all function return instructions ret with absolute jumps to T through the compiler. Therefore, the springboard function T provides a single function return point for the program, that is, all function returns when the program is running must be completed through T, and the address of T will be tracked by the ETM component as the jump target address. By capturing the jump to T in the parsed ETM control flow tracking information, the subsequent jump event can be identified as an ETM function return event.

[0047] This article uses the LLVM compiler to automatically implement code instrumentation. LLVM compilation includes the following stages: front-end, optimization, back-end, and assembly. The front-end converts the source code into IR, the back-end converts IR into the corresponding machine code, and the final assembly stage converts the machine code into binary instructions for the target machine. In the back-end stage, LLVM completes the insertion of the function prologue and epilogue. Therefore, this article implements code instrumentation by writing a back-end Pass to complete the acquisition of function call information.

[0048] 3. Runtime forward control flow integrity check

[0049] The present invention uses the ETM component in the ARM CoreSight program tracking framework to obtain the control flow information when the trusted SDN switch is running normally. ETM obtains the jump information of the program by monitoring the processor instruction bus, so it will not introduce additional performance overhead for the operation of the program. However, due to the extremely streamlined design of the ETM protocol, it brings many challenges to the inference of basic blocks: ① The jump behavior of the program control flow is recorded as a 1-bit ATOM E / N event, and several consecutive ATOM events will be compressed into an ATOM message, and the ATOM message needs to be decompressed. ② By default, ETM only outputs the jump target address of the indirect jump, and the jump target address of the direct jump will be ignored, so that the entire control flow of the program cannot be tracked using ETM. ③ For any jump, the information of the jump address is not output, so the context when the jump occurs cannot be inferred. Among them, by enabling the ETM branch broadcasting function, ETM can track the direct jump target address in ②. Although the ETM protocol assumes that the trace analyzer (hereinafter referred to as the user of the trace information for ease of understanding) has complete program image information, the user infers the basic block where the trace starts based on the address of the trace starting point, thereby maintaining the control flow state of the program. In addition, the complete control flow graph of a large application is too large to be fully input for CFI detection. Therefore, the present invention designs a method for inferring program basic blocks through local ETM trace information, combined with the jump events and jump target addresses recorded in the ATOM message, so that the location where the jump occurs and the actual jump target address can be inferred based on the ETM trace information without monitoring the complete image.

[0050] By introducing the concept of Absolute Basic Block (AN), users of the ETM tracing protocol can determine the basic block in which the current program is located through local ETM tracing information, and then infer the call site of the indirect jump and the actual jump target address. The difference between an absolute basic block and a basic block is: ① The last instruction can only be an unconditional jump instruction; ② The block can contain several conditional jump instructions. It is easy to see that the absolute basic block has the following characteristics: ① An absolute basic block can only be entered by jumping. ② An absolute basic block consists of at least one basic block. ③ An absolute basic block that does not contain conditional jump instructions is no different from a single basic block. Based on characteristic ①, the current absolute basic block can be uniquely determined by the jump target address alone when the program is running. Based on characteristic ②, when the absolute basic block is determined, the basic block in which the current program is located can be determined through a limited number of control flow change information. For example Figure 2As shown in the figure, the code sequence is divided into two absolute basic blocks AN1 and AN2. According to the number of basic blocks, the absolute basic blocks can be divided into first-order absolute basic blocks, second-order absolute basic blocks, etc., where AN2 is a third-order basic block containing basic blocks N1, N2 and N3, and ends with an indirect jump instruction BLR. When the processor jumps into AN2 for execution, it may enter any of the three basic blocks. At this time, the basic block entered can be determined by the target address of the jump.

[0051] After the basic block is determined, this method can be used for runtime forward CFI detection to identify indirect function call events and call point location information from the control flow information traced by ETM, and compare them with the legal pointing set of the indirect function to ensure the forward control flow integrity of the trusted SDN switch program.

[0052] 4. Runtime Backward Control Flow Integrity Check

[0053] The runtime backward control flow integrity check uses the STM component and the ETM component in combination. Since the data generation methods of the STM component and the ETM component are different, there is a problem of asynchrony between the STM and ETM data streams. The present invention writes a FLAG message to the STM before the function returns to indicate that a function return event has occurred in the trusted SDN software switch program. When the system is running, the ETM and STM each generate a tracking data message. Even if there is a time difference between the two, the timelines of the recorded function return events are consistent with the actual function return order. Therefore, the function return event recorded by the ETM side through the springboard function T and the function return event recorded by the STM side can be associated in the order in which the records are generated, thereby restoring the function return information.

[0054] The backward control flow integrity check includes six submodules, namely, the STM data inversion module, the ETM return address filtering module, the STM data stack, the STM return address queue, the ETM return address queue, and the backward CFI detector. Among them, the STM data inversion module is used to adjust the function call information output by the STM, and the adjusted call information will be stored in the STM data stack. The ETM return address filtering module will identify the springboard function address in the function call information on the ETM side, and filter out the subsequent jump address as the actual return address of the function (ETM_RET_ADDR) and store it in the ETM return address queue. The STM return address queue is used to store the expected return address of the function (STM_RET_ADDR) popped from the STM data stack. The detection module is responsible for detecting the backward CFI of the program.

[0055] When the trusted SDN software switch program is running, ① the expected return address of the function recorded by STM will be pushed into the STM data stack first, and the actual return address of the function tracked by ETM will be stored in the ETM return address queue. ② If STM receives a function return event (RET_FLAG), it will trigger the pop operation of the STM data stack and store the expected return address at the top of the stack into the STM return address queue. ③ Finally, the backward CFI detection module will read the STM and ETM return address queues at the same time and compare the values ​​of the two return addresses. If they do not match, it means that a backward CFI exception has occurred.

[0056] 5. Example of Program Control Flow Integrity Protection

[0057] The present invention uses an example to illustrate how to use the ARM CoreSight-based trusted SDN software switch control flow integrity protection method. The example uses the Open vSwitch (OvS) program as the protection object and simulates the method to protect the ARM architecture software switch running OvS. The overall architecture is as follows: Figure 3 shown.

[0058] Step 1: Use the LLVM compilation component to compile the OvS source code to obtain LLVM IR.

[0059] Step 2: Generate the legal OvS indirect call pointer set based on LLVM IR through TypeDive, and save the legal pointer set to the secure world.

[0060] Step 3: Use the LLVM compiler component to compile LLVM IR into an executable file, configure the backend Pass to customize the function preface and epilogue, and insert STM-related code snippets.

[0061] Step 4: Start the protected program and start the monitoring protection program in the secure world.

[0062] Step 5: Allocate the ARM CoreSight component to the secure world and obtain the message that records the jump information during runtime.

[0063] Step 6: The forward control flow integrity protection module identifies the location and target address of the relative jump from the message, detects whether the relative jump in the control flow conforms to the legal pointing set, and ensures the integrity of the forward control flow.

[0064] Step 7: The backward control flow integrity protection module builds a shadow stack based on the STM message and the ETM message, and checks whether the return address matches the shadow stack when the function returns, to ensure the backward control flow integrity.

[0065] It should be noted that the above embodiments are not intended to limit the protection scope of the present invention, and equivalent changes or substitutions made on the basis of the above technical solutions all fall within the protection scope of the claims of the present invention.

Claims

1. A trusted SDN software switch control flow integrity protection method based on ARM CoreSight, characterized by: The method comprises the following steps in sequence: (1) Code static analysis: During the compilation of the trusted SDN software switch code, static analysis is performed on the intermediate instructions generated by the program compilation to create a legal pointer set for each indirect function call in the code. The legal pointer set is saved in the secure world of the trusted SDN software switch and isolated from the ordinary world to ensure the integrity of the legal pointer set. (2) Compile-time code instrumentation: When compiling the trusted SDN software switch program, the function call and return position are inserted, and the recording instructions of the STM component in ARM CoreSight are inserted, so that the software switch program can report the function call stack information to the STM component in real time when running. The STM component is allocated to the secure world and isolated from the ordinary world to ensure the integrity of the recorded function call stack information. (3) Runtime forward control flow integrity check: During the normal operation of the trusted SDN software switch, the ETM component in ARM CoreSight is allocated to the secure world, and the message recording the jump information during operation is obtained from the ETM component to reconstruct the control flow of the software switch program. It is determined whether the relative jump in the control flow conforms to the legal pointing set generated in step (1). If it does not conform, the program is stopped in time to ensure the integrity of the program's forward control flow. (4) Runtime backward control flow integrity check: During the normal operation of the switch, the shadow function call stack is constructed through the STM component message generated by the plug-in in (2). When the trusted SDN software switch program function returns, the return address is checked to see if it is consistent with the shadow function call stack record. If there is any inconsistency, the program is stopped in time to ensure the backward integrity of the control flow.

2. According to claim 1, the control flow integrity protection method of the trusted SDN software switch based on ARM CoreSight is characterized in that: In step (1), the trusted SDN software switch program is compiled using the LLVM compiler to obtain LLVMIR as a unified intermediate language. The LLVM IR is statically analyzed using the MLTA technology to calculate the corresponding legal pointer set for each indirect function call in the trusted SDN software switch program source code. The legal instruction set is recorded in the secure world memory of the trusted SDN software switch, and TZASC is used to ensure that the secure world memory cannot be accessed by programs in the ordinary world.

3. The method for protecting control flow integrity of a trusted SDN software switch based on ARM CoreSight according to claim 1, characterized in that: In step (2), the LLVM compiler is used to automatically implement code instrumentation. The function prologue and epilogue are inserted in the backend stage when LLVM converts IR into the corresponding machine code. By configuring the backend Pass to customize the function prologue and epilogue, the STM component report instruction fragment is inserted into the function call and return positions of the trusted SDN software switch program code, respectively, to record the function expected return address and function return event, respectively.

4. The method for protecting control flow integrity of a trusted SDN software switch based on ARM CoreSight according to claim 1, characterized in that: In step (3), the target address of the indirect jump is obtained from the ATOM event issued by the ETM component when the trusted SDN software switch is running, and the target address of the direct jump is obtained in combination with the ETM jump broadcast function. By introducing the concept of absolute basic blocks and combining the code to generate basic blocks to infer the state machine, the occurrence address of the indirect jump is inferred from the target address in the ATOM event and the ETM jump broadcast, and the occurrence address of the indirect jump and the target address are checked to see if they conform to the legal pointing set in step (1) to ensure the forward control flow integrity of the program.

5. The method for protecting control flow integrity of a trusted SDN software switch based on ARM CoreSight according to claim 1, characterized in that: In step (4), the STM message generated by the STM component report instruction fragment inserted in step (2) when the trusted SDN software switch is running is obtained, and the STM message is saved in the secure world of the trusted SDN software switch. A shadow function call stack is maintained in the secure world through the STM message. When the function returns, it is checked whether it matches the return address in the shadow function call stack, thereby ensuring the backward control flow integrity of the trusted SDN software switch program.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the control flow integrity protection method of a trusted SDN software switch based on ARM CoreSight as described in any one of claims 1 to 5 is implemented.

7. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instruction is executed by the processor, the control flow integrity protection method of the trusted SDN software switch based on ARM CoreSight as described in any one of claims 1 to 5 is implemented.

Images