Method and device for detecting program cache leakage, storage medium, and processor

Abstract

The application discloses a program cache leakage detection method and device, a storage medium and a processor. The method comprises the following steps: acquiring a control flow graph of a program, and determining the node type of a sensitive node in the control flow graph; acquiring a corresponding leakage detection algorithm according to the node type of the sensitive node; and determining whether the sensitive node has cache leakage according to the leakage detection algorithm. The detection method can effectively detect whether the program has cache leakage, thereby guaranteeing the theoretical safety of the program and improving the expansibility of the program.

Description

Technical Field

[0001] This invention relates to the field of computer hardware security technology, and in particular to a method for detecting program cache leakage, a device for detecting program cache leakage, a computer-readable storage medium, and a processor. Background Technology

[0002] With the development of computer networks, people's demands for computer performance are also increasing, and the operating speed of the CPU (central processing unit) is an important indicator of computer performance. To speed up CPU operation, various acceleration strategies have been proposed, such as caching, branch prediction, and out-of-order execution. However, while these strategies increase CPU speed, they also bring corresponding security threats.

[0003] The added acceleration strategies themselves contain certain vulnerabilities, allowing attackers to exploit leaked information to obtain users' private information. Regarding caching, attackers can deduce the private key value of encryption algorithms on the target computer by analyzing the time difference between cache hits and misses when reading memory data. Current cache leak attack methods can already crack the keys of commonly used encryption algorithms such as AES (Advanced Encryption Standard), RSA, and ECDSA (Elliptic Curve Digital Signature Algorithm).

[0004] Current cache leak detection methods cannot formally guarantee the theoretical security of programs that show no leaks. Furthermore, they typically only design detection rules for specific types of cache leaks in a particular high-level programming language, making it difficult to extend the detection to other high-level programming languages ​​or when new cache leaks occur. Summary of the Invention

[0005] This invention aims to at least partially address one of the technical problems in related technologies. Therefore, the first objective of this invention is to propose a method for detecting program cache leaks, which can effectively detect whether a program has a cache leak, ensuring the program's theoretical security and improving its scalability.

[0006] The second objective of this invention is to provide a device for detecting program cache leaks.

[0007] A third objective of this invention is to provide a computer-readable storage medium.

[0008] The fourth objective of this invention is to provide a processor.

[0009] To achieve the above objectives, a first aspect of the present invention proposes a method for detecting program cache leaks, comprising: acquiring the control flow graph of the program and determining the node type of sensitive nodes in the control flow graph; acquiring a corresponding leak detection algorithm based on the node type of the sensitive nodes; and determining whether a cache leak exists in the sensitive nodes based on the leak detection algorithm.

[0010] The method for detecting program cache leaks according to embodiments of the present invention first obtains the control flow graph of the program and determines the node types of sensitive nodes in the control flow graph. Then, it obtains a corresponding leak detection algorithm based on the node types of the sensitive nodes. Finally, it determines whether a cache leak exists in the sensitive node based on the leak detection algorithm. Therefore, this method can effectively detect whether a cache leak exists in the program, ensuring the theoretical security of the program and improving its scalability.

[0011] In addition, the method for detecting program cache leakage according to the above embodiments of the present invention may also have the following additional technical features:

[0012] According to one embodiment of the present invention, obtaining the control flow graph of a program includes: obtaining the source code of the program and compiling the source code to obtain assembly program code; performing semantic parsing on the assembly instructions in the assembly program code to obtain the instruction type of the assembly instructions; generating a control flow graph based on the assembly instructions, determining the node type of each node in the control flow graph based on the instruction type, and determining sensitive nodes based on the node type, wherein the assembly instructions correspond one-to-one with each node in the control flow graph.

[0013] According to one embodiment of the present invention, obtaining a corresponding leakage detection algorithm based on the node type of the sensitive node includes: when the sensitive node is a memory access node, the leakage detection algorithm is a data flow leakage detection algorithm, wherein the memory access node includes general memory access nodes and intra-branch memory access nodes; when the sensitive node is a jump node, the leakage detection algorithm is a control flow leakage detection algorithm, wherein the jump node includes branch jump nodes.

[0014] According to an embodiment of the present invention, when the leakage detection algorithm is a data flow leakage detection algorithm, determining whether a sensitive node has a cache leak according to the leakage detection algorithm includes: obtaining a first probability of a collision between the memory access node and its preceding and following nodes; and determining that the memory access node has a cache leak when the first probability satisfies a first preset leakage condition.

[0015] According to an embodiment of the present invention, obtaining a first probability of a collision between a memory access node and its preceding and following nodes includes: obtaining a pending collision probability between the memory access node and its preceding and following nodes; obtaining a first correlation between the access address of the memory access node and sensitive data in the cache; and determining the first probability based on the pending collision probability and the first correlation.

[0016] According to one embodiment of the present invention, obtaining the pending collision probability between a memory access node and its preceding and following nodes includes: obtaining the cache conflict situation between the access addresses of the memory access node, the cache collision situation between the memory access node and its preceding and following nodes, and the number of unique collisions between the memory access node and its preceding and following nodes; and determining the pending collision probability based on the cache conflict situation, the cache collision situation and the number of unique collisions.

[0017] According to an embodiment of the present invention, when the leakage detection algorithm is a control flow leakage detection algorithm, determining whether a sensitive node has a cache leakage according to the leakage detection algorithm includes: obtaining a second probability of a cache collision between a jump node and the cache access nodes of its preceding and following branches; and determining that the jump node has a cache leakage when the second probability satisfies a second preset leakage condition.

[0018] According to one embodiment of the present invention, obtaining a second probability of a cache collision between a jump node and its preceding and following branch cache access nodes includes: obtaining the number of cache collisions between the jump node and its preceding and following branch cache access nodes; obtaining a second correlation between the access address of the jump node and sensitive data in the cache; and determining the second probability based on the number of cache collisions and the second correlation.

[0019] To achieve the above objectives, a second aspect of the present invention provides a program cache leak detection device, comprising: an acquisition module for acquiring the control flow graph of the program and determining the node type of sensitive nodes in the control flow graph; an algorithm determination module for acquiring a corresponding leak detection algorithm based on the node type of the sensitive nodes; and a detection module for determining whether a cache leak exists in the sensitive nodes based on the leak detection algorithm.

[0020] According to an embodiment of the present invention, a program cache leak detection device acquires the control flow graph of the program and determines the node type of sensitive nodes in the control flow graph. An algorithm determination module acquires a corresponding leak detection algorithm based on the node type of the sensitive nodes. A detection module determines whether a cache leak exists in the sensitive nodes based on the leak detection algorithm. Therefore, this device can effectively detect whether a cache leak exists in the program, ensuring the theoretical security of the program and improving its scalability.

[0021] In addition, the program cache leakage detection device according to the above embodiments of the present invention may also have the following additional technical features:

[0022] According to an embodiment of the present invention, the acquisition module includes: a compilation processing unit, used to acquire the source code of the program and compile the source code to obtain assembly program code; an instruction parsing unit, used to perform semantic parsing on the assembly instructions in the assembly program code to obtain the instruction type of the assembly instructions; and a generation unit, used to generate a control flow graph based on the assembly instructions, determine the node type of each node in the control flow graph based on the instruction type, and determine sensitive nodes based on the node type, wherein the assembly instructions correspond one-to-one with each node in the control flow graph.

[0023] According to one embodiment of the present invention, when the sensitive node is a memory access node, the leakage detection algorithm is a data flow leakage detection algorithm, wherein the memory access node includes general memory access nodes and intra-branch memory access nodes; when the sensitive node is a jump node, the leakage detection algorithm is a control flow leakage detection algorithm, wherein the jump node includes branch jump nodes.

[0024] According to an embodiment of the present invention, when the leakage detection algorithm is a data flow leakage detection algorithm, the detection module is specifically used to: obtain the first probability of a collision between the memory access node and its preceding and following nodes; and determine that the memory access node has a cache leak when the first probability satisfies the first preset leakage condition.

[0025] According to one embodiment of the present invention, the detection module is further configured to: obtain the pending collision probability between the memory access node and the preceding and following nodes; obtain the first correlation between the access address of the memory access node and the sensitive data in the cache; and determine the first probability based on the pending collision probability and the first correlation.

[0026] According to one embodiment of the present invention, the detection module is further configured to: obtain cache conflict status between access addresses of memory access nodes, cache collision status between memory access nodes and preceding and following nodes, and the number of unique collisions between memory access nodes and preceding and following nodes; and determine the probability of pending collisions based on cache conflict status, cache collision status and the number of unique collisions.

[0027] According to an embodiment of the present invention, when the leakage detection algorithm is a control flow leakage detection algorithm, the detection module is specifically used to: obtain a second probability of a cache collision between the jump node and the cache access nodes of its preceding and following branches; and determine that the jump node has a cache leakage when the second probability satisfies a second preset leakage condition.

[0028] According to one embodiment of the present invention, the detection module is further configured to: obtain the number of cache collisions between the jump node and the cache access nodes of the preceding and following branches; obtain a second correlation between the access address of the jump node and the sensitive data in the cache; and determine a second probability based on the number of cache collisions and the second correlation.

[0029] To achieve the above objectives, a computer-readable storage medium is provided in a third aspect of the present invention, which stores a program cache leak detection program thereon. When the program cache leak detection program is executed by a processor, it implements the above-described program cache leak detection method.

[0030] The computer-readable storage medium of this invention, by executing the above-described method for detecting program cache leaks, can effectively detect whether there is a cache leak in a program, ensuring the theoretical security of the program and improving its scalability.

[0031] To achieve the above objectives, a processor is provided in a fourth aspect of the present invention, including the above-described program cache leak detection device.

[0032] The processor in this embodiment of the invention, by executing the above-described program cache leak detection device, can effectively detect whether there is a cache leak in the program, ensuring the theoretical security of the program and improving its scalability.

[0033] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0034] Figure 1 A flowchart of a method for detecting program cache leakage according to an embodiment of the present invention;

[0035] Figure 2 This is a flowchart of a control flow graph generation method according to a specific embodiment of the present invention;

[0036] Figure 3 This is a flowchart of a method for detecting program cache leakage according to a specific embodiment of the present invention;

[0037] Figure 4 This is a block diagram of a program cache leak detection device according to an embodiment of the present invention;

[0038] Figure 5 This is a block diagram of a program cache leak detection device according to an embodiment of the present invention;

[0039] Figure 6 This is a block diagram of a processor according to an embodiment of the present invention. Detailed Implementation

[0040] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0041] The following description, with reference to the accompanying drawings, outlines the method and apparatus for detecting program cache leaks, as well as a computer-readable storage medium and processor, according to embodiments of the present invention.

[0042] Figure 1 This is a flowchart of a method for detecting program cache leakage according to an embodiment of the present invention.

[0043] like Figure 1 As shown, the method for detecting program cache leaks according to an embodiment of the present invention may include the following steps:

[0044] S1, obtain the control flow graph of the program and determine the node type of sensitive nodes in the control flow graph.

[0045] According to one embodiment of the present invention, obtaining the control flow graph of a program includes: obtaining the source code of the program and compiling the source code to obtain assembly program code; performing semantic parsing on the assembly instructions in the assembly program code to obtain the instruction type of the assembly instructions; generating a control flow graph based on the assembly instructions, determining the node type of each node in the control flow graph based on the instruction type, and determining sensitive nodes based on the node type, wherein the assembly instructions correspond one-to-one with each node in the control flow graph.

[0046] Specifically, because computers cannot directly recognize high-level programming languages, including C, C++, and Java, they need to be processed and converted into a language that the computer can understand. For example, Figure 2 As shown, the process begins by inputting the source code of the cryptographic algorithm program. Upon obtaining the source code file, a complete file with the extension .c is acquired. This file is then processed by the compiler, undergoing preprocessing, compilation, assembly, and linking operations to convert the .c file into a binary file with the extension .o. Next, the binary file is disassembled into assembly code, resulting in an assembly file. Then, semantic analysis is performed on the assembly instructions within the assembly file. Based on the results of this analysis, the instruction types of the assembly instructions are determined; for example, instruction types may include mov instructions, jump instructions, etc. The assembly instructions are then categorized, and the categorization results are marked with sensitive information. The execution order of the instructions is determined based on their priority, ultimately forming a directed acyclic graph (control flow graph) with sensitive information. Each node in this directed acyclic graph corresponds one-to-one with an assembly instruction, and the node type of each node is determined by the instruction type of the assembly statement. Nodes marked with sensitive information are considered sensitive nodes.

[0047] Therefore, assembly language instructions and node types are recorded in the control flow graph data structure. Each node in the control flow graph represents an assembly statement, and the instruction type of the assembly statement determines the node type, which includes general nodes and sensitive nodes. To reduce the time complexity of detection and speed up the execution time, it is not necessary to detect all nodes in the control flow graph during detection; only sensitive nodes need to be detected to efficiently determine whether there are problems such as cache leaks in the program. When detecting sensitive nodes, the marked sensitive nodes are first classified. Sensitive node types include memory access nodes and jump nodes. Memory access nodes can include general memory access nodes and intra-branch memory access nodes, and jump nodes can include branch jump nodes.

[0048] It's important to note that a Control Flow Graph (CF6), also called a control flow diagram, is an abstract representation of a process or program. It's an abstract data structure used in the compiler, maintained internally, and represents all paths traversed during program execution. It uses a graph to represent the possible flow of execution for all basic blocks within a process, reflecting the real-time execution process. The compiler can be either gcc or g++, and the disassembler can be objdump.

[0049] S2, obtain the corresponding leakage detection algorithm based on the node type of the sensitive node.

[0050] According to one embodiment of the present invention, obtaining a corresponding leakage detection algorithm based on the node type of the sensitive node includes: when the sensitive node is a memory access node, the leakage detection algorithm is a data flow leakage detection algorithm, wherein the memory access node includes general memory access nodes and intra-branch memory access nodes; when the sensitive node is a jump node, the leakage detection algorithm is a control flow leakage detection algorithm, wherein the jump node includes branch jump nodes.

[0051] Specifically, step S1 above yields the node types of sensitive nodes. Common node types include: memory access nodes (general memory access nodes and intra-branch memory access nodes), jump nodes, and general nodes. General nodes do not pose a cache leak risk, while memory access nodes may experience data flow leaks, and jump nodes may experience control flow leaks. Therefore, when a sensitive node is a memory access node, a data flow leak detection algorithm is used; when a sensitive node is a jump node, a control flow leak detection algorithm is used. Thus, by using appropriate leak detection algorithms for different sensitive nodes, it is not necessary to detect all nodes during the detection process, reducing the time complexity of the detection.

[0052] S3, determine whether there is a cache leak in the sensitive node based on the leak detection algorithm.

[0053] According to an embodiment of the present invention, when the leakage detection algorithm is a data flow leakage detection algorithm, determining whether a sensitive node has a cache leak according to the leakage detection algorithm includes: obtaining a first probability of a collision between the memory access node and its preceding and following nodes; and determining that the memory access node has a cache leak when the first probability satisfies a first preset leakage condition.

[0054] Specifically, for all memory access nodes, the data flow leak detection algorithm is invoked according to their execution order in the control flow graph. To reduce time complexity, the data flow leak detection algorithm calculates the probability of collisions between the sensitive memory access node and its preceding and following execution nodes within a small search window. After the search window is completed, information on whether the current node leaks is obtained. If the current memory access node has a cache leak, it is recorded in the detection report, and then the detection of the next node begins until all memory access nodes in the control flow graph have been detected. The detection report includes the leak location, leak amount, and leak type.

[0055] The following describes in detail how to obtain the first probability of a collision between a memory access node and its preceding and following nodes.

[0056] According to an embodiment of the present invention, obtaining a first probability of a collision between a memory access node and its preceding and following nodes includes: obtaining a pending collision probability between the memory access node and its preceding and following nodes; obtaining a first correlation between the access address of the memory access node and sensitive data in the cache; and determining the first probability based on the pending collision probability and the first correlation.

[0057] According to one embodiment of the present invention, obtaining the pending collision probability between a memory access node and its preceding and following nodes includes: obtaining the cache conflict situation between the access addresses of the memory access node, the cache collision situation between the memory access node and its preceding and following nodes, and the number of unique collisions between the memory access node and its preceding and following nodes; and determining the pending collision probability based on the cache conflict situation, the cache collision situation and the number of unique collisions.

[0058] Specifically, the cache collision situation between the memory access node and the nodes before and after it is obtained in the following way, where firstly, two instructions r are formalized. i and r j The cache collision situation is represented as Colli(r) i r j The result of two different instructions is either true or false. i and r j When the cache set and cache tag are both equal, Colli(r) i r j ) = true, when two different instructions r iand r j When either the cache set or the cache tag is not equal, Colli(r) i r j The cache set and cache tag are calculated as follows:

[0059] set(r i )=(σ i >>B)(2 s -1)

[0060] tag(r i )=σ i >>(B+S)

[0061] Where >> represents the logical right shift sign, and S = 2 s σ represents the number of cache sets in the cache. i Represents instruction r i The memory address being accessed, where B represents the size of the cache line.

[0062] Therefore, the result of a cache collision (cache collision situation) can be expressed by the following formula:

[0063]

[0064] When the calculation result is true, it indicates a cache hit, meaning that a cache collision will result in one cache hit.

[0065] The cache conflict situation between the access addresses of memory nodes is obtained in the following way, where when two instructions r i and r j When two instructions have the same cache set but different cache tags, a cache conflict will occur between the access addresses of the memory nodes. This cache conflict is denoted as Conflict(r). i r j The formula for representing cache conflicts is as follows:

[0066]

[0067] Cache conflicts occur because multiple addresses are mapped to the same local cache unit, leading to access conflicts and thus affecting the subsequent instruction r. j This will affect the order of content in the cache, which is determined by r. j The conflicting instruction is loaded, so a cache conflict will not result in a cache hit.

[0068] For the same instruction r iThere may be multiple conditions r that satisfy the execution path in the control flow graph. j The condition that causes cache conflicts between accessed memory nodes is determined by the following formula: UniqueConflic(r i r j The result represents two instructions r i r j Does the conflict repeat?

[0069] UniqueConflic(r i r j )=∧ i＜k＜j (set(r j ) = set(r k ))∧(tag(r j )≠tag(r k ))

[0070] The unique number of collisions between the accessed memory node and the preceding and following nodes is obtained using the following method: The unique number of collisions between the accessed memory node and the preceding and following nodes is determined based on the formulas for calculating cache collisions and whether cache collisions are duplicated. Let Cnf(r) be the number of collisions between the accessed memory node and the preceding and following nodes. i r j ) represents r i to r j The number of unique collisions on an instruction sequence is calculated using the following formula:

[0071]

[0072] Then, based on the cache conflict situation, cache collision situation, and the number of unique conflicts, the probability of a pending collision is determined. The collision probability calculation needs to determine the range of values ​​for the collision probability, not the specific value of the collision probability. This can be done using Collipr(r)... i r j The range of values ​​for the cache collision probability is represented by ), i.e., the first probability. The results have two output types, as follows:

[0073] Collipr(r i r j )∈{DET,UND}

[0074] Here, DET indicates that the probability of a collision is certain, and UND indicates that the probability of a collision is yet to be determined.

[0075] Assume Prco(r) i r j Let be the actual probability of a cache collision. When the probability of a cache collision is fixed, then we have Prco(r) i r j )=1∨Prco(r i rj ) = 0 and Collipr(r i r j ) = DET is an equivalence relation.

[0076] When the probability of a cache collision is pending, it includes the following three cases: First, instruction r i Two different addresses σ with cache collisions can be accessed. ia and σ ib First, when instruction access conflicts exist, the probability of a cache collision is undetermined; second, there exists a relationship with r. j Instruction r that causes a cache collision i In other words, when a cache collision occurs, the probability of the cache collision is undetermined; third, due to the limitations of cache associativity, r i When the loaded content is not replaced, meaning there is a fixed mapping between main memory and the cache set, and certain instructions point to content that will not be replaced, the probability of a cache collision is undetermined. The undetermined collision probability UND, which satisfies all three conditions simultaneously, is expressed by the following formula:

[0077]

[0078] Where, addr(r) i ) represents the instruction r i The access address of the memory node, Γ i For r k The execution path in the control flow graph. This represents the set-association number of the cache. When the probability of a cache collision is uncertain, the above expression is compared with Collipr(r i r j ) = UND is an equivalence relation.

[0079] When r i and r j The collision probability of two instructions is due to the two addresses σ ia and σ ib When the difference is disrupted, the attacker can obtain the difference as follows:

[0080]

[0081] in,

[0082]

[0083]

[0084] Among them, Timestamp(r i ) represents the instruction r i The end time of the instruction, Timestamp(r)j ) represents the instruction r j The instruction end time, SI (Sensitive Information) represents sensitive data. This represents the sampling difference between two time samples.

[0085] At this point, if r i If the accessed address depends on sensitive data in the cache, an attacker can exploit this leak to infer the value of the private key for the encryption algorithm on the target computer based on the time difference. Ultimately, the expression used by the data stream leak detection algorithm to detect data stream leaks (the first preset leak condition) is as follows:

[0086]

[0087] Among them, DFLEAK(r i ) represents the instruction r i Data stream leakage, Dep represents whether there is a correlation between two values, i.e., the first correlation, with results of true and false, m * This represents sensitive data in the cache.

[0088] If all sensitive nodes in the control flow graph satisfy the above formula after traversing all nodes, then that node will experience a data flow leak.

[0089] According to an embodiment of the present invention, when the leakage detection algorithm is a control flow leakage detection algorithm, determining whether a sensitive node has a cache leakage according to the leakage detection algorithm includes: obtaining a second probability of a cache collision between a jump node and the cache access nodes of its preceding and following branches; and determining that the jump node has a cache leakage when the second probability satisfies a second preset leakage condition.

[0090] According to one embodiment of the present invention, obtaining a second probability of a cache collision between a jump node and its preceding and following branch cache access nodes includes: obtaining the number of cache collisions between the jump node and its preceding and following branch cache access nodes; obtaining a second correlation between the access address of the jump node and sensitive data in the cache; and determining the second probability based on the number of cache collisions and the second correlation.

[0091] Specifically, based on the protection principle of CTP (Constant Time Programming), unbalanced branch hit times will lead to control flow leakage. The algorithm iterates through all sensitive nodes in the control flow graph, calling a control flow leakage detection algorithm on all branch jump nodes. This algorithm searches within two or more branches of each node in the control flow graph, calculating the probability of cache collisions between memory access nodes within those branches. If a leakage is found, it is recorded in a report, and the process continues until all nodes have been checked.

[0092] Specifically, any branch in a branching statement is denoted as branch p. Within p, the instruction r... j The number of cache collisions caused is denoted as Cnthit(p, r). j The calculation results are as follows:

[0093]

[0094] Among them, Colli(r i r j The method for obtaining the cache collision information is the same as that in the data flow leakage detection algorithm described above, and the method for obtaining the cache collision information is also the same, so it will not be repeated here. If the instruction r i The accessed address depends on sensitive data, allowing attackers to exploit control flow leaks. The final control flow leak detection algorithm uses the following expression (second preset leak condition) to detect control flow leaks:

[0095] CFLEAK(r b )=True≡Cnthit(p,r j )≠Cnthit(p, r j )∧Dep(addr(r b ), m * )

[0096] Among them, CFLEAK(r b ) represents the instruction r b Control flow leakage, Cnthit(p, r j ) indicates that in any branch p of a branch statement, the instruction r j The number of cache collisions caused, Dep(addr(r) b ), m * The ) indicates whether there is a correlation between two values, i.e., secondary correlation.

[0097] If a node satisfies the above formula after traversing all sensitive nodes in the control flow graph, then that node has a control flow leakage.

[0098] Furthermore, control flow graph-based detection methods can be easily extended to other types of leaks, such as branch prediction, giving the system good scalability. The following explanation uses branch prediction leaks as an example.

[0099] Specifically, branch prediction mechanisms predict the subsequent execution flow based on the latest branch history and execute the predicted branch instructions before the actual branch jump. This is widely used in modern processors to reduce latency caused by conditional branch instructions. If the processor makes a correct prediction, the prediction continues; if the processor makes an incorrect prediction, the execution of the prediction is abandoned to avoid erroneous program execution. There is a time difference between the processor's incorrect and correct predictions, which attackers may exploit to cause sensitive data leakage. Sensitive data is safe from branch prediction when the prediction time difference is small, i.e., when the following formula is satisfied:

[0100]

[0101] in, This represents the sampling difference between two time samples, when all possible values ​​can be obtained in the program. satisfy The target code is safe from branch prediction attacks.

[0102] Branch prediction adds a branch prediction path at each branch decision point compared to ordinary sequential execution, and requires the establishment of an expression for the branch prediction mechanism to judge sensitive nodes based on the branch prediction attack situation.

[0103] In summary, the program cache leak detection method of this invention can detect cache leak problems in programs, achieves cache leak detection with theoretical security and coverage of multiple leak types, and has good scalability.

[0104] The following is combined Figure 3 The detection method of the present invention will be described below.

[0105] As a specific example, after obtaining the control flow graph, the method for detecting program cache leaks according to the present invention may include the following steps:

[0106] S101, read cache configuration.

[0107] S102, enter the detection start point in the control flow graph.

[0108] S103, fetch the next instruction in the control flow graph.

[0109] S104. Determine if the node type is a sensitive node. If yes, proceed to step S105; otherwise, proceed to step S103.

[0110] S105, Determine if the node type is a memory access node. If yes, proceed to step S106; otherwise, proceed to step S107.

[0111] S106, invoke the data stream detection algorithm.

[0112] S107. Determine if the node type is a jump node. If yes, proceed to step S108; otherwise, proceed to step S103.

[0113] S108, invoke the control flow detection algorithm.

[0114] S109, the reporting module records the test results.

[0115] S110, determine if all nodes have been searched. If yes, proceed to step S111; otherwise, proceed to step S103.

[0116] S111, the detection is complete and the final detection result is output.

[0117] In summary, the method for detecting program cache leaks according to embodiments of the present invention first obtains the program's control flow graph and determines the node types of sensitive nodes in the control flow graph. Then, it obtains a corresponding leak detection algorithm based on the node types of the sensitive nodes. Finally, it determines whether a cache leak exists in the sensitive node based on the leak detection algorithm. Therefore, this method can effectively detect whether a cache leak exists in the program, ensuring the program's theoretical security and improving its scalability.

[0118] Corresponding to the above embodiments, the present invention also proposes a detection device for program cache leakage.

[0119] like Figure 4 As shown, the program cache leakage detection device of this embodiment includes: an acquisition module 10, an algorithm determination module 20, and a detection module 30.

[0120] The acquisition module 10 is used to acquire the program's control flow graph and determine the node types of sensitive nodes in the control flow graph. The algorithm determination module 20 is used to acquire the corresponding leak detection algorithm based on the node types of sensitive nodes. The detection module 30 is used to determine whether there is a cache leak in the sensitive node based on the leak detection algorithm.

[0121] According to one embodiment of the present invention, such as Figure 5As shown, the acquisition module 10 includes: a compilation processing unit 11, used to acquire the source code of the program and compile the source code to obtain assembly program code; an instruction parsing unit 12, used to perform semantic parsing on the assembly instructions in the assembly program code to obtain the instruction type of the assembly instructions; and a generation unit 13, used to generate a control flow graph based on the assembly instructions, determine the node type of each node in the control flow graph based on the instruction type, and determine sensitive nodes based on the node type, wherein the assembly instructions correspond one-to-one with each node in the control flow graph.

[0122] According to an embodiment of the present invention, the algorithm determination module 20 is further configured to: when the sensitive node is a memory access node, the leakage detection algorithm is a data flow leakage detection algorithm, wherein the memory access node includes general memory access nodes and intra-branch memory access nodes; when the sensitive node is a jump node, the leakage detection algorithm is a control flow leakage detection algorithm, wherein the jump node includes branch jump nodes.

[0123] According to an embodiment of the present invention, when the leakage detection algorithm is a data flow leakage detection algorithm, the detection module 30 is specifically used to: obtain the first probability of a collision between the memory access node and its preceding and following nodes; and determine that the memory access node has a cache leak when the first probability satisfies the first preset leakage condition.

[0124] According to an embodiment of the present invention, the detection module 30 is further configured to: obtain the pending collision probability between the memory access node and the preceding and following nodes; obtain the first correlation between the access address of the memory access node and the sensitive data in the cache; and determine the first probability based on the pending collision probability and the first correlation.

[0125] According to an embodiment of the present invention, the detection module 30 is further configured to acquire cache conflict status between access addresses of memory access nodes, cache collision status between memory access nodes and preceding and following nodes, and the number of unique collisions between memory access nodes and preceding and following nodes; and determine the probability of pending collisions based on cache conflict status, cache collision status and the number of unique collisions.

[0126] According to an embodiment of the present invention, when the leakage detection algorithm is a control flow leakage detection algorithm, the detection module 30 is specifically used to: obtain a second probability of a cache collision between the jump node and the cache access nodes of its preceding and following branches; and determine that the jump node has a cache leakage when the second probability satisfies a second preset leakage condition.

[0127] According to one embodiment of the present invention, the detection module 30 is further configured to: obtain the number of cache collisions between the jump node and the cache access nodes of the preceding and following branches; obtain the second correlation between the access address of the jump node and the sensitive data in the cache; and determine a second probability based on the number of cache collisions and the second correlation.

[0128] It should be noted that for details not disclosed in the program cache leakage detection device of this embodiment, please refer to the details disclosed in the program cache leakage detection method of this embodiment, which will not be repeated here.

[0129] According to an embodiment of the present invention, a program cache leak detection device acquires the control flow graph of the program and determines the node type of sensitive nodes in the control flow graph. An algorithm determination module acquires a corresponding leak detection algorithm based on the node type of the sensitive nodes. A detection module determines whether a cache leak exists in the sensitive nodes based on the leak detection algorithm. Therefore, this device can effectively detect whether a cache leak exists in the program, ensuring the theoretical security of the program and improving its scalability.

[0130] Corresponding to the above embodiments, the present invention also proposes a computer-readable storage medium.

[0131] The present invention provides a computer-readable storage medium storing a program cache leak detection program thereon, which, when executed by a processor, implements the above-described program cache leak detection method.

[0132] The computer-readable storage medium of the present invention, by executing the above-described method for detecting program cache leaks, can effectively detect whether there is a cache leak in a program, ensuring the theoretical security of the program and improving its scalability.

[0133] Corresponding to the above embodiments, the present invention also proposes a processor.

[0134] like Figure 6 As shown, the processor 100 of the present invention may include a program cache leak detection device 110.

[0135] The processor of the present invention, by including the above-described program cache leak detection device, can effectively detect whether there is a cache leak in the program, ensuring the theoretical security of the program and improving the program's scalability.

[0136] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0137] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0138] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0139] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0140] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0141] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for detecting program cache leaks, characterized in that, The method includes: Obtain the control flow graph of the program and determine the node type of the sensitive nodes in the control flow graph; Based on the node type of the sensitive node, a corresponding leakage detection algorithm is obtained, including: When the sensitive node is a memory access node, the leakage detection algorithm is a data flow leakage detection algorithm, wherein the memory access node includes general memory access nodes and intra-branch memory access nodes; Determining whether the sensitive node has a cache leak based on the leak detection algorithm includes: When the leakage detection algorithm is a data stream leakage detection algorithm, the pending collision probability between the memory access node and the preceding and following nodes is obtained; the first correlation between the access address of the memory access node and the sensitive data in the cache is obtained; the first probability is determined according to the pending collision probability and the first correlation; when the first probability is determined to satisfy the first preset leakage condition, it is determined that the memory access node has a cache leakage.

2. The method for detecting program cache leakage according to claim 1, characterized in that, The control flow graph of the acquisition program includes: Obtain the source code of the program and compile the source code to obtain assembly code; The instruction type of the assembly instructions is obtained by performing semantic parsing on the assembly instructions in the assembly program code; The control flow graph is generated according to the assembly instructions, and the node type of each node in the control flow graph is determined according to the instruction type, and the sensitive node is determined according to the node type, wherein the assembly instructions correspond one-to-one with each node in the control flow graph.

3. The method for detecting program cache leakage according to claim 1, characterized in that, The step of obtaining the corresponding leakage detection algorithm based on the node type of the sensitive node includes: When the sensitive node is a jump node, the leakage detection algorithm is a control flow leakage detection algorithm, wherein the jump node includes a branch jump node.

4. The method for detecting program cache leakage according to claim 1, characterized in that, The step of obtaining the undetermined collision probability between the memory access node and the preceding and following nodes includes: Obtain the cache conflict situation between the access addresses of the memory access node, the cache collision situation between the memory access node and the preceding and following nodes, and the number of unique conflicts between the memory access node and the preceding and following nodes; The probability of pending collision is determined based on the cache conflict situation, the cache collision situation, and the number of unique collisions.

5. The method for detecting program cache leakage according to claim 3, characterized in that, When the leakage detection algorithm is a control flow leakage detection algorithm, determining whether the sensitive node has a cache leak based on the leakage detection algorithm includes: Obtain the second probability of a cache collision between the jump node and the cache access nodes of its preceding and following branches; When the second probability is determined to satisfy the second preset leakage condition, it is determined that the jump node has a cache leak.

6. The method for detecting program cache leakage according to claim 5, characterized in that, The step of obtaining the second probability of a cache collision between the jump node and the cache access nodes of its preceding and following branches includes: Obtain the number of cache collisions between the jump node and the cache access nodes of the preceding and following branches; Obtain the second correlation between the access address of the jump node and the sensitive data in the cache; The second probability is determined based on the number of cache collisions and the second correlation.

7. A device for detecting program cache leaks, characterized in that, The device includes: The acquisition module is used to acquire the control flow graph of the program and determine the node type of sensitive nodes in the control flow graph; The algorithm determination module is used to obtain the corresponding leakage detection algorithm based on the node type of the sensitive node, including: When the sensitive node is a memory access node, the leakage detection algorithm is a data flow leakage detection algorithm, wherein the memory access node includes general memory access nodes and intra-branch memory access nodes; The detection module is used to determine whether the sensitive node has a cache leak based on the leak detection algorithm, including: When the leakage detection algorithm is a data stream leakage detection algorithm, the pending collision probability between the memory access node and the preceding and following nodes is obtained; the first correlation between the access address of the memory access node and the sensitive data in the cache is obtained; the first probability is determined according to the pending collision probability and the first correlation; when the first probability is determined to satisfy the first preset leakage condition, it is determined that the memory access node has a cache leakage.

8. The detection device for program cache leakage according to claim 7, characterized in that, The acquisition module includes: The compilation processing unit is used to obtain the source code of the program and compile the source code to obtain assembly program code; The instruction parsing unit is used to perform semantic parsing on the assembly instructions in the assembly program code to obtain the instruction type of the assembly instructions; The generation unit is configured to generate the control flow graph according to the assembly instructions, determine the node type of each node in the control flow graph according to the instruction type, and determine the sensitive node according to the node type, wherein the assembly instructions correspond one-to-one with each node in the control flow graph.

9. The detection device for program cache leakage according to claim 7, characterized in that, When the sensitive node is a jump node, the leakage detection algorithm is a control flow leakage detection algorithm, wherein the jump node includes a branch jump node.

10. The detection device for program cache leakage according to claim 7, characterized in that, The detection module is used for: Obtain the cache conflict situation between the access addresses of the memory access node, the cache collision situation between the memory access node and the preceding and following nodes, and the number of unique conflicts between the memory access node and the preceding and following nodes; The probability of pending collision is determined based on the cache conflict situation, the cache collision situation, and the number of unique collisions.

11. The detection device for program cache leakage according to claim 9, characterized in that, When the leakage detection algorithm is a control flow leakage detection algorithm, the detection module is used for: Obtain the second probability of a cache collision between the jump node and the cache access nodes of its preceding and following branches; When the second probability is determined to satisfy the second preset leakage condition, it is determined that the jump node has a cache leak.

12. The detection device for program cache leakage according to claim 11, characterized in that, The detection module is used for: Obtain the number of cache collisions between the jump node and the cache access nodes of the preceding and following branches; Obtain the second correlation between the access address of the jump node and the sensitive data in the cache; The second probability is determined based on the number of cache collisions and the second correlation.

13. A computer-readable storage medium, characterized in that, It stores a program cache leak detection program, which, when executed by the processor, implements the program cache leak detection method according to any one of claims 1-6.

14. A processor, characterized in that, Includes a detection device for program cache leakage according to any one of claims 7-12.

Images