Overflow attack defense method and system based on stack randomization

Abstract

The present invention belongs to the technical field of computer security, and particularly relates to an overflow attack defense method and system based on stack randomization, comprising: a random seed generator generates a random seed according to a control parameter provided by a service routine; a random number generator generates a random number for representing the relative distance between a return address and a data overflow point according to the random seed; a data segment length for randomly and dynamically inserting a return address is determined according to the random number, and the data segment with the length determined by the random number is inserted into the return address and an embedded component content with randomized return address processing is generated; the embedded component content is recompiled by a compiler to generate a program with the same function and an increased security mechanism, wherein the return address randomization processing is used in the security mechanism to make the position of the return address in the stack randomly uncertain when a program function call occurs, thereby increasing the difficulty of stack buffer overflow attacks, avoiding the work of return address integrity detection, and improving the overall efficiency of return address protection.

Description

Technical Field

[0001] The invention belongs to the technical field of computer security, and in particular relates to an overflow attack defense method and system based on stack randomization. Background Art

[0002] The stack buffer overflow attack is to overwrite the return address by continuously writing data into the stack, thereby changing the software control flow. The key to the success of the stack buffer overflow attack is that the attacker can accurately determine the location of the return address. In real attack scenarios, once the attacker finds that the software has a stack buffer overflow attack vulnerability, he can often determine the location of the return address through a limited number of tests. For stack buffer overflow attacks, the most classic defense method is StackGuard. Simply put, StackGuard inserts a flag word into the stack as a "sentinel". When the attacker tampers with the return address by continuously injecting illegal addresses, the "sentinel" will be overwritten. In this way, when the program returns from the sub-function, it will first check whether the "sentinel" is normal. If the "sentinel" is overwritten, it means that an attack has occurred. In order to prevent the "sentinel" from being guessed by the attacker, it is also necessary to process the "sentinel". The typical method is randomization. Since the illegally input data is usually a string, the "sentinel" can also contain the string end character so that it cannot overwrite the "sentinel". StackShield uses a backup method to protect the return address in the stack, that is, the "shadow stack". When a function is called, its return address is written to the shadow stack, and then the function body is executed: when the function is about to return, the return address of the stack item is compared with the return address in the shadow stack. If the two addresses are exactly the same, then it can return normally, otherwise the program will stop executing. Of course, when the function is about to return, the return address in the shadow stack can also be directly copied to the runtime stack item as the function return address. For the traditional shadow stack implementation, the multiple value copies between memory and registers seriously affect its performance, so that defenders cannot find a balance between defense effectiveness and performance overhead.

[0003] Existing methods for defending against stack buffer overflow attacks often have the possibility of being bypassed, and the integrity check causes a large performance overhead. From the perspective of the attack principle, the stack buffer overflow attack uses the fixed relative distance between unsafe variables such as arrays and the return address, and the return address can be accurately overwritten through repeated testing. Several existing works are implemented around how to detect the integrity of the return address, and have not fundamentally broken the above rule, which makes these works often unable to truly solve the stack buffer overflow attack or have a large cost. For example, the sentinel strategy: after the attacker accurately knows the location of the return address, he can skip the sentinel and overwrite the return address, so that the attack can be carried out under the premise of ensuring the integrity of the sentinel. For example, the shadow stack strategy: some shadow stacks still have a certain address mapping relationship with the return address, so the attacker can continue to overwrite the return address in the shadow stack after overwriting the return address. At the same time, due to the shadow stack and the detection overhead, the shadow stack will cause a certain performance loss to the software operation. The above method performs necessary checks and protections around the return address, but does not process the return address itself. Summary of the invention

[0004] To this end, the present invention provides an overflow attack defense method and system based on stack randomization, which dynamically inserts data fragments with randomly changing lengths to change the relative distance between the return address in the stack and the starting point of the attacker's overflow (i.e., a variable, such as a character array), and uses a space-for-time strategy to increase the size of the storage space in the stack, thereby achieving the purpose of reducing the time overhead of return address integrity detection, etc., making the stack buffer overflow attack more difficult, avoiding tedious work such as return address integrity detection through a certain amount of storage space waste, and improving the overall efficiency of return address protection.

[0005] According to the design scheme provided by the present invention, a stack randomization-based overflow attack defense method includes the following contents:

[0006] The random seed generator generates a random seed according to the control parameters provided by the service routine; the random number generator generates a random number for representing the length of the data segment filled between the return address and the data overflow point (a local variable that an attacker may exploit) according to the random seed;

[0007] Determine the length of the data segment used for random dynamic insertion into the return address according to the random number, insert the data segment with the length determined by the random number into the return address and generate embedded component content of the randomized return address;

[0008] The embedded component content is recompiled by a compiler to generate a program with the same function but with the security mechanism of the present invention added, so that the position of the return address in the stack is randomized and uncertain when a program function call occurs.

[0009] As the overflow attack defense method based on stack randomization of the present invention, further, the random seed generator generates a random seed by collecting internal data of the processor; the random number generator uses the random seed as the encryption algorithm plaintext, key and initial vector, encrypts the plaintext to generate ciphertext, and uses the ciphertext as a random number for representing the relative distance between the return address and the data overflow point.

[0010] As the overflow attack defense method based on stack randomization of the present invention, further, the random seed generator uses the processor performance monitoring counter to obtain the number of times a preset type of event occurs inside the processor at the current time to generate a random seed.

[0011] As the overflow attack defense method based on stack randomization of the present invention, further, the random seed generator collects the number of times each type of event occurs at the current time as output data, and uses the lowest two bits of the output data as random seed components.

[0012] As the overflow attack defense method based on stack randomization of the present invention, further, a random number buffer pool with a ring structure is used to cache the random number generated by the random number generator for determining the length of the inserted data segment. The ring structure of the random number buffer pool has a head pointer for taking random numbers from the random number buffer pool and a tail pointer for the random number generator to write random numbers to the random number buffer pool.

[0013] As the overflow attack defense method based on stack randomization of the present invention, further, a locking mechanism is used to perform concurrent control on concurrent access of multiple threads in the random number buffer pool, and the amount of data in the random number buffer pool is periodically detected, and the random number buffer pool is subjected to empty overflow detection and wake-up thread according to the preset random number buffer pool size, overflow threshold and empty threshold. In the locking mechanism, when any thread accesses the random number buffer pool head pointer, it first applies for a lock to the random number buffer pool, obtains the random number after the application is successful, and moves the head pointer backward and releases the lock.

[0014] As the overflow attack defense method based on stack randomization of the present invention, further, a random number is used as a random factor for the length of the data segment, and the function call filling data length factor = the actual length of the function call filling data segment ⊕ the length random factor is used to insert the data segment between the function call destination address and the return address.

[0015] As the overflow attack defense method based on stack randomization of the present invention, further, in the return address push operation, the return address is pushed onto the stack using a push instruction, and data fragments of random number lengths are continuously written into the stack, and a jmp instruction is used to jump to the destination address of the function call.

[0016] Furthermore, the present invention also provides an overflow attack defense system based on stack randomization, comprising: a random number generation module, a random number embedding module and a process compilation module, wherein:

[0017] A random number generation module is used for the random seed generator to generate a random seed according to the control parameters provided by the service routine; the random number generator generates a random number for representing the relative distance between the return address and the data overflow point according to the random seed;

[0018] A random number embedding module, used to determine the length of a data segment for random dynamic insertion into a return address according to a random number, insert the data segment with the length determined by the random number into the return address and generate embedded component content for randomized return address processing;

[0019] The process compiling module is used to recompile the embedded component content through a compiler to generate a program with the same function but with the security mechanism of the present invention added, so that the position of the return address in the stack is random and uncertain when a program function call occurs.

[0020] The stack randomization-based overflow attack defense system of the present invention further comprises: a user control interface module shared by multiple softwares, which is used to set control parameters and related threshold data through user input.

[0021] Beneficial effects of the present invention:

[0022] The present invention defends against the necessary conditions for the generation of stack buffer overflow attacks (i.e., the position between the data overflow point and the return address is fixed). By changing the relative distance between the data overflow point and the return address in each function call, the attacker has only a 1 / n probability of success each time he attempts to attack (n is the maximum randomization threshold), thereby increasing the difficulty of stack buffer overflow attacks. The present invention can also be complementary to some other existing defense methods. Due to the different entry points, there is no repeated intersection of defense means. Defense methods such as sentinels and shadow stacks can be combined with the present invention to achieve common defense against stack buffer overflow attacks, which is convenient for application in actual scenarios and has good application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a schematic diagram of the overflow attack defense method based on stack randomization in the embodiment;

[0024] Figure 2 This is a schematic diagram of the stack buffer overflow attack defense principle in the embodiment;

[0025] Figure 3 It is a schematic diagram of the overall overview of the scheme in the embodiment;

[0026] Figure 4 This is a schematic diagram of the system architecture of the solution in the embodiment;

[0027] Figure 5 This is a schematic diagram of an internal random number generator in the embodiment;

[0028] Figure 6 This is a schematic diagram of the random seed generator workflow in the embodiment;

[0029] Figure 7 This is a schematic diagram of the organization and access principle of the random number buffer pool in the embodiment;

[0030] Figure 8 This is a pseudo code diagram for replacing the call instruction in the embodiment;

[0031] Fig. 9 This is a pseudocode representation of the ret instruction replacement in the real-time example. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0033] A stack buffer overflow attack is a method of continuously writing data into the stack to overwrite the return address, thereby changing the software control flow. The key to a successful stack buffer overflow attack is that the attacker can accurately determine the location of the return address. In a real attack scenario, once an attacker finds that the software has a stack buffer overflow vulnerability, he can often determine the location of the return address through a limited number of tests. The present invention provides a stack randomization-based overflow attack defense method, see Figure 1 As shown, it contains the following contents:

[0034] S101, a random seed generator generates a random seed according to a control parameter provided by a service routine; a random number generator generates a random number for representing a relative distance between a return address and a data overflow point according to the random seed;

[0035] S102, determining the length of a data segment for randomly and dynamically inserting into a return address according to a random number, inserting the data segment with the length determined by the random number into the return address, and generating embedded component content of the randomized return address;

[0036] S103, recompiling the embedded component content through a compiler to generate a program with the same function but with the added security mechanism of the present invention, so that the position of the return address in the stack is randomized and uncertain when a program function call occurs.

[0037] The relative distance between the return address and the data overflow point is randomized using random numbers, so that the position of the return address in the stack is not fixed and changes during each function call, making it impossible for attackers to determine the return address position (even if the attacker successfully overflows in a certain test, the attack will most likely fail because the return address position changes every time the function is called).

[0038] See also Figure 2 As shown in (a) and (b), the stack buffer overflow attack can be based on a variable in the current stack (such as a character array), and the attacker continues to write data, resulting in the return address being overwritten. Once the function returns, the overwritten address (which may be the address leading to the malicious code) will be executed, causing the software control flow to be illegally transferred. In the embodiment of this case, the relative position of the return address and the data overflow point is changed, and a random number stream of varying length is randomly filled between the return address and the data overflow point. In addition, in order to increase the difficulty of the attacker, the length of the random number stream filled in each function call can change, so that the relative distance of the attacker covering the return address from the data overflow point is always in a changing state, and it is difficult for the attacker to achieve the purpose of a successful attack through exhaustive enumeration. For example, the original relative distance between the variable and the return address is 18 bytes, so the attacker can start writing the malicious address after continuously covering 18 bytes. After adopting the solution strategy in the embodiment of this case, the length of the randomly filled data is 10 during a certain function call, so the attacker obviously cannot successfully attack by covering it in the manner of 18 bytes. Of course, the attacker can try further, hoping to find that the current relative distance is 28 bytes. However, the present invention requires that the length of the data filled in each time the function is called will change. In the next attack scenario, the length may have become 16, and the attacker still cannot succeed. In this way, the attacker's attack attempt may be reset to zero in each function call.

[0039] Assume that the attacker cannot directly peek at the software runtime data. Specifically, the attacker can obtain a copy of the software and analyze the software code and internal data, but cannot directly peek at the internal data held by the software when it is running. In a more vivid way, the attacker can know in advance the copy of a certain software and know that it will run on a certain host, but the attacker cannot know the runtime data generated by the software when it runs on the host. This assumption is reasonable: it is relatively easy to obtain a copy of the software, but it is more difficult to obtain the data when the software is running. If the attacker does not gain control of the operating system, it is often impossible to know the status data of the software when it is running. The stack buffer overflow attack itself is an opportunity for the attacker to gain control of the operating system. Therefore, it is reasonable to assume that the status data of the software when it is running is difficult for the attacker to obtain.

[0040] In this embodiment, see Figure 3 As shown, a new system service routine can be added to the operating system. The service is responsible for providing a number of control parameters for the process, and these parameters are valid for all processes in the entire operating system. Several embedded components are implanted in all processes, and these components will complete the specific operation of randomizing the return address. The system service will be developed in accordance with the traditional software development method, and the embedded components of the process will be implanted into the software through recompilation. gcc compiler: an open source compiler that supports compilation of multiple languages ​​​​such as C and Java. Since the gcc compiler is open source, the internal source code can be modified to change the compilation process, thereby achieving a specific compilation purpose, for example: inserting a specified code snippet in a certain type of position in the software. With respect to the gcc compiler, other compilers also have similar processes, which are not required in the implementation scheme of this case. Based on the gcc compiler, executable instructions that meet the requirements can be generated by recompilation under the premise of open source code.

[0041] The system architecture can be Figure 4 As shown, each operating system has a service routine as an interactive interface with the user, which specifically receives the user's control parameters. The user can set unified control parameters for the entire operating system, or set specific control parameters for a specific process. The embedded components inside the process mainly include: an internal random number generation unit, a random number buffer pool, a buffer pool management unit, and a number of mortise and tenon joints. Mortise and tenon joint: a structure of Chinese wood art, which uses concave and convex matching to achieve the connection of wooden pieces. The scheme in the embodiment of this case borrows this term to describe the code fragments replaced before and after the function returns. The instruction sequence is changed before the function call, so it is also necessary to transform the function call. This corresponding relationship is consistent with the mortise and tenon joint, so the name is used to describe the replaced code fragments before and after. The internal random number generation unit in the figure includes a random seed generator and a random number generator. The random seed generator receives the control parameters from the user control interface unit to generate a random seed and provides it to the random number generator. The random number generator generates random numbers and outputs them to the random number buffer pool. The mortise and tenon joint cooperates with the internal function call of the software and is responsible for the randomization of the return address. The buffer pool management unit is responsible for accessing and filling the buffer pool.

[0042] As an overflow attack defense method based on stack randomization in an embodiment of the present invention, further, the random seed generator generates a random seed by collecting internal data of the processor; the random number generator uses the random seed as the encryption algorithm plaintext, key and initial vector, encrypts the plaintext to generate ciphertext, and uses the ciphertext as a random number for representing the relative distance between the return address and the data overflow point.

[0043] In order to prevent attackers from guessing the location of the return address, the randomness of the length of the inserted data must be guaranteed. For this reason, in the embodiment of this case, a random number generator held inside the software is used, which can be referred to as an internal random number generator. The characteristic of the internal random number generator is that it does not rely on external resources that can be easily known or guessed by attackers to generate random number streams, so that the random numbers generated by the internal random number generator are not easily known or affected by attackers. Figure 5 As shown in the figure, the internal random number generator mainly consists of two parts: random seed generator and random number generator. The random number generator is the basis for generating pseudo-random number streams. The random number can be generated based on the block encryption algorithm. In simple terms, it is to repeatedly encrypt the output ciphertext packets and output the continuously generated ciphertext packets as pseudo-random numbers. To ensure that the output data stream is not guessed by the attacker, it is necessary to ensure that the initial vector, plaintext and key of the block encryption algorithm are not guessed by the attacker. These initial data will be generated by the random seed generator. From the structure of the internal random number generator, the key to ensuring the quality of random numbers lies in the random number of the initial seed of the random number, or in other words, it is not guessed by the attacker. From the perspective of computer architecture, the most difficult thing for an attacker to control is the processor. The processor is a high-speed computer component, and the state information is constantly changing rapidly. This state information can be collected by software as a random seed, and when the attacker wants to collect this state information, the information has often changed greatly. Although this method is not as high in quality as some proprietary built-in hardware random number generators, it does not make special requirements on hardware, so it can be applied to a large number of commercial computer systems.

[0044] As an overflow attack defense method based on stack randomization in an embodiment of the present invention, further, the random seed generator uses a processor performance monitoring counter to obtain the number of occurrences of a preset type of event inside the processor at the current time to generate a random seed. Further, the random seed generator collects the number of occurrences of each type of event at the current time as output data, and uses the lowest two bits of the output data as random seed components.

[0045] The processor performance monitoring counter is a hardware feature of Intel processors, which is used to record the number of times certain specific events occur inside the processor. From a physical point of view, it is a number of registers. Some registers are used for setting, mainly to select the processor events to be recorded (because there are many processor events that can be recorded, but due to the limited number of registers, only a few events can be recorded in a certain monitoring process); some registers are used to record the number of times processor events occur (general processor models only have 4 registers to record the number of times). In the embodiment of this case, the processor internal state data is collected through the processor performance monitoring counter (Performance Monitor Counter). The processor performance monitoring counter is a hardware feature provided by Intel processors. It is mainly used for software debugging and other purposes. Its purpose is to feedback the internal state of the processor to the user. In the embodiment of this case, the processor performance monitoring counter can be used to know the number of times a certain type of event occurs inside the processor at the current time, and these numbers can be used to generate random seeds. It should be noted that not all processors have the hardware feature of the processor performance monitoring counter, but most other types of processors have similar or partially similar hardware features for feedback of processor internal data to processor users. Therefore, the ideas provided by the present invention can still be used for other types of processors. Due to the limited collection capability of the processor performance monitoring counter, only a small number of events can be collected each time, and general Intel processor models often only support the collection of 4 types of events. For this reason, in the implementation scheme of this case, it is set by default that the number of collected 4 types of events can be used as the input data of the initial seed. The selection of the 4 types of events is set by the software user, that is, it accepts user control instructions. In this way, the uncontrollable factors (user input) of the attacker can be increased, making it more difficult for the attacker to guess the collection of random seeds.

[0046] Only the lowest two bits of the output data of each event number are collected as the components of the random seed. Since any processor state change must take a certain amount of time, even if the event change time is 1ms, then for the count value change, the lowest bit (binary) changes in 1ms, and the secondary bit changes in 2ms. Therefore, the frequency of high-order bit changes must be slower than the frequency of low-order bit changes. In order to reduce the probability of being guessed by the attacker, in this embodiment, only the lowest two bits of the collected data are taken to ensure the randomness of the input data as much as possible.

[0047] To sum up, the working process of the random seed generator is as follows: Figure 6As described. (1) The user inputs a control instruction, selects the event set to be collected, and sets the configuration parameters of the processor performance monitor counter accordingly; (2) The collection unit collects processor status data regularly. To ensure the randomness of the data, the first collected data is discarded; (3) The collection unit submits the 4 data collected at one time to the processing unit, and the processing unit uniformly intercepts the lowest two bits to form a 1-byte random seed; (4) According to the requirements of the packet length, key length, initial vector length, etc. of the block encryption algorithm, the collection unit and the processing unit work together to output a random seed of sufficient length. The random seed will be used as the plaintext, key and initial vector of the block encryption algorithm. The random number generator will encrypt by group and output the encrypted ciphertext as a random number. At the same time, the ciphertext of the current group will be encrypted again as "plaintext" in a loop, and the ciphertext will be output again. In this way, random numbers can be output continuously. Regarding the block encryption algorithm, there is no requirement in the embodiment of this case. Generally speaking, a general block algorithm such as AES can be used, and an encryption mode such as CBC can be used.

[0048] In order to ensure that the output random number is less than the maximum randomization threshold n, all output random numbers will be further processed using modular operations. For example: the generated random number is x, and x = num*n + y, then through modular operations, the random number generator will eventually output y, not x. This ensures that the maximum output random number does not exceed n. In combination with actual conditions, the maximum randomization threshold n does not exceed 65536, that is, the representation range of two bytes. Too large a maximum randomization threshold will lead to more serious space loss. When n is less than 256, the random number generator uses 1 byte to represent 1 random number; when n is greater than 256 and less than 65536, the random number generator uses 2 bytes to represent 1 random number. The size of the random number is transparent to the random number user (mortise and tenon). When obtaining the random number, the buffer pool management unit will determine whether to output 1 byte or 2 bytes to the mortise and tenon at a time based on the size of n.

[0049] It should be noted that the random number emphasized in the embodiments of this case is not a requirement for its random performance, but emphasizes preventing it from being guessed by attackers at a relatively low cost. Even if the random performance is poor, as long as it cannot be guessed by attackers, or the guessing cost is too high, the requirement can be met. The random number generator can use other algorithms, such as a sequence cipher algorithm, to generate a random number stream, or the user can directly set the initial random seed. This is not required in the embodiments of this case.

[0050] As an overflow attack defense method based on stack randomization in an embodiment of the present invention, further, a random number buffer pool with a ring structure is used to cache the random number generated by the random number generator for determining the length of the inserted data segment. The ring structure of the random number buffer pool has a head pointer for taking random numbers from the random number buffer pool and a tail pointer for the random number generator to write random numbers to the random number buffer pool.

[0051] See also Figure 7 As shown, in order to improve the efficiency of the mortise and tenon in obtaining random numbers, a random number buffer pool is adopted and organized in a ring structure, which has a head pointer and a tail pointer. The head pointer is used by the mortise and tenon to take a random number from the buffer pool, and the head pointer moves backward by one position (one position is equivalent to the size of a random number. For example, if the random number is 1 byte, then it moves one byte. The size of the random number will be set according to the range of the maximum randomization threshold n). The tail pointer is used by the random number generator to write random numbers into the buffer pool. Every time a random number is written, the tail pointer also moves one position. The buffer pool management unit is responsible for the management of the buffer pool, which mainly includes: concurrency control and overflow detection.

[0052] As an overflow attack defense method based on stack randomization in an embodiment of the present invention, further, a locking mechanism is used to perform concurrent control on concurrent access of multiple threads in a random number buffer pool, and the amount of data in the random number buffer pool is periodically detected. The random number buffer pool is subjected to empty overflow detection and wake-up thread according to a preset random number buffer pool size, overflow threshold and empty threshold. In the locking mechanism, when any thread accesses the random number buffer pool head pointer, it first applies for a lock to the random number buffer pool, obtains a random number after the application is successful, and moves the head pointer backward and releases the lock.

[0053] To support the multi-threaded operation of software, the buffer pool access supports multi-threaded concurrent access, and the concurrent control is completed by the buffer pool management unit. The buffer pool management unit adopts a locking mechanism: when any thread accesses the head pointer, it first applies for a lock from the buffer pool. Only after the application is successful can it obtain a random number. After obtaining the random number successfully and moving the head pointer backward, the lock is released. In this way, it can support the mortise and tenon in multiple threads to jointly access the buffer pool. The tail pointer does not require concurrent control because only the random number generator operates on it. The buffer pool management unit periodically detects the data volume of the buffer pool. The buffer pool management unit runs in the form of a thread and is periodically awakened to perform empty / full detection. Let the size of the buffer pool be size, the current data volume be cur, and the remaining ratio be cur / size. The overflow threshold is set to Ko, and the empty threshold is set to Kn. When cur / size < Kn, it indicates that the data in the buffer pool has fallen below the warning line, and the buffer pool management unit requires the random number generator to start replenishing random numbers. When cur / size > Ko, it indicates that the data in the buffer pool has exceeded the warning line, and the random number generator stops replenishing random numbers. To avoid frequent replenishment of the buffer pool, users should reasonably set the size size of the buffer pool according to the software's need for random numbers.

[0054] Based on the above content, the main operations of the random number buffer pool are summarized as follows: (1) The user sets the main parameters of the buffer pool, including the buffer pool size size, the overflow threshold Ko, the empty threshold Kn, etc.; (2) The buffer pool management unit wakes up the random number generator and starts filling the buffer pool until the overflow threshold Ko is reached; (3) During the software operation, the mortise and tenon scattered inside the software start to access the random numbers through the head pointer according to the locking requirements; (4) The buffer pool management unit periodically detects whether the current data volume cur of the buffer pool is less than the empty threshold. If so, it wakes up the random number generator to fill it, otherwise it does nothing; (5) When the software exits, the storage space of the buffer pool is also cleared.

[0055] As the overflow attack defense method based on stack randomization in the embodiment of the present invention, further, the random number is used as the length random factor of the data segment, and the function call filling data length factor = the actual length of the function call filling data segment ⊕ length random factor is used to insert the data segment between the function call destination address and the return address. Further, in the return address push operation onto the stack, the return address is pushed onto the stack using the push instruction, and a data segment of the random number length is continuously written into the stack, and the jmp instruction is used to jump to the target address of the function call.

[0056] In order to dynamically change the relative distance between the return address and the attack overflow position, a data segment of random length is inserted between the two in the embodiment of this case. To achieve this purpose, the method of instruction replacement can be adopted. In the traditional method, the return address is pushed on the stack by the call instruction. However, the call instruction can be regarded as a collection of two operations, push and jump, and these two operations cannot be separated. In order to continue writing data in the stack before jumping, the call instruction must be replaced so that the two operations are performed separately, thereby making it possible to insert a data segment of random length.

[0057] like Figure 8 As shown in the figure, the call instruction is replaced with a series of instructions. This series of instructions not only needs to complete the function of the original call instruction, but also needs to continue to write some data into the stack after returning to the address. Figure 8 As shown on the right, it is mainly divided into four contents. (1) Use the push instruction to push the return address onto the stack, which is the pseudo code "push return address". (2) Continuously write data, and the length of the written data is determined by a random number. (3) Push the factor containing the length of the padding data onto the stack, which is the pseudo code "pushn". (4) Finally, jump to the destination address, that is, the called function, which is the pseudo code "jmp*".

[0058] Indicates the factor that includes the length of the padding data. Each time the software runs, a random number generator will generate a random number of the same length as the address, which is called the length random factor Len_r. Len represents the actual length of the padding data for this function call, and the factor that includes the length of the padding data is represented by Len_n. There is a relationship Len_n=Len⊕Len_r. The reason for introducing Len_r instead of pushing the length Len directly into the stack is to prevent attackers from affecting the function return process by overwriting Len (because when the function returns, the padding length Len needs to be indicated).

[0059] Note: (1) The length of the written data is related to the protection strength. The more data is written, the more difficult it is for the attacker to guess. The two are in a linear increasing relationship. (2) Pushing the factor containing the length of the padding data into the stack does not affect security, because the attacker can overwrite Len_n but will not know the value of Len (this is limited by the security assumption given in the embodiment of this case, and the security assumption is reasonable).

[0060] In order to ensure that the function can return correctly, the ret instruction must be processed as necessary. Since the ret instruction directly takes the top data of the stack as the return address and uses it as the target address to jump, this will cause the ret instruction to mistakenly use the random data pushed into the stack as the return address to jump, resulting in function errors. The original random fill data must be popped out of the stack and the real return address must be retained as the top element of the stack. So if Fig. 9 As shown, the ret instruction is replaced. It is mainly divided into four contents. (1) Read the random length factor Len_r; (2) First read the top data of the stack (ie: Len_n), and get the filling length Len according to the relationship Len_n=Len⊕Len_r; (3) According to Len, execute a series of pop instructions to pop the randomly filled data out of the stack; (4) Finally, use the jmp instruction to perform the real jump. Of course, the top pointer of the stack can be directly operated to complete similar work. However, considering that it involves too many changes to the existing execution flow, this method of only replacing the call and ret instructions can be used to implement the push operation of the return address. These replaced instructions can be called mortise and tenon. Mortise and tenon are used to match function calls. When the function is called, a data fragment with a random length is inserted, which is equivalent to changing the original structure of the wood interface. Therefore, when the function returns, the same correction is made so that the function can return normally. Mortise and tenon are required to be implanted in the software in this embodiment. Since there are multiple function calls in the software, several mortise and tenon will also be implanted in the software.

[0061] Instruction replacement is completed in the compilation stage, and the instruction replacement process of the two types of instructions can be completed in the gcc compiler. During the internal compilation process, the gcc compiler will first generate the compilation intermediate results in the ATL form of the intermediate link, and these intermediate results will refer to the compilation template and compile them into the assembly instruction form. By changing the compilation template of the gcc compiler, the corresponding contents of the call instruction and the ret instruction are replaced with the above contents. In this way, the purpose of the present invention can be achieved without modifying the source code by the user on the premise of knowing the source code.

[0062] In the embodiment of this case, in order to make the attacker's attack attempt zero, the length of the random data inserted between the return address and the overflow starting point changes each time the function is called; in order to prevent the attacker from guessing the pattern of the insertion length, a random number generator based on the processor state information is used to make it difficult for the attacker to affect the random number generation process by setting the external environment of the software. On the whole, if the length range of the dynamically inserted data is [1,n], then the probability of a successful attack is 1 / n, and the probability of a successful attack will not accumulate with the increase in the number of attacks. In this way, the solution only wastes a certain amount of storage space, avoids the tedious work of return address integrity detection, and improves the overall efficiency of return address protection.

[0063] Furthermore, based on the above method, an embodiment of the present invention also provides an overflow attack defense system based on stack randomization, comprising: a random number generation module, a random number embedding module and a process compilation module, wherein:

[0064] A random number generation module is used for the random seed generator to generate a random seed according to the control parameters provided by the service routine; the random number generator generates a random number for representing the relative distance between the return address and the data overflow point according to the random seed;

[0065] A random number embedding module, used to determine the length of a data segment for random dynamic insertion into a return address according to a random number, insert the data segment with the length determined by the random number into the return address and generate embedded component content for randomized return address processing;

[0066] The process compilation module is used to recompile the embedded component content into all processes in the system through a compiler, so that the position of the return address in the stack is random and uncertain when a function call occurs.

[0067] Through the defense solution in this case, after the software workflow is started, the random seed generator implanted in the software will request the maximum random number threshold and the acquisition processor event sequence from the system service, and complete the generation of random seeds; after receiving the random seed, the random number generator will start to generate random numbers, fill them into the buffer pool, and perform overflow detection regularly; once the function call is triggered, Mortise and Tenon takes a random number from the buffer pool as the length of the random filling data, and continues to write data of this length after pushing the return address into the stack; when the function returns, Mortise and Tenon will bypass the filled data, obtain the return address and then return.

[0068] Note: The random seed generator is only executed once when the software is started. A random seed is generated once for each software startup, and all software in the operating system do not share the random seed. The random seed is the input data of the random number generator. Once generated, it is stored in the random number generator and disappears automatically when the software exits. The random seed generation is triggered when the software is started. The random seed generator is implanted into the software during recompilation. Its location is after the operating system completes software loading and other necessary initializations, but before the real business work begins. In terms of the console control sequence, the random seed generator can be implanted into the first instruction of the main function. As for other initialization functions before the main function, they can be optimized from the compiler or operating system level using the ideas designed by the present invention.

[0069] The overall process after the software is started is described as follows: When the software is started, the control data is obtained from the user control data interface unit to provide parameters for the random seed generator. The random seed generator collects the status information of the processor through the processor performance monitoring counter to generate a random seed. The random number generator is based on the block encryption algorithm and uses the random seed as the algorithm input to generate a pseudo-random data stream on demand. After the random number buffer is full, the random number generator stops generating random numbers and restores the original workflow of the software. When the software calls a function, the corresponding tenon uses a blocking mechanism to access the buffer pool and obtain a random number as the length of the filling data. The tenon completes the stack data filling of the specified length and jumps to the function. Before the function returns, the corresponding tenon knows the length of the random filling data through the top data of the stack, then obtains the correct return address and returns to the function. The buffer pool management unit regularly detects the data margin of the buffer pool and replenishes the random numbers in the buffer pool in time. After the software exits, all resources including the buffer pool are released and the software ends.

[0070] As the overflow attack defense system based on stack randomization in the embodiment of the present invention, further, it also includes: a user control interface module shared by multiple softwares, which is used to set control parameters and related threshold data through user input.

[0071] The user control interface module can be used as the only interface facing the user and is also shared by multiple software in the operating system. The user control interface module is used to input the corresponding control interface parameters to guide all software using the mechanism in the entire operating system. Users can set the corresponding control parameters for all software through this interface, or set unique control parameters for specified software through this interface. Users can specify specific security policies for different software according to the different security sensitivity of the software. The most core work of the user control interface module is the necessary hardware environment initialization. In order to ensure the security of the random seed, the processor status data can be used as input. The collection of this data depends on the processor performance monitoring counter. Therefore, the user control interface module must first complete the processor model query and the initialization setting of the hardware environment. After the processor model is determined, the user control interface module lists the available processor event types for the user to filter and determine. Therefore, the user control interface unit must first complete the following tasks: (1) complete the processor model query; (2) complete the setting of the processor performance monitor control register (such as: whether to collect kernel space data); (3) list the available processor event types for the user to filter. Among them, the processor events that can be collected should meet two conditions: (1) the event should be difficult for the attacker to control or influence, and (2) the event should be volatile. The former is to ensure that the attacker cannot affect the data source of the random number seed. Generally, these events are such as: BR_MISP_EXEC.COND. Even if the attacker completely controls the operating system or even the hardware itself, it is difficult for the attacker to accurately control the occurrence of branch prediction events. This type of event meets the first condition. The latter emphasizes the rapid change of data. It is difficult for the attacker to capture the same data. A typical example is L2_TRANS.L1D_WB. Due to the rapid reading and writing of the cache, this state changes rapidly, resulting in very rapid data changes. Different models of processors have different support ranges, but most models of processors support hundreds of events, so users have enough events to choose from.

[0072] The maximum randomization threshold n is a control parameter that must be set. The maximum randomization threshold n is the maximum length of the random filling data of the mortise and tenon. n should not be too large, otherwise it will cause too much waste of storage space. Because each function call will generate an unused stack space that does not exceed n. At the same time, since the computer system itself will also limit the maximum length of the stack space, an excessively large n will not be accepted by the operating system. n should not be too small, otherwise the difficulty of the attacker's guess will be greatly reduced, reducing the protection strength. In general, n can be set to 64, that is, the probability of each attacker's attack being successful is 1 / 64. Users can set different maximum randomization thresholds n for different software according to their needs to achieve different levels of protection. Other parameters, such as the buffer pool size, can also be set by users, or the default options can be used.

[0073] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0074] Based on the above method and / or system, an embodiment of the present invention also provides a server, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0075] Based on the above method and / or system, an embodiment of the present invention further provides a computer-readable medium having a computer program stored thereon, wherein the above method is implemented when the program is executed by a processor.

[0076] In all examples shown and described herein, any specific values ​​should be interpreted as merely exemplary and not as limiting, and thus other examples of the exemplary embodiments may have different values.

[0077] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0078] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A stack randomization-based overflow attack defense method, characterized in that: Contains the following: The random seed generator generates a random seed according to the control parameters provided by the service routine; the random number generator generates a random number for representing the relative distance between the return address and the data overflow point according to the random seed; Determine the length of a data segment used for randomly and dynamically inserting into a return address according to a random number, insert the data segment with the length determined by the random number into the return address, and generate embedded component content of the randomized return address; The embedded component content is recompiled by a compiler to generate a program with the same function and an added safety mechanism, in which a return address randomization process is used to make the position of the return address in the stack random and uncertain when a program function call occurs.

2. The stack randomization-based overflow attack defense method according to claim 1, characterized in that: The random seed generator generates a random seed by collecting data from inside the processor; the random number generator uses the random seed as the encryption algorithm plaintext, key and initial vector to encrypt the plaintext to generate ciphertext, and uses the ciphertext as a random number to represent the relative distance between the return address and the data overflow point.

3. The stack randomization-based overflow attack defense method according to claim 1 or 2, characterized in that: The random seed generator uses a processor performance monitoring counter to obtain the number of occurrences of a preset type of event inside the processor at the current time to generate a random seed.

4. The stack randomization-based overflow attack defense method according to claim 3, characterized in that: The random seed generator collects the number of times each type of event occurs at the current time as output data, and uses the lowest two bits of the output data as random seed components.

5. The stack randomization-based overflow attack defense method according to claim 1, characterized in that: A random number buffer pool with a ring structure is used to cache random numbers generated by a random number generator for determining the length of an inserted data segment. The ring structure of the random number buffer pool has a head pointer for taking random numbers from the random number buffer pool and a tail pointer for the random number generator to write random numbers into the random number buffer pool.

6. The stack randomization-based overflow attack defense method according to claim 5, characterized in that: A locking mechanism is used to control concurrent access of multiple threads in a random number buffer pool, and the amount of data in the random number buffer pool is detected regularly. The random number buffer pool is subjected to empty overflow detection and wake-up thread according to the preset random number buffer pool size, overflow threshold and empty threshold. In the locking mechanism, when any thread accesses the random number buffer pool head pointer, it first applies for a lock from the random number buffer pool. After the application is successful, the random number is obtained, the head pointer is moved back and the lock is released.

7. The stack randomization-based overflow attack defense method according to claim 1, characterized in that: The random number is used as the length random factor of the data segment, and the data segment is inserted between the function call destination address and the return address using the function call filling data length factor = the actual length of the function call filling data segment ⊕ the length random factor.

8. The stack randomization-based overflow attack defense method according to claim 1 or 7, characterized in that: In the return address push operation, the return address is pushed onto the stack using the push instruction, and data fragments of the random number length are continuously written into the stack, and the jmp instruction is used to jump to the destination address of the function call.

9. An overflow attack defense system based on stack randomization, characterized in that: Contains: random number generation module, random number embedded module and process compilation module, among which, A random number generation module is used for the random seed generator to generate a random seed according to the control parameters provided by the service routine; the random number generator generates a random number for representing the relative distance between the return address and the data overflow point according to the random seed; A random number embedding module, used to determine the length of a data segment for random dynamic insertion into a return address according to a random number, insert the data segment with the length determined by the random number into the return address and generate embedded component content for randomized return address processing; The process compiling module is used to recompile the embedded component content through a compiler to generate a program with the same function but with the security mechanism of the present invention added, so that the position of the return address in the stack is random and uncertain when a program function call occurs.

10. The stack randomization-based overflow attack defense system according to claim 9, characterized in that: It also includes: a user control interface module shared by multiple softwares, which is used to set control parameters and related threshold data through user input.

Images