A fine-grained runtime sensitive data randomization protection method

Abstract

The application discloses a fine-grained runtime sensitive data randomization protection method, which adds sensitive data confidentiality and integrity cryptography protection extension instructions at the instruction level through the extension of an instruction set to provide fine-grained cryptography operation primitives for protecting sensitive data confidentiality and integrity. When an operating system kernel or a user state application process needs to operate on sensitive data, the extended cryptography operation primitives need to be used to encrypt or decrypt the sensitive data. When encryption or decryption is performed, additional key and handle information and selection information of a data protection range need to be provided. The program protected by the extended instruction set provided by the application can resist various memory-related software attacks, can flexibly provide integrity and confidentiality protection according to the difference of the selection range of the input, and can flexibly provide time or space memory security protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer application runtime security, and in particular to a fine-grained runtime sensitive data randomization protection method. BACKGROUND

[0002] Memory is an important component in computer architecture, and the running code and processing data of any program will be stored in memory. Google engineers once conducted a statistical analysis of high-risk vulnerabilities in their browser since 2015, and the results showed that about 70% of them were memory-related vulnerabilities.

[0003] Programs generate different types of data in memory during runtime, including return addresses, state variables, and cryptographic algorithm keys, which are sensitive information. Direct use of software methods for protection often results in significant performance overhead. Although mainstream processor manufacturers provide common cryptographic algorithm encryption engines such as Intel AES-NI, they are not suitable for frequent encryption and decryption operations. Currently, there is still a lack of fine-grained runtime sensitive data protection primitives in computer architecture. SUMMARY

[0004] To overcome the deficiencies of the prior art, the present application provides a fine-grained runtime sensitive data randomization protection method, and the specific technical solutions are as follows:

[0005] The present application discloses a fine-grained runtime sensitive data randomization protection method, which adds sensitive data confidentiality and integrity cryptographic protection extension instructions at the instruction level by extending the instruction set to provide fine-grained cryptographic operation primitives for protecting sensitive data confidentiality and integrity. When the operating system kernel or user-mode application process needs to operate on sensitive data, the extended cryptographic operation primitives need to be used to encrypt or decrypt the sensitive data. Additional key and handle information, as well as data protection range selection information, are required during encryption or decryption.

[0006] As a further improvement, when the operating system kernel or user-mode application process needs to store sensitive data in memory, the extended cryptographic operation instructions are used to encrypt the sensitive data to achieve randomization effect. When the operating system kernel or application process needs to use sensitive data, the extended cryptographic operation instructions are used to decrypt the sensitive data to achieve de-randomization effect. The core protection function of the present application is achieved through encryption and decryption of cryptographic operations.

[0007] As a further improvement, the sensitive data confidentiality and integrity cryptography protection extension instruction described in the application comprises: an encryption instruction for encrypting all contents, an encryption instruction for encrypting part of the contents and filling in integrity check information, a decryption instruction for decrypting all contents, a decryption instruction for decrypting all contents and checking the integrity of part of the contents, a decryption instruction for decrypting all contents and performing symbol expansion after checking the integrity of part of the contents, and an instruction type introduction, in addition to the simple encryption and decryption instructions (for protecting the confidentiality of data), the integrity check information is added on the basis of encryption and decryption to protect the integrity and confidentiality of data.

[0008] As a further improvement, the sensitive data confidentiality and integrity cryptography protection extension instruction described in the application receives five inputs of operation content, key, handle, and selection range start and end bytes, and generates one output of the result after encryption and decryption.

[0009] As a further improvement, the key described in the application should be stored in an isolated special register accessible to a higher privilege level including the kernel state, and an additional random number offset should be added when simultaneously protecting the operating system kernel and user state application, to ensure that there is no information leakage across privilege states; the key is required during the encryption and decryption process, and here it is required that the key should not be leaked.

[0010] As a further improvement, the sensitive data confidentiality and integrity cryptography protection extension instruction described in the application selects a lightweight symmetric cryptography algorithm when encrypting or decrypting sensitive content, including: XOR operation, lightweight block cipher, and lightweight adjustable block cipher. The lightweight cryptography algorithm is selected to ensure that the performance is not affected.

[0011] As a further improvement, the sensitive data described in the application includes control flow data such as return addresses and function pointers of the operating system kernel and user state program, intermediate results of sensitive operations, related keys, and state variables affecting program branch decisions.

[0012] As a further improvement, the handle described in the application uses fixed constants or random numbers, timestamps, and variable address information according to different use scenarios to provide ordinary randomization protection, randomization protection combined with time state, and randomization protection combined with space state. By using the handle, replacement attacks can be resisted.

[0013] As a further improvement, the selection information of the data protection range described in the application achieves different protection effects according to the length of the range. When the selected range is less than the machine word length, integrity and confidentiality protection can be provided, and when the selected range is equal to the machine word length, at least confidentiality protection can be provided. This is the opening condition for confidentiality protection and integrity protection.

[0014] The beneficial effects of the present application are as follows:

[0015] The present application discloses a fine-grained runtime sensitive data randomization protection method, which can provide fine-grained runtime data randomization protection for operating system kernels and user state application programs. The present application introduces basic primitives of cryptographic operations at the instruction level, and combines flexible protection range selection functions in extended instructions, so that cryptographic operations can be efficiently performed on sensitive data of any length. Since attackers cannot directly tamper with the randomized data, programs protected by the extended instruction set proposed by the present application can resist various memory-related software attacks; according to the different selection ranges of the input, the present application can flexibly provide integrity and confidentiality protection, and according to the different provision of the handle, the present application can flexibly provide time or space memory safety protection, filling the design gap of fine-grained runtime sensitive data protection primitives in the current computer architecture. DETAILED DESCRIPTION

[0016] The present application discloses a fine-grained runtime sensitive data randomization protection method, which provides fine-grained cryptographic operation primitives for protecting the confidentiality and integrity of sensitive data at the instruction level through the way of extended instruction set. When the operating system kernel or user state application process needs to operate sensitive data, the extended cryptographic operation primitives need to be used to encrypt or decrypt the sensitive data. Additional handle information and data protection range selection information need to be provided during encryption or decryption.

[0017] When the operating system kernel or user state application process needs to store sensitive data into the memory, the extended cryptographic operation instructions are used to encrypt the sensitive data to achieve randomization effect; when the operating system kernel or application process needs to use sensitive data, the extended cryptographic operation instructions are used to decrypt the sensitive data to achieve de-randomization effect.

[0018] The sensitive data confidentiality and integrity cryptographic operation instruction extension includes: an encryption instruction for encrypting all contents, an encryption instruction for encrypting part of the contents and filling integrity check information, a decryption instruction for decrypting all contents, a decryption instruction for decrypting all contents and checking the integrity of part of the contents, and a decryption instruction for decrypting all contents and performing symbol extension after checking the integrity of part of the contents; the sensitive data confidentiality and integrity cryptographic operation instruction extension receives five inputs of operation content, key, handle, and selection range start and end bytes; the key should be stored in an isolated special register accessible to a higher privilege level including the kernel state, and an additional random number offset should be added when the operating system kernel and the user state application are protected at the same time, to ensure that there is no information leakage when crossing the privilege state.

[0019] The sensitive data includes the return address, function pointer and other control flow data of the operating system kernel and user state program, sensitive intermediate results (intermediate variables generated in the process of cryptographic library operation) and related keys, state variables (non-control flow data affecting branch decision).

[0020] The sensitive data includes the return address, function pointer and other control flow data of the operating system kernel and user state program, sensitive intermediate results (intermediate variables generated in the process of cryptographic library operation) and related keys, state variables (non-control flow data affecting branch decision).

[0021] The dials can use fixed constants or random numbers, time stamps, variable address information according to different use scenarios to provide ordinary randomization protection, randomization protection combined with time state and randomization protection combined with space state. In addition, the protection selection range can achieve different effects of protection according to the length of the range. When the selection range is less than the machine word length, integrity and confidentiality protection can be provided, and when the selection range is equal to the machine word length, at least confidentiality protection can be provided.

[0022] The purposes and effects of the present application will become more apparent through the following detailed description of specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0023]

[0024] The above table is a format specification of the fine-grained runtime sensitive data randomization instruction extension under the RISC-V architecture. The RISC-V instruction set is used as an example to illustrate how to extend the instruction set to provide fine-grained data randomization protection. Randomization is achieved through encryption, and the randomization (de-randomization) and encryption (decryption) are not distinguished in the following. The cryptographic algorithm used for encryption and decryption should be a lightweight symmetric cryptographic algorithm. The lightweight cryptographic algorithm includes but is not limited to: XOR operation, lightweight block cipher (PRESENT, LBlock), lightweight adjustable block cipher (QARMA, CRAFT, SKINNY, Lilliput). Under the premise of meeting the security requirements, the algorithm with small delay and easy hardware implementation should be preferred.

[0025] The whole instruction adopts R-type format, which has two source input registers and one target register. In the extension scheme, the first source register is used to store the data to be randomized (or de-randomized), the second source register is used to store the handle used for randomization (or de-randomization), and the target register is used to store the result after randomization (or de-randomization). The funct3 field is used to encode the key used in the randomization process. The funct7 field is used to encode the operation range and mode, wherein the lowest bit is used to indicate whether the instruction is an encryption operation or a decryption operation, the first to third bits are used to select the start byte, and the fourth to sixth bits are used to select the end byte.

[0026] For convenience of description, the assembly format of the encryption instruction is cre[x]k rd,rs[e:s],rt, and the assembly format of the decryption instruction is crd[x]k(s) rd,rs,rt,[end:start]. For the encryption operation cre[x]k, the plaintext data in the rs register is truncated from the start byte to the end byte, padded with 0 on both sides to 64 bits, encrypted with the key x and the handle in the rt register, and the result is saved to the rd register; for the decryption operation crd[x]k(s), the content in the rs register is decrypted with the key x and the handle in the rt register, and after decryption, it is detected whether the content outside the start byte to the end byte is all 0, and after detection, the detection result is saved to the rd register (if the s bit is set, the result is sign-extended), and if the detection fails, the processor will throw an exception state.

[0027] The extended instruction is the basic unit for protecting sensitive data in the design, and is responsible for performing cryptographic algorithm operations on the input content. The management logic of the key storage and update is responsible for the operating system kernel and the trusted firmware. The key should be stored in an isolated special register accessible to a higher privilege level including the kernel mode, and an additional random number offset should be added when protecting the operating system kernel and user mode application at the same time, to ensure that there is no information leakage across the privilege state.

[0028] According to different use scenarios, the handle register can use fixed constants or random numbers, timestamps, variable address information, and can provide ordinary randomization protection, randomization protection combined with time state, and randomization protection combined with space state.

[0029] According to different protection ranges, when the selected range is less than 8 bytes, integrity and confidentiality protection can be provided, and when the selected range is equal to 8 bytes, confidentiality protection can be provided.

[0030] Sensitive data includes return addresses, function pointers, and other control flow data of operating system kernel and user-space applications, sensitive intermediate results (intermediate variables generated during cryptographic library operations), and related keys, state variables (non-control flow data that affect branch decisions).

[0031]

[0032] The above gives an assembly code example of protecting different types of data under the RISC-V architecture using the sensitive data randomization extension instruction under different protection ranges. In the example, it is assumed that a 39-bit virtual address space is used, the data to be operated is in the a0 register, and the address of the variable to be protected in the memory is used as a handle, the low 32-bit address is in the t1 register, the high 32-bit address is in the t2 register, and all examples use the key a for operation.

[0033] Those skilled in the art can understand that the above description is only a single example of the application and is not intended to limit the application. Although the application has been described in detail with reference to the foregoing examples, those skilled in the art can still modify the technical solutions recorded in the foregoing examples or make equivalent replacements for part of the technical features. Any modification, equivalent replacement, etc. within the spirit and principles of the application shall be included in the protection scope of the application.

Claims

1. A fine-grained method for runtime randomization protection of sensitive data, characterized in that, By extending the instruction set, extended instructions for cryptographic protection of sensitive data confidentiality and integrity are added at the instruction level to provide fine-grained cryptographic primitives for protecting the confidentiality and integrity of sensitive data. When the operating system kernel or user-mode application process needs to operate on sensitive data, the extended cryptographic primitives are used to encrypt or decrypt the sensitive data. When encrypting or decrypting, additional key, handle information, and start and end byte selection information for the data protection range must be provided. When protecting both the operating system kernel and user-mode applications, an additional random number offset needs to be added to the encryption or decryption operation to ensure that no information is leaked when crossing privileged modes. Depending on the usage scenario, the control information can be selected as a fixed constant, a random number, a timestamp, or a variable address information to provide ordinary randomization protection, randomization protection combined with time status, or randomization protection combined with spatial status. The selection information for the data protection scope achieves different protection effects depending on the length of the scope: when the selected scope is less than the machine word length, it provides integrity and confidentiality protection; when the selected scope is equal to the machine word length, it provides at least confidentiality protection.

2. The fine-grained runtime sensitive data randomization protection method according to claim 1, characterized in that, When the operating system kernel or user-mode application process needs to store sensitive data in memory, it uses extended cryptographic operation instructions to encrypt the sensitive data to achieve a randomization effect; when the operating system kernel or application process needs to use the sensitive data, it uses extended cryptographic operation instructions to decrypt the sensitive data to achieve a derandomization effect.

3. The fine-grained runtime sensitive data randomization protection method according to claim 1, characterized in that, The aforementioned cryptographic protection extension instructions for the confidentiality and integrity of sensitive data include: encryption instructions that encrypt all content, encryption instructions that encrypt part of the content and fill in integrity verification information, decryption instructions that decrypt all content, decryption instructions that decrypt all content and verify the integrity of part of the content, and decryption instructions that decrypt all content, verify the integrity of part of the content, and then perform symbol extension.

4. The fine-grained runtime sensitive data randomization protection method according to claim 1, characterized in that, The key should be stored in a special, isolated register accessible at a higher privilege level, including kernel mode.

5. The fine-grained runtime sensitive data randomization protection method according to claim 1, characterized in that, The aforementioned cryptographic protection extension instructions for the confidentiality and integrity of sensitive data use lightweight symmetric cryptographic algorithms, including XOR operation, lightweight block ciphers, and lightweight adjustable block ciphers, when encrypting or decrypting sensitive content.

6. The fine-grained runtime sensitive data randomization protection method according to claim 1, 2, 3, 4, or 5, characterized in that, The sensitive data includes control flow data and non-control flow data. The control flow data includes the return addresses and function pointers of the operating system kernel and user-mode programs. The non-control flow data includes intermediate results of sensitive operations, related keys, and state variables that affect program branch decisions.

Images