A Scalable Software Randomization Compilation Method for Source Code

Abstract

The present invention discloses an extensible software randomization compilation method for source code, including an extensible software randomization framework, a code generation randomization plug-in and a data processing randomization plug-in. First, at the level of the extensible software randomization framework, a packaging method for the compiler is defined, so as to achieve the reuse of the existing compiler function, and at the same time, the software randomization function can be effectively embedded; secondly, in the extensible framework, the code generation randomization plug-in is dynamically loaded to finally generate individual different software codes; at the same time, in the extensible framework, the data processing randomization plug-in is dynamically loaded to increase the randomization ability of the software individual to process memory data during dynamic operation; finally, the generated software individual is randomized in static code and dynamic data processing, which greatly increases the difficulty for attackers to break the software, thereby enhancing the security protection ability of the software itself.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an extensible software randomization compilation method oriented to source code. Background Art

[0002] Software is a basic component of information systems, and most network attacks achieve their goals through software vulnerabilities. In the traditional software development and distribution mechanism, the release version of the software is usually placed directly on the network server for users to download and use. When there are vulnerabilities in the release version of the software, all software users will be affected, and traditional software security defense generally relies on vulnerability patching, which is only effective after the horse has bolted. This kind of easy-to-attack and difficult-to-defend situation is a problem often encountered in the field of network security.

[0003] To solve this type of problem, the industry has proposed a software randomization method based on mobile target defense. By generating software variants with the same functions but different code structures each time you compile, you can build a completely different software ecosystem. Different users will run different software variants, making it difficult for attackers to develop attack strategies for the same software. When different devices run different variants of the same software, attackers must either develop an attack method for each variant, or create an attack method that is complex enough to succeed on all of these variants at the same time. Therefore, attackers must spend more time and energy to complete the attack. When software randomization technology is used in conjunction with a mechanism for regularly releasing and updating software versions, the success rate of traditional software vulnerability attacks can be reduced to zero.

[0004] At present, some academic studies have proposed some software randomization schemes, such as Figure 1 The software randomization method based on compiler development based on LLVM (Low Level Virtual Machine, LLVM) shown in the figure generally generates randomized enhanced binary software by adding an additional code randomization stage in the final machine code generation and intermediate code optimization process. However, although such methods can be transparent to end users, developers still need to specially configure and use the relevant randomization processing process, which has many inconveniences in the actual application process and is not conducive to practical application. Summary of the invention

[0005] In order to solve the technical problem that the current software randomization scheme requires developers to configure the randomization process by themselves, which increases the workload of developers and is not conducive to improving work efficiency. The present invention provides an extensible mechanism for software randomization that does not require developers to change their software development habits, and can develop and customize special code generation randomization plug-ins and data processing randomization plug-ins according to actual security requirements, and integrate them through an extensible framework, so that more software randomization methods can be implemented through the method of the present invention, which is an extensible software randomization compilation method for source code.

[0006] In order to achieve the above technical purpose, the technical solution of the present invention is:

[0007] A scalable software randomization compilation method for source code, comprising the following steps:

[0008] When compiling the source code, first check whether there are pre-defined randomized compilation parameters in the compilation command line parameters. If not, compile the source code directly; if so, further parse the received compilation command line parameters, and reconstruct all compilation parameters through the parameter array, and during reconstruction, dynamically insert the randomized compilation parameters into the parameter array in the form of randomized compilation instructions; finally, regenerate the command line parameters uniformly and submit them to the system compiler for source code compilation.

[0009] The method described above, when no randomized compilation requirement is received, directly compiling the source code means directly using the received command line parameters to call the system compiler to compile the source code.

[0010] The method described above, the process of reconstructing all compilation parameters through the parameter array includes:

[0011] First, an empty parameter array Array is initialized, then the command line parameters are parsed, and the parsed non-randomized parameters are added to the Array. At the same time, the parsed randomized parameters are replaced with system-predefined randomized compilation instructions and added to the Array. Finally, the parameter array is used as the parameter of the system compiler for code compilation.

[0012] The method, wherein the randomized compilation instruction includes a randomized code generation instruction, and the execution process of the instruction includes:

[0013] First, obtain a list of all functions in the source code, and process each specific function in the list: first obtain a list of all basic blocks in the function and further obtain a list of all intermediate instructions, then randomize the intermediate instructions and basic blocks, and finally compile them into a randomized code dynamic link library that can be loaded at any time to implement function calls, thereby achieving code randomization.

[0014] In the method, the execution process of the randomized code generation instruction is to act as a randomized code plug-in, and when the system compiler is compiling, the randomized compilation instruction is used to dynamically specify the randomized code plug-in, thereby realizing randomized code generation.

[0015] In the method, the randomized compilation instructions also include randomized data processing instructions, and the execution process of the instructions includes: establishing a runtime library including randomized processing functions for different memory data structures, and compiling a randomized data dynamic link library that can be loaded at any time, so that when analyzing the instructions, calls to corresponding randomized processing functions in the runtime library are inserted for different randomized data instructions, thereby realizing data randomization.

[0016] In the method, the execution process of the randomized data processing instruction is to act as a randomized data plug-in, and when the system compiler is compiling, the randomized compilation instruction is used to dynamically specify the randomized data plug-in, thereby realizing data randomization.

[0017] An electronic device, comprising:

[0018] one or more processors;

[0019] a storage device for storing one or more programs,

[0020] When the one or more programs are executed by the one or more processors, the one or more processors implement the aforementioned method.

[0021] A computer readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the aforementioned method

[0022] The technical effect of the present invention is that the original system compiler is uniformly encapsulated, and the code generation randomization and data processing randomization plug-ins can be loaded on demand in an extensible manner, thereby generating individual software codes, and finally realizing the randomization of the generated software individuals in static code and dynamic data processing, which greatly increases the difficulty for attackers to break into the software, thereby enhancing the security protection capabilities of the software itself. At the same time, the present invention is provided to developers in the form of a compiler, and a mature and strictly verified randomization algorithm can be enabled by default, thereby achieving software security enhancement that is transparent to users and developers. When developers or software manufacturers have special security requirements, they can also customize and develop related randomization plug-ins, which are uniformly loaded through the compiler provided by the present invention, to achieve software security enhancement with higher intensity. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic diagram of the existing LLVM-based software random compilation framework;

[0024] Figure 2 A schematic diagram of the overall framework of the scalable randomized compiler provided by the present invention;

[0025] Figure 3 A schematic diagram of an extensible software randomization framework of the present invention;

[0026] Figure 4 A schematic diagram of a randomization framework for code generation of the present invention;

[0027] Figure 5 Schematic diagram of the randomization framework of data processing of the present invention. DETAILED DESCRIPTION

[0028] See also Figure 1 , the method provided in this embodiment includes three parts: an extensible software randomization framework, a code generation randomization plug-in, and a data processing randomization plug-in. First, at the level of the extensible software randomization framework, this embodiment provides a packaging method for the compiler, thereby realizing the reuse of the existing compiler functions, and at the same time being able to effectively embed the software randomization function; secondly, in the extensible framework, the code generation randomization plug-in is dynamically loaded to finally generate individual software codes; at the same time, in the extensible framework, the data processing randomization plug-in is dynamically loaded to increase the randomization ability of the software individual to process memory data during dynamic operation; finally, the generated software individual is randomized in static code and dynamic data processing, which greatly increases the difficulty for attackers to break into the software, thereby enhancing the software's own security protection capabilities.

[0029] The scalable software randomization framework mentioned in this embodiment is specifically:

[0030] The software code generally requires many complex command line parameters during the compilation process. This embodiment realizes the dynamic and scalable addition of the software code random compilation function through the compiler of the internal packaging and scheduling system. The overall process framework is as follows Figure 3 As shown. The random compiler provided in this embodiment first detects the command line parameters of the compilation. If no randomized compilation requirement is detected, the system compiler is directly called with the received command line parameters for source code compilation. If the parameters related to the randomized compilation requirement are detected, the received compilation command line parameters are further parsed, and all compilation parameters are reconstructed through a parameter array inside the program. When a randomized compilation parameter is encountered, the randomized compilation instructions are dynamically inserted into the parameter array by adding a randomized parameter processing process, and finally the command line parameters are uniformly generated, and finally the system compiler is called for source code compilation to generate randomized individual software.

[0031] Taking the Linux system based on the LLVM framework and the Clang compiler as an example, the internal randomization parameter processing process provided in this embodiment is as follows.

[0032]

[0033]

[0034] Specifically, this embodiment first initializes an empty parameter array Array, then parses the command line parameters, and adds the parsed non-randomized parameters to the Array, and replaces the parsed randomized parameters with system predefined randomized compilation instructions and adds them to the Array, and finally uses the parameter array as a parameter of the system compiler to compile the code, thereby completing the internal randomized parameter processing process.

[0035] The code generation randomization plug-in mentioned in this embodiment is:

[0036] In order to realize the randomness of generating software individuals, it is generally necessary to randomly disrupt the code during the compilation process. There are many specific random disruption algorithms, including equivalent replacement, redundant insertion, control flow disruption, etc. Although the specific randomization algorithms may be different, a relatively unified code generation randomization algorithm framework can still be abstracted. The present invention designs a relatively general software code randomization algorithm flow based on the LLVM framework. The specific process is: first, by adding a function-level processing process, a list of all functions in the code is obtained, and then each function is randomized; then when processing a specific function, all basic block lists in the function are obtained and all intermediate instruction lists are further obtained, and then the instructions, basic blocks, etc. are randomized, and can finally be compiled into a dynamic link library that can be dynamically loaded and reused, that is, the LLVM processing process, so that it can be uniformly scheduled and used by the overall framework.

[0037] For example, if a code randomization plug-in is named RandomCode and the generated dynamic link library is RandomCode.so, the randomization parameter is designed to be -randcode path / to / RandomCode.so. When the extensible software randomization framework adds randomization command line parameters, it can be dynamically specified through the -Xclang-load-Xclang parameter of the Clang system compiler, thereby using different code generation randomization plug-ins according to different security requirements.

[0038] Specifically, all existing methods for implementing code randomization can be loaded into this embodiment for implementation. For example, this embodiment implements code randomization through an equivalent replacement method, wherein basic block randomization can be implemented by inserting a code distributor. As long as a dynamic link library is generated based on the existing code randomization method, it can be loaded by the aforementioned framework call, thereby implementing specific code randomization.

[0039] The data processing randomization plug-in mentioned in this embodiment is specifically:

[0040] Code generation randomness can only make the generated software individual present randomness during static analysis, but when the software is running, its dynamic data processing behavior in memory remains unchanged. For this reason, it is necessary to insert additional data processing randomization functions in advance during the compilation process. Specific data processing randomization methods may include randomized stack data operations, randomized heap data operations, etc. Different randomization algorithms may differ in their specific implementations, such as establishing a shadow stack or inserting random redundant data, etc. Similarly, this embodiment abstracts the data processing randomization process into a relatively unified algorithm framework. This embodiment designs a relatively general data processing randomization algorithm flow based on the LLVM framework. The specific process is as follows: first, a runtime library is designed to implement the randomization processing function of different memory data structures, and then a call to a specific function in the runtime library is inserted for different instructions when analyzing instructions, thereby realizing the dynamic randomization capability of the data processing process. Similarly, the data processing process randomization function is finally compiled into a runtime library and a dynamically loadable and reusable dynamic link library, i.e., the LLVM processing process, which can be uniformly scheduled and used by the overall framework.

[0041] Data processing randomization framework

[0042] For example, if a data processing plug-in is named RandomData, the generated dynamic link library is RandomData.so, and the generated runtime library is RandomDataRuntime.a, then the randomization parameter can be designed as -randdata path / to / RandomData.so. When the extensible software randomization framework adds data processing randomization command line parameters, it can be dynamically specified through the -Xclang-load-Xclang parameter of the Clang system compiler, and the runtime function can be statically linked by directly appending the parameter path / to / RandomDataRuntime.a, thereby realizing the use of different data processing randomization plug-ins according to different security requirements.

[0043] Specifically, existing data structure randomization implementation methods can be loaded into this embodiment for implementation. For example, this embodiment can implement stack structure randomization by analyzing stack operation instructions and additionally inserting a padding area of ​​random length. At the same time, heap structure randomization can be implemented by changing all heap operation function calls to custom heap operation functions.

[0044] At the same time, this embodiment also provides an electronic device and a computer-readable medium.

[0045] Electronic equipment includes:

[0046] one or more processors;

[0047] a storage device for storing one or more programs,

[0048] When the one or more programs are executed by the one or more processors, the one or more processors implement the aforementioned method.

[0049] In specific use, users can interact with servers, which are also electronic devices, through electronic devices as terminal devices and based on the network to achieve functions such as receiving or sending messages. Terminal devices are generally various electronic devices equipped with display devices and used based on human-computer interfaces, including but not limited to smart phones, tablet computers, laptops and desktop computers. Various specific application software can be installed on the terminal devices as needed, including but not limited to web browser software, instant messaging software, social platform software, shopping software, etc.

[0050] The server is a network service end for providing various services. The method provided in this embodiment is generally executed by the server. In actual use, under the necessary conditions, the terminal device can also directly execute this method.

[0051] Similarly, the computer-readable medium provided in this embodiment stores a computer program, which implements the method of the embodiment of the present invention when executed by a processor.

Claims

1. A scalable software randomization compilation method for source code, characterized in that: The following steps are involved: When compiling the source code, first check whether there are pre-defined randomized compilation parameters in the compilation command line parameters. If not, compile the source code directly; if yes, further parse the received compilation command line parameters, and reconstruct all compilation parameters through the parameter array, and during the reconstruction, dynamically insert the randomized compilation parameters into the parameter array in the form of randomized compilation instructions; finally, regenerate the command line parameters uniformly and submit them to the system compiler for source code compilation; The process of reconstructing all compilation parameters through the parameter array includes: First, an empty parameter array Array is initialized, then the command line parameters are parsed and the parsed non-randomized parameters are added to the Array. At the same time, the parsed randomized parameters are replaced with the system predefined randomized compilation instructions and added to the Array. Finally, the parameter array is used as the parameter of the system compiler to compile the code. The randomized compilation instruction includes a randomized code generation instruction, and the execution process of the instruction includes: First, obtain a list of all functions in the source code, and process each specific function in the list: first obtain a list of all basic blocks in the function and further obtain a list of all intermediate instructions, then randomize the intermediate instructions and basic blocks, and finally compile them into a randomized code dynamic link library that can be loaded at any time to implement function calls, thereby achieving code randomization.

2. The method according to claim 1, characterized in that When no randomized compilation requirement is received, directly compiling the source code means directly using the received command line parameters to call the system compiler to compile the source code.

3. The method according to claim 1, characterized in that The execution process of the randomized code generation instruction is to act as a randomized code plug-in, and when the system compiler is compiling, the randomized compilation instruction is used to dynamically specify the randomized code plug-in, thereby realizing randomized code generation.

4. The method according to claim 1, characterized in that: The randomization compilation instructions also include randomization data processing instructions. The execution process of the instructions includes: establishing a runtime library including randomization processing functions for different memory data structures, and compiling a randomization data dynamic link library that can be loaded at any time, so that when analyzing the instructions, calls to corresponding randomization processing functions in the runtime library are inserted for different randomization data instructions, thereby realizing data randomization.

5. The method according to claim 4, characterized in that The execution process of the randomized data processing instruction is to act as a randomized data plug-in, and when the system compiler is compiling, the randomized compilation instruction is used to dynamically specify the randomized data plug-in, thereby realizing data randomization.

6. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

7. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images