Device safety detection method, device, computer device and readable storage medium

Abstract

The present invention provides a device security detection method, apparatus, computer equipment and readable storage medium. The method comprises: obtaining a front-end file and a back-end program in the device firmware; extracting a string used to mark user input data in the front-end file to obtain a string set; matching the back-end program with a string in the string set; determining a taint introduction point according to the matched string; taking the taint introduction point as the analysis starting point, performing taint analysis on the back-end program to detect whether there is a security vulnerability in the device firmware. The present invention can improve the accuracy of security detection of IoT devices.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and in particular to a device security detection method, device, computer device and readable storage medium. Background Art

[0002] The Internet of Things is a network of physical objects embedded with sensors, software, and other technologies that allow these devices to connect and exchange data with other devices and systems. IoT devices are the same physical objects, specifically any independent device that can be controlled from a remote location. There are many types of IoT devices, ranging from ordinary household items to complex industrial tools, such as webcams and wireless routers.

[0003] The Internet of Things has developed rapidly in recent years. Driven by cutting-edge IT technologies such as AI, cloud computing, and 5G, various forms of IoT devices have emerged one after another. The embedded systems that carry IoT applications are severely fragmented, resulting in a lack of unified security application standards and various security issues. The current IoT device security vulnerability analysis technology is difficult to perform unified and efficient security detection on various devices due to the diversity of device types and the diversity of the underlying CPU architecture of the device.

[0004] There are three types of security detection methods in the prior art. The first type is a manual method that relies on professionals to audit binary programs. Therefore, it is impossible to perform systematic detection on a large number of IoT devices and is inefficient. The second type is a dynamic fuzzy testing method that simulates the process and results of one or more executions of a device program, analyzes the properties of the code in terms of time, performance, etc., requires hardware support or simulates various types of hardware interrupts, and is limited by the availability of device firmware behavior simulation technology, which greatly limits the feasibility of the testing method. The third type is a static analysis method, which specifically refers to a code analysis technology that scans binary programs or codes without running device programs to verify whether the code meets indicators such as standardization, security, and reliability. It starts from the security analysis of the firmware, is free from the limitations of terminal physical devices, and can quickly complete large-scale security tests. This type of method solves the problems of the first and second types of detection methods mentioned above.

[0005] However, the inventors found that: for static analysis methods represented by the research based on the Angr symbolic execution framework, by converting the binary program after firmware decompression into an intermediate language, in order to track the changes in variables and path execution conditions when simulating program execution, the propagation path of external input tainted variables within the system is obtained, and the program input conditions that trigger security vulnerabilities are obtained. However, it lacks the exact execution status of the program, the accuracy of the data flow analysis results is reduced, and there are many false positives and false negatives.

[0006] Karonte built a communication model between multiple modules of an embedded system through static analysis methods and applied it to security vulnerability mining, achieving certain results. However, due to the lack of contextual semantic information in program execution, it resulted in a high false negative rate.

[0007] In summary, the current static detection method usually contains a large number of false positives and missed negatives in its detection results, and its accuracy needs to be improved. Therefore, how to improve the accuracy of IoT device security detection has become a technical problem that needs to be solved urgently in this field. Summary of the invention

[0008] The purpose of the present invention is to provide a device security detection method, device, computer device and readable storage medium to solve the above-mentioned technical problems in the prior art.

[0009] On the one hand, to achieve the above-mentioned purpose, the present invention provides a device safety detection method.

[0010] The security detection method comprises: obtaining a front-end file and a back-end program in a device firmware; extracting a character string used for marking user input data in the front-end file to obtain a character string set; matching the back-end program with a character string in the character string set; determining a taint introduction point according to the matched character string; and performing a taint analysis on the back-end program with the taint introduction point as an analysis starting point to detect whether the device firmware has a security vulnerability.

[0011] Furthermore, the step of extracting the character string used to mark the user input data in the front-end file to obtain the character string set includes: extracting the API interface name and parameter name in the front-end file.

[0012] Furthermore, the step of determining the taint introduction point based on the matched character strings includes: determining whether the backend program is a boundary program according to the number of matched character strings, wherein the greater the number of matched character strings, the greater the probability that the backend program is determined to be a boundary program; and determining the taint introduction point based on the matched character strings in the boundary program.

[0013] Furthermore, taking the taint introduction point as the analysis starting point, performing taint analysis on the backend program to detect whether there is a security vulnerability in the device firmware includes: taking the taint introduction point as the analysis starting point, performing taint analysis only on the boundary program to detect whether there is a security vulnerability in the device firmware.

[0014] Furthermore, the front-end file includes an HTML file, a JS file and / or an XML file, and the step of extracting the API interface name and parameter name in the front-end file includes: using a regular expression to match the values ​​of the "action" attribute, the "name" attribute and the "id" attribute of each tag in the HTML file; parsing the JS file into an abstract syntax tree, traversing the abstract syntax tree, obtaining a subtree with a type attribute of Literal, and extracting the subtree attributes of "name" containing " / ", "value" containing " / ", "name" and "value"; parsing the XML file to extract the first-level tag under the Body node and the node tag under the first-level tag.

[0015] Furthermore, after extracting the string used to mark user input data from the front-end file and obtaining the string set, and before matching the back-end program with the strings in the string set, the device security detection method also includes: removing parameter names in the string set whose length is less than p or greater than q, q is greater than p, and q and p are both natural numbers; removing parameter names in the string set that appear in n or more different front-end files, n is a natural number; removing parameter names containing special characters in the string set; removing API interface names in the string set whose length is less than or equal to m, m is a natural number; removing API interface names in the string set that contain special characters other than " / " and / or "?"; removing API interface names in the string set that do not contain the " / " character; and / or removing characters after the "?" character in the API interface name.

[0016] Furthermore, the step of determining the taint introduction point according to the matched character string includes: determining the position of the instruction referenced by the matched character string in the backend program to obtain a direct reference point; and using the direct reference point as the taint introduction point.

[0017] Furthermore, the device firmware includes multiple backend programs, and the step of determining the taint introduction point based on the matched string also includes: judging whether the data content of the direct reference point in the backend program is passed to the variable of the first set function of the operating disk; if the data content of the direct reference point is passed to the variable of the first set function, searching the multiple backend programs for the first get function of the operating disk corresponding to the first set function; determining the variable assignment position of the first get function to obtain the cross-process reference point; and using the cross-process reference point as the taint introduction point.

[0018] Furthermore, the direct reference point is used to pass the string as a parameter to the using function, and the step of determining the taint introduction point based on the matched string also includes: traversing the function call points of the using function in the back-end program; searching for the parameter passing position of the string parameter of the function call point to obtain an indirect reference point; and using the indirect reference point as the taint introduction point.

[0019] Furthermore, the device firmware includes multiple back-end programs, and the step of determining the taint introduction point based on the matched string also includes: judging whether the data content of the indirect reference point in the back-end program is passed to the variable of the second set function of the operating disk; if the data content of the indirect reference point is passed to the variable of the second set function, searching the multiple back-end programs for the second get function of the operating disk corresponding to the second set function; determining the variable assignment position of the second get function to obtain the cross-process reference point; and using the cross-process reference point as the taint introduction point.

[0020] Furthermore, taking the taint introduction point as the analysis starting point, performing taint analysis on the backend program to detect whether there is a security vulnerability in the device firmware includes: taking the taint introduction point as the root node, extracting the sub-function call tree of the function at the taint introduction point, wherein, in the sub-function call tree, the call instruction in the backend program is used as the edge connecting the parent and child nodes, and the preset target function is used as the leaf node; performing taint execution on the backend program according to the sub-function call tree, wherein the taint execution strategy includes: judging whether the current sub-function is on the sub-function call tree, if it exists, directly following up the execution, if not, judging whether the parameters of the current sub-function are contaminated by taint diffusion, if the parameters of the current sub-function are not contaminated, skipping the execution of the current sub-function without processing, if the parameters of the current sub-function are contaminated, then when the parameters of the current sub-function have a return value, the taint is diffused to the return value, and when the parameters of the current sub-function have a return value, the taint is diffused to the return value, and when the parameters of the current sub-function have a return value, the taint is diffused to the return value. When the parameter has no return value, the taint is spread to other writable address parameters of the current sub-function; when the taint is executed to the preset target function, whether the device firmware has a security vulnerability is determined according to whether the parameters of the preset target function are contaminated, wherein the step of determining whether the device firmware has a security vulnerability according to whether the parameters of the preset target function are contaminated specifically includes: when the preset target function is a function that can cause a buffer overflow, determining whether the length parameter of the preset target function is contaminated, if the length parameter does not exist, determining whether the data source of the preset target function is contaminated, wherein when the length parameter is contaminated, or the data source of the preset target function is contaminated, it is determined that the device firmware has a security vulnerability; when the preset target function is a function that can cause command injection, determining whether there is contaminated byte content in the call parameters of the preset target function, if there is contaminated byte content in the call parameters, it is determined that the device firmware has a security vulnerability.

[0021] On the other hand, to achieve the above-mentioned purpose, the present invention provides an equipment safety detection device.

[0022] The device security detection device includes: an acquisition module, which is used to acquire the front-end file and back-end program in the device firmware; an extraction module, which is used to extract the character string used to mark the user input data in the front-end file to obtain a character string set; a matching module, which is used to match the back-end program with the character string in the character string set; a determination module, which is used to determine the taint introduction point according to the matched character string; and an analysis module, which is used to perform taint analysis on the back-end program with the taint introduction point as the analysis starting point, so as to detect whether there is a security vulnerability in the device firmware.

[0023] To achieve the above objectives, the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0024] To achieve the above object, the present invention also provides a computer-readable storage medium on which a computer program is stored, and the computer program implements the steps of the above method when executed by a processor.

[0025] The device security detection method, device, computer device and readable storage medium provided by the present invention obtain the front-end file and back-end program in the device firmware, extract the character string used to mark the user input data in the front-end file to obtain a character string set, and then match the character string in the character string set with the back-end program, determine the back-end program taint introduction point through the matched character string, and finally use the taint introduction point as the analysis starting point to perform taint analysis on the back-end program to detect whether there is a security vulnerability in the device firmware. Through the present invention, the character string marking the external user input data is determined based on the front-end file, and then this type of character string is matched in the back-end program. According to the matched character string, the external user input is accurately located in the back-end program, that is, the position of the taint introduction point during the taint analysis, so that the taint analysis can be performed quickly and accurately, the firmware security vulnerability is detected, and the accuracy of vulnerability mining is effectively improved. At the same time, the taint analysis process can also be shortened, and the vulnerability mining efficiency can be improved.

[0026] Furthermore, the device security detection method, apparatus, computer equipment and readable storage medium provided by the embodiments of the present invention also have the following technical effects: it is capable of identifying the character strings used to mark user input in various back-end programs in the firmware, and thus can accurately locate the parsing position of the user input data in the network service back-end program; based on the identified taint introduction point, taint analysis can automatically detect the program path that may be affected by external input, and analyze the possible harm, which can effectively shorten the taint analysis process, optimize the path convenience process of symbolic execution, and improve the efficiency and accuracy of vulnerability mining for IoT device firmware. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0028] Figure 1 A flowchart of a device security detection method provided in Embodiment 1 of the present invention;

[0029] Figure 2A block diagram of a device safety detection device provided in Embodiment 2 of the present invention;

[0030] Figure 3 This is a hardware structure diagram of a computer device provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical scheme and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0032] In order to improve the accuracy of IoT device security detection, the inventor studied the device security detection method in the prior art and found that the reasons for the high missed alarm rate and false alarm rate of device security analysis include: the inability to quickly and effectively identify the code fragments related to the user-controllable input during the program analysis process. Based on this, the present invention provides a device security detection method, device, computer device and readable storage medium. In the device security detection method provided by the present invention, the front-end file and back-end program in the device firmware are first obtained, and the string used to mark the user input data in the front-end file is extracted to obtain a string set, that is, the semantics of the external user input is obtained through the front-end file, and then the back-end program is matched with the string in the string set, and the taint introduction point is determined according to the matched string, and the taint introduction point is used as the analysis starting point to perform taint analysis on the back-end program to detect whether there is a security vulnerability in the device firmware, so that in the static analysis process of the back-end program, the external user input, that is, the position of the taint introduction point, is accurately located, effectively improving the accuracy of vulnerability mining, and at the same time, it can also shorten the taint analysis process and improve the efficiency of vulnerability mining.

[0033] Specific embodiments of the device security detection method, apparatus, computer device, and readable storage medium provided by the present invention will be described in detail below.

[0034] Embodiment 1

[0035] The embodiment of the present invention provides a device security detection method, which uses front-end files and back-end programs to determine the taint introduction point in the static analysis process of the back-end program. Through this method, the accuracy and efficiency of vulnerability mining can be improved. Specifically, Figure 1 This is a flow chart of a device security detection method provided in Embodiment 1 of the present invention, such as Figure 1 As shown, the device safety detection method provided in this embodiment includes the following steps S101 to S105.

[0036] Step S101: Obtain the front-end files and back-end programs in the device firmware.

[0037] Firmware is the core component of IoT devices, containing all kinds of information and programs such as the operating system, protocol stack, configuration files, executable scripts and application components that the device runs. Before the IoT device is connected to the network and used, users can conduct security checks on the device firmware, discover security vulnerabilities and take corresponding precautions, which can significantly reduce the possibility of the device being hacked during operation.

[0038] Firmware usually supports more than one network service, and network services require the cooperation of front-end and back-end files to provide user configuration or communication services between devices. Front-end files mainly include resource files such as HTML, XML, JavaScript, PHP, etc., and back-end files mainly include various executable programs and function link libraries. The front-end file is mainly responsible for receiving user input and composing the input into network data packets to the back-end. The back-end program is usually a resident process, which parses and processes user input by listening to and receiving data packets transmitted by the front-end.

[0039] IoT devices can perform security testing based on firmware. Through functions such as firmware metadata extraction, firmware automatic decompression, firmware file security analysis, and component vulnerability correlation analysis, security vulnerabilities and hidden dangers in the firmware at the file, component, and function levels can be discovered.

[0040] In step S101, the file system of the firmware can be obtained by decompressing the firmware of the IoT device, and the files can be obtained by scanning the decompressed file system, and the files can be classified to obtain the front-end files and the back-end programs.

[0041] Step S102: extracting the character string used to mark the user input data in the front-end file to obtain a character string set.

[0042] As a resource file, the front-end file can reflect semantic expression. Therefore, in step S102, different extraction strategies can be adopted for different types of front-end files based on the semantic rules of different types of front-end files. Strings are extracted through automatic extraction methods, such as regular expression extraction methods, and the strings used to mark user input data in the front-end files are extracted to form a string set.

[0043] Among them, optionally, in one embodiment, the step of extracting the string used to mark the user input data in the front-end file and obtaining the string set includes: extracting the API interface name and parameter name in the front-end file, wherein the parameter name refers to the name of the parameter corresponding to the request of the API interface, the API interface name can mark the position where the tainted interface function is introduced, and the parameter name can mark the position where the tainted parameter is introduced. Therefore, by extracting the API interface name and parameter name, the string used to mark the user input data can be accurately obtained.

[0044] Step S103: Match the backend program with the character string in the character string set.

[0045] Through the above step S102, a character string set consisting of character strings marking user input data is obtained. In this step S103, the character strings in the character string set are matched with the backend program.

[0046] Optionally, the backend program is a binary program. When matching the backend program with a string, the string is converted into a binary sequence and then matched with the binary program. One backend program can match several strings.

[0047] Step S104: Determine the stain introduction point according to the matched character string.

[0048] Specifically, when determining the taint introduction point according to the matched character string, the reference position of the matched character string in the backend program or a related file of the reference position can be used as the taint introduction point.

[0049] Step S105: Taking the taint introduction point as the analysis starting point, taint analysis is performed on the backend program to detect whether there is a security vulnerability in the device firmware.

[0050] Taint analysis is a data flow analysis method that can be abstracted into a triple<sources,sinks,sanitizers> In the form of, sources are the taint introduction points, which directly introduce untrusted data or confidential data into the system; sinks are the taint convergence points, which directly generate security-sensitive operations or leak private data to the outside world; sanitizers represent data encryption or removal operations that prevent data transmission from posing a threat to the information security of the software system. Taint analysis is to analyze whether the data introduced by the taint introduction points in the program can be directly transmitted to the taint convergence points without undergoing harmless processing. If not, it means that the data transmission is safe; if so, it means that the data flow transmission and processing process has caused problems such as private data leakage or dangerous operations.

[0051] Therefore, when performing taint analysis on the backend program, the taint introduction point must first be determined. In this embodiment, the character string matched by the backend program is a character string marking the user input data, so the taint introduction point is determined based on the matched character string, and then the taint introduction point is used as the analysis starting point. When performing taint analysis on the backend program, that is, the position of the user input data and the related position of the user input data are used as the analysis starting point for taint analysis, which can quickly and accurately locate the position of the external user input.

[0052] In the device security detection method provided in this embodiment, the front-end file and the back-end program in the device firmware are obtained, and the string used to mark the user input data is extracted from the front-end file to obtain a string set, and then the string in the string set is matched with the back-end program, and the back-end program taint introduction point is determined by the matched string. Finally, the back-end program is subjected to taint analysis with the taint introduction point as the analysis starting point to detect whether there is a security vulnerability in the device firmware. The device security detection method provided in this embodiment is adopted to determine the string marking the external user input data based on the front-end file, and then match this type of string in the back-end program. According to the matched string, the external user input is accurately located in the back-end program, that is, the position of the taint introduction point during the taint analysis, so that the taint analysis can be performed quickly and accurately, the firmware security vulnerability can be detected, and the accuracy of vulnerability mining can be effectively improved. At the same time, the taint analysis process can also be shortened, and the vulnerability mining efficiency can be improved.

[0053] Optionally, in one embodiment, the step of determining the taint introduction point based on the matched strings includes: determining whether the backend program is a boundary program according to the number of matched strings, wherein the greater the number of matched strings, the greater the probability that the backend program is determined to be a boundary program; and determining the taint introduction point based on the matched strings in the boundary program.

[0054] Specifically, decompressing the firmware can obtain multiple backend programs. When determining the taint introduction point based on the matched strings, the boundary program is first determined based on the number of strings matched by each backend program, and then the taint introduction point is determined based on the strings matched in the boundary program. The boundary program refers to the backend program used in the firmware for receiving, processing and distributing user input. When determining the boundary program, the greater the number of strings matched by a backend program, the greater the probability that it is determined as a boundary program. For example, the backend programs can be sorted according to the number of matched strings, and the first N backend programs are taken as boundary programs, where N is a natural number greater than 1; for another example, a string number threshold can be set. When the number of strings matched by the backend program is greater than the string number threshold, the backend program is determined to be a boundary program, where the string number threshold can be determined based on the actual analysis performance test.

[0055] The device security detection method provided in this embodiment is used to first determine the boundary program in the back-end program based on the number of matched strings, and then determine the taint introduction point based on the strings included in the boundary program. This can further reduce the number of taint introduction points on the basis of being able to accurately locate the external user input position, reduce redundant analysis, improve the execution efficiency of taint analysis, and improve the efficiency of device security detection.

[0056] Optionally, in one embodiment, taking the taint introduction point as the analysis starting point, performing taint analysis on the backend program to detect whether there is a security vulnerability in the device firmware includes: taking the taint introduction point as the analysis starting point, performing taint analysis only on the boundary program to detect whether there is a security vulnerability in the device firmware.

[0057] Specifically, in this embodiment, taint analysis is not performed on all backend programs, but only on boundary programs. The boundary program is a backend program in the firmware used to receive, process user input and distribute tasks. It is the main program for tainted data transmission. Analyzing only the boundary program can reduce the number of taint analysis programs, further reduce redundant analysis, improve the execution efficiency of taint analysis, and improve the efficiency of device security detection.

[0058] Optionally, in one embodiment, the front-end file includes an HTML file, a JS file and / or an XML file, and the step of extracting the API interface name and parameter name in the front-end file includes: using a regular expression to match the values ​​of the "action" attribute, the "name" attribute and the "id" attribute of each tag in the HTML file; parsing the JS file into an abstract syntax tree, traversing the abstract syntax tree, obtaining a subtree with a type attribute of Literal, and extracting the subtree attributes of "name" containing " / ", "value" containing " / ", "name" and "value"; parsing the XML file to extract the first-level tag under the Body node and the node label of the first-level tag.

[0059] Specifically, by using regular expressions to match the values ​​of the "action" attributes of each tag in the HTML file, the API interface name in the HTML file can be obtained. By using regular expressions to match the values ​​of the "name" attributes and "id" attributes of each tag in the HTML file, the parameter name in the HTML file can be obtained.

[0060] JS file, also known as Javascript file, can be parsed into an abstract syntax tree according to any method in the prior art, and then the abstract syntax tree is traversed to obtain a subtree with a type attribute of Literal, that is, type = "Literal", and finally the values ​​of the subtree attributes "name" and "value" containing " / " are extracted to obtain the API interface name in the JS file, and the values ​​of "name" and "value" are extracted to obtain the parameter name in the JS file.

[0061] For XML files, the first-level tag extracted from the Body node is the API interface name. Based on the extracted API interface name, the lower-level node tags of the first-level tag, that is, the lower-level node tags of the API interface node, are all relevant parameters of the request. Among them, XML files include template files used when transmitting data in the HNAP protocol and UPNP protocol.

[0062] Optionally, in one embodiment, after extracting the string used to mark user input data from the front-end file and obtaining the string set, before matching the back-end program with the string in the string set, the device security detection method also includes: removing parameter names in the string set whose length is less than p or greater than q, where q is greater than p, and p and q are both natural numbers; removing parameter names in the string set that appear in n or more different front-end files, where n is a natural number; removing parameter names containing special characters in the string set; removing API interface names in the string set whose length is less than or equal to m, where m is a natural number; removing API interface names in the string set that contain special characters other than “ / ” and / or “?”; removing API interface names in the string set that do not contain the “ / ” character; and / or removing characters after the “?” character in the API interface name.

[0063] Specifically, in this embodiment, after extracting the corresponding strings in the front-end file to form a string set, before using the strings in the string set to match the back-end program, the string set is first filtered to filter out invalid strings, thereby improving the effectiveness of the string set. Specifically, different filtering methods are used for API interface names and parameter names.

[0064] For the API interface name, strings with a length less than or equal to m (where m is a natural number) are removed, that is, strings with a length greater than m are retained. For example, when m = 5, strings with 5 < len(str) are retained as the API interface name. The inventors found through research that the length usually exceeds a certain value. Therefore, strings with too small a length are removed from the string set as invalid API interface names; strings that contain other special characters in addition to " / " and / or "?" are removed; strings that do not contain the " / " character are removed, that is, the API interface name must include the " / " character. The inventors found through research that the API interface name usually includes " / ". Therefore, strings that do not contain " / " are removed from the string set as invalid API interface names. For strings that contain the "?" character, the characters before the "?" character are retained, and the characters after the "?" character are removed.

[0065] For the parameter name, when filtering from the perspective of character length, parameters that are too long or too short are filtered out. Parameter names with a length less than p or greater than q in the string set are removed, that is, characters with a length greater than or equal to p and less than or equal to q are retained. For example, characters with a length greater than or equal to 5 and less than or equal to 25 are retained, 5 <= len(str) <= 25. The inventors found through research that when a parameter name appears in multiple front-end files, it actually does not belong to the string that marks user input. Therefore, parameter names that appear in n or more different front-end files in the string set are removed. For example, if a parameter name appears in 10 different files, it is removed. In addition, conventional parameter names do not include special characters. Therefore, parameter names that contain special characters in the string set are removed.

[0066] When determining the taint introduction point based on the matched string, one or more of the following methods can be used for determination, and the specific descriptions of the various methods are as follows.

[0067] Optionally, in one embodiment, the steps for determining the taint introduction point based on the matched string include: determining the position of the instruction that references the matched string in the backend program to obtain the direct reference point; using the direct reference point as the taint introduction point.

[0068] Specifically, after the backend program matches a string in the string set, it further determines the address position of the instruction that references the string in the backend program, which is defined as the direct reference point, so as to use this direct reference point as the entry position for subsequent taint analysis.

[0069] Optionally, in one embodiment, the direct reference point is used to pass a string as a parameter to the using function, and the step of determining the taint introduction point based on the matched string also includes: traversing the function call points of the using function in the backend program; searching for the parameter passing position of the string parameter of the function call point to obtain an indirect reference point; and using the indirect reference point as the taint introduction point.

[0070] Specifically, according to the usage functions corresponding to the strings located by the direct reference points, all the call locations of these usage functions are traversed in the backend program to find the parameter passing locations (instruction addresses) of the string parameters of these function call points as indirect reference points, so as to use the indirect reference points as the entry locations for subsequent taint analysis. Further optionally, after obtaining the aforementioned parameter passing locations, they are compared with the direct reference points, and only the addresses that do not appear in the direct reference points are used as indirect reference points to reduce redundant analysis.

[0071] Optionally, in one embodiment, the device firmware includes multiple backend programs, and when determining the taint introduction point based on the matched string, the cross-process reference point is further determined based on the above direct reference point or indirect reference point. Specifically, it is determined whether the data content of the direct reference point (or indirect reference point) in the backend program is passed to the variable of the set function of the operating disk; if the data content of the direct reference point (or indirect reference point) is passed to the variable of the set function, then the get function of the operating disk corresponding to the set function is searched in multiple backend programs; the variable assignment position of the get function is determined to obtain the cross-process reference point; and the cross-process reference point is used as the taint introduction point.

[0072] Specifically, some user data will be transferred between different processes after entering the processing and parsing flow of the backend program. Therefore, when performing backend program analysis, the difficulty of subsequent analysis will be increased. In order to simplify the difficulty of analyzing such data flows, the embodiment can realize the recovery of cross-process data transfer relations to quickly realize data flow analysis. After obtaining the above-mentioned direct reference point (or indirect reference point), a data flow analysis is performed on the data content at the position of the direct reference point (or indirect reference point) to determine whether this part of the data will pass the data content to the set function of the operating disk in subsequent processing, and write this data content to the system or file through the set function. If there is such a function to operate the data content, then the get function corresponding to the set function is searched in each acquired backend program. After finding it, the variable assignment position of the get function is determined as a cross-process reference point, so that this point is used as the entry position for subsequent taint analysis.

[0073] For example, after obtaining the direct reference point (or indirect reference point), determine whether the data content at the position of the direct reference point (or indirect reference point) is passed to the variable pcVar1 similar to nvram_safe_set("url_filter_mode",pcVar1). If the condition is met, search for the corresponding function similar to s1=(char*)nvram_safe_get("url_filter_mode") in the current backend program and other backend programs. Through the characteristics of these two types of functions and the consistency of the strings in the reference parameters of these two types of functions, the relationship between the two can be established, and the assignment position of the variable s1 here can be used as a cross-process reference point, as a new type of data flow analysis entry.

[0074] Optionally, in one embodiment, taking the taint introduction point as the analysis starting point, performing taint analysis on the backend program to detect whether there is a security vulnerability in the device firmware includes: taking the taint introduction point as the root node, extracting the sub-function call tree of the function at the taint introduction point, wherein, in the sub-function call tree, the call instruction in the backend program is used as the edge connecting the parent and child nodes, and the preset target function is used as the leaf node; tainting the backend program according to the sub-function call tree; when the taint is executed to the preset target function, determining whether there is a security vulnerability in the device firmware based on whether the parameters of the preset target function are contaminated.

[0075] Furthermore, when the backend program is taintedly executed according to the sub-function call tree, the tainted execution strategy includes: determining whether the current sub-function is on the sub-function call tree; if so, directly following up the execution; if not, determining whether the parameters of the current sub-function are contaminated by taint diffusion; if the parameters of the current sub-function are not contaminated, skipping the current sub-function execution without processing; if the parameters of the current sub-function are contaminated, then when the parameters of the current sub-function have a return value, diffusing the taint to the return value; and when the parameters of the current sub-function do not have a return value, diffusing the taint to other writable address parameters of the current sub-function.

[0076] Furthermore, the step of determining whether there is a security vulnerability in the device firmware based on whether the parameters of the preset target function are contaminated specifically includes: when the preset target function is a function that can cause a buffer overflow, determining whether a length parameter of the preset target function is contaminated; if the length parameter does not exist, determining whether a data source of the preset target function is contaminated; wherein, when the length parameter is contaminated, or the data source of the preset target function is contaminated, determining that there is a security vulnerability in the device firmware; when the preset target function is a function that can cause a command injection, determining whether there is contaminated byte content in the calling parameters of the preset target function; if there is contaminated byte content in the calling parameters, determining that there is a security vulnerability in the device firmware.

[0077] Specifically, after obtaining all the backend programs and taint introduction points to be analyzed, for each taint introduction point, the address is used as the root node to extract the sub-function call tree (call trace) of the current function. The sub-function call tree uses the call instruction in the backend program as the edge construction condition connecting the parent and child nodes, and the pre-defined target function as the leaf node, for example, the dangerous function that may cause buffer overflow and command injection is used as the target function. For the sub-function that cannot ultimately call the target function, the node and the sub-tree are directly removed from the function call tree.

[0078] Among them, the hazard functions mainly include the following two categories:

[0079] 1) Dangerous functions that may cause buffer overflows include various dangerous functions like memcpy that may cause overflows due to defects in input length restrictions; they also include dangerous functions like strcpy or sprintf with %s parameters that do not limit the input length and may cause potential memory corruption.

[0080] 2) Dangerous functions that may cause command injection include system, popen, and doSystemCmd, which are unique to some embedded environments.

[0081] When constructing the sub-function call tree, we perform angr-based directional symbolic execution: we use the function that is cross-referenced by the string as the taint introduction point for taint execution. When we encounter a sub-function introduced by the call instruction, we determine whether to follow up the execution based on the execution strategy, and finally execute it to the target function. We formulate a corresponding taint judgment strategy for the target function, and output relevant alarm prompts when several parameters of the target function meet the conditions for being tainted.

[0082] The taint execution strategy for sub-functions mentioned above is specifically as follows: first determine whether the sub-function to be called is on the extracted function call tree. If so, directly follow up the execution to ensure that the symbolic execution can eventually execute the target function; if not, execute the following taint diffusion strategy: if the parameters of the function are not contaminated by taint diffusion, skip the sub-function execution without processing; if a parameter is contaminated, decide whether to diffuse the taint directly to the return value or to other writable address parameters of the function based on whether the sub-function has a return value.

[0083] For dangerous functions that may cause buffer overflow, when taint analysis is executed on such functions, it is usually determined whether the length parameter of the function is contaminated. When the length parameter does not exist, it is determined whether the data source is contaminated to determine whether a buffer overflow vulnerability may be caused.

[0084] For dangerous functions that may cause command injection, when taint analysis is executed on such functions, it is usually determined whether each byte in the function's call parameter is contaminated. If there are contaminated bytes, it is considered that a command injection vulnerability may occur.

[0085] By adopting the device security detection method provided in this embodiment, the semantics of external input is obtained in the front-end resource file, and then in the process of static analysis of the back-end program, the location where the taint parameters and interface functions are introduced is located, which can shorten the taint analysis process and optimize the path selection of symbolic execution. On the basis of executing input-sensitive taint analysis, the solution space of symbolic execution is greatly shortened, effectively improving the efficiency and accuracy of vulnerability mining.

[0086] Embodiment 2

[0087] Corresponding to the above-mentioned embodiment 1, embodiment 2 of the present invention provides an equipment safety detection device. The corresponding technical feature details and corresponding technical effects can be referred to the above-mentioned embodiment 1, and will not be repeated in this embodiment. Figure 2 A block diagram of a device safety detection device provided in Embodiment 2 of the present invention, such as Figure 2 As shown, the device includes: an acquisition module 201, an extraction module 202, a matching module 203, a determination module 204 and an analysis module 205.

[0088] Among them, the acquisition module 201 is used to obtain the front-end file and back-end program in the device firmware; the extraction module 202 is used to extract the character string used to mark the user input data in the front-end file to obtain a character string set; the matching module 203 is used to match the back-end program with the character string in the character string set; the determination module 204 is used to determine the taint introduction point according to the matched character string; the analysis module 205 is used to perform taint analysis on the back-end program with the taint introduction point as the analysis starting point, so as to detect whether there is a security vulnerability in the device firmware.

[0089] Optionally, in one embodiment, when extracting the character string used to mark the user input data in the front-end file, the extraction module 202 extracts the API interface name and parameter name in the front-end file.

[0090] Optionally, in one embodiment, the determination module 204 includes: a first determination unit, used to determine whether the backend program is a boundary program according to the number of matched strings, wherein the greater the number of matched strings, the greater the probability that the backend program is determined as a boundary program; and a second determination unit, determining the stain introduction point based on the strings matched in the boundary program.

[0091] Optionally, in one embodiment, the analysis module 205 takes the taint introduction point as the analysis starting point and performs taint analysis on the backend program to detect whether there is a security vulnerability in the device firmware, and only performs taint analysis on the boundary program.

[0092] Optionally, in one embodiment, the front-end file includes an HTML file, a JS file and / or an XML file. When the extraction module 202 extracts the API interface name and parameter name in the front-end file, the specific steps performed include: using a regular expression to match the values ​​of the "action" attribute, the "name" attribute and the "id" attribute of each tag in the HTML file; parsing the JS file into an abstract syntax tree, traversing the abstract syntax tree, obtaining a subtree with a type attribute of Literal, and extracting the subtree attributes of "name" containing " / ", "value" containing " / ", "name" and "value"; parsing the XML file to extract the first-level tag under the Body node and the node tags under the first-level tag.

[0093] Optionally, in one embodiment, the device security detection device also includes a filtering module, which is used to extract the string used to mark user input data in the front-end file in the extraction module, and after obtaining the string set, before the matching module matches the back-end program with the string in the string set, perform the following steps: remove parameter names in the string set whose length is less than p or greater than q, q is greater than p, and q and p are both natural numbers; remove parameter names in the string set that appear in n or more different front-end files, n is a natural number; remove parameter names containing special characters in the string set; remove API interface names in the string set whose length is less than or equal to m, m is a natural number; remove API interface names in the string set that contain special characters other than " / " and / or "?"; remove API interface names in the string set that do not contain the " / " character; and / or remove characters after the "?" character in the API interface name.

[0094] Optionally, in one embodiment, the determination module 204 includes: a third determination unit, configured to determine the location of the instruction referenced by the matched character string in the backend program, obtain a direct reference point, and use the direct reference point as the taint introduction point.

[0095] Optionally, in one embodiment, the device firmware includes multiple back-end programs, and the determination module 204 also includes: a fourth determination unit, used to determine whether the data content of the direct reference point in the back-end program is passed to the variable of the first set function of the operating disk; if the data content of the direct reference point is passed to the variable of the first set function, then searching the multiple back-end programs for the first get function of the operating disk corresponding to the first set function; determining the variable assignment position of the first get function to obtain a cross-process reference point; and using the cross-process reference point as the taint introduction point.

[0096] Optionally, in one embodiment, the direct reference point is used to pass the string as a parameter to the using function, and the determination module 204 also includes: a fifth determination unit, used to traverse the function call points of the using function in the back-end program; search for the parameter passing position of the string parameter of the function call point to obtain an indirect reference point; and use the indirect reference point as the taint introduction point.

[0097] Optionally, in one embodiment, the device firmware includes multiple back-end programs, and the determination module 204 also includes: a sixth determination unit, used to determine whether the data content of the indirect reference point in the back-end program is passed to the variable of the second set function of the operating disk; if the data content of the indirect reference point is passed to the variable of the second set function, then searching the multiple back-end programs for the second get function of the operating disk corresponding to the second set function; determining the variable assignment position of the second get function to obtain a cross-process reference point; and using the cross-process reference point as the taint introduction point.

[0098] Optionally, in one embodiment, the analysis module 205 includes: an extraction unit, used to extract a sub-function call tree of the function at the location of the taint introduction point with the taint introduction point as the root node, wherein, in the sub-function call tree, the call instruction in the back-end program is used as the edge connecting the parent and child nodes, and the preset target function is used as the leaf node; an execution unit, used to perform taint execution on the back-end program according to the sub-function call tree, wherein the taint execution strategy includes: determining whether the current sub-function is on the sub-function call tree, if so, directly following up the execution, if not, determining whether the parameters of the current sub-function are contaminated by taint diffusion, if the parameters of the current sub-function are not contaminated, skipping the execution of the current sub-function without processing, if the parameters of the current sub-function are contaminated, then when the parameters of the current sub-function have a return value, the taint is diffused to the return value, and when the parameters of the current sub-function have a return value, the taint is diffused to the return value, and when the parameters of the current sub-function have a return value, the taint is diffused to the return value. When the parameter has no return value, the taint is spread to other writable address parameters of the current sub-function; a judgment unit is used to determine whether the device firmware has a security vulnerability when the taint is executed to the preset target function according to whether the parameters of the preset target function are contaminated, wherein the steps specifically performed by the judgment unit include: when the preset target function is a function that can cause a buffer overflow, judging whether the length parameter of the preset target function is contaminated, if the length parameter does not exist, judging whether the data source of the preset target function is contaminated, wherein when the length parameter is contaminated, or the data source of the preset target function is contaminated, it is determined that the device firmware has a security vulnerability; when the preset target function is a function that can cause command injection, judging whether there is contaminated byte content in the call parameters of the preset target function, if there is contaminated byte content in the call parameters, it is determined that the device firmware has a security vulnerability.

[0099] Embodiment 3

[0100] This third embodiment also provides a computer device, such as a smart phone, tablet computer, laptop computer, desktop computer, rack server, blade server, tower server or cabinet server (including an independent server or a server cluster composed of multiple servers) that can execute programs. Figure 3 As shown, the computer device 01 of this embodiment includes at least but is not limited to: a memory 012 and a processor 011 which can be interconnected through a system bus. Figure 3 It should be pointed out that Figure 3 Only a computer device 01 having components memory 012 and processor 011 is shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0101] In this embodiment, the memory 012 (i.e., readable storage medium) includes flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 012 can be an internal storage unit of the computer device 01, such as a hard disk or memory of the computer device 01. In other embodiments, the memory 012 can also be an external storage device of the computer device 01, such as a plug-in hard disk equipped on the computer device 01, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory 012 can also include both the internal storage unit of the computer device 01 and its external storage device. In this embodiment, the memory 012 is generally used to store the operating system and various application software installed on the computer device 01, such as the program code of the device safety detection device of the second embodiment. In addition, the memory 012 can also be used to temporarily store various types of data that have been output or are to be output.

[0102] In some embodiments, the processor 011 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 011 is generally used to control the overall operation of the computer device 01. In this embodiment, the processor 011 is used to run the program code stored in the memory 012 or process data, such as a device security detection method.

[0103] Embodiment 4

[0104] This fourth embodiment also provides a computer-readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (for example, an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a disk, an optical disk, a server, an App application store, etc., on which a computer program is stored, and the program implements the corresponding function when executed by the processor. The computer-readable storage medium of this embodiment is used to store device security detection devices, and implements the device security detection method of embodiment one when executed by the processor.

[0105] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0106] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0107] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method.

[0108] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A device safety detection method, characterized in that: include: Get the front-end files and back-end programs in the device firmware; Extract the character string used to mark the user input data from the front-end file to obtain a character string set; Matching the backend program with a string in the string set; Determining a stain introduction point according to the matched character string; Taking the taint introduction point as the analysis starting point, performing taint analysis on the backend program to detect whether there is a security vulnerability in the device firmware, including: taking the taint introduction point as the root node, extracting the sub-function call tree of the function at the taint introduction point position, performing taint execution on the backend program according to the sub-function call tree, and when the taint execution reaches a preset target function, determining whether there is a security vulnerability in the device firmware based on whether the parameters of the preset target function are contaminated.

2. The device safety detection method according to claim 1, characterized in that: The step of extracting the character string used to mark the user input data in the front-end file to obtain a character string set includes: Extract the API interface name and parameter name in the front-end file.

3. The device safety detection method according to claim 1 or 2, characterized in that: The step of determining the stain introduction point according to the matched character string comprises: Determining whether the backend program is a boundary program according to the number of matched character strings, wherein the greater the number of matched character strings, the greater the probability that the backend program is determined to be a boundary program; and The stain introduction point is determined according to the character string matched in the boundary program.

4. The device safety detection method according to claim 3, characterized in that: The steps of taking the taint introduction point as the analysis starting point and performing taint analysis on the backend program to detect whether the device firmware has a security vulnerability include: Taking the taint introduction point as the analysis starting point, only the boundary program is subjected to taint analysis to detect whether there is a security vulnerability in the device firmware.

5. The device safety detection method according to claim 2, characterized in that: The front-end file includes an HTML file, a JS file and / or an XML file, and the step of extracting the API interface name and parameter name in the front-end file includes: Use regular expressions to match the values ​​of the "action" attribute, the "name" attribute, and the "id" attribute of each tag in the HTML file; Parse the JS file into an abstract syntax tree, traverse the abstract syntax tree, obtain a subtree whose type attribute is Literal, and extract the subtree attributes of "name" containing " / ", "value" containing " / ", the value of "name" and the value of "value"; The XML file is parsed to extract the first-level tags under the Body node and the node tags under the first-level tags.

6. The device safety detection method according to claim 2, characterized in that: After extracting the string used to mark the user input data from the front-end file to obtain a string set, and before matching the back-end program with the strings in the string set, the device security detection method further includes: Remove parameter names whose length is less than p or greater than q from the string set, where q is greater than p, and both q and p are natural numbers; Remove parameter names that appear in n or more different front-end files from the string set, where n is a natural number; Remove parameter names containing special characters from the string set; Remove the API interface names whose length is less than or equal to m from the string set, where m is a natural number; Remove the API interface names that contain special characters other than " / " and / or "?" from the string set; Remove the API interface names that do not contain the " / " character in the string set; and / or Remove the characters after the "?" character in the API interface name.

7. The device safety detection method according to claim 2, characterized in that: The step of determining the stain introduction point according to the matched character string comprises: Determine the position of the matched string in the backend program where the instruction is referenced to obtain a direct reference point; The direct reference point is used as the stain introduction point.

8. The device safety detection method according to claim 7, characterized in that: The device firmware includes a plurality of backend programs, and the step of determining the taint introduction point according to the matched character string further includes: Determine whether the data content of the direct reference point in the backend program is passed to the variable of the first set function of the operating disk; If the data content of the direct reference point is passed to the variable of the first set function, searching the first get function of the operating disk corresponding to the first set function in the plurality of backend programs; Determine the variable assignment position of the first get function to obtain a cross-process reference point; and The cross-process reference point is used as the taint introduction point.

9. The device safety detection method according to claim 7, characterized in that: The direct reference point is used to pass the string as a parameter to the use function, and the step of determining the stain introduction point according to the matched string also includes: Traversing the function call points of the used function in the backend program; Find the parameter passing position of the string parameter of the function call point to obtain an indirect reference point; and The indirect reference point is used as the taint introduction point.

10. The device safety detection method according to claim 9, characterized in that: The device firmware includes a plurality of backend programs, and the step of determining the taint introduction point according to the matched character string further includes: Determine whether the data content of the indirect reference point in the backend program is passed to the variable of the second set function of the operating disk; If the data content of the indirect reference point is passed to the variable of the second set function, searching the plurality of backend programs for a second get function for operating the disk corresponding to the second set function; Determine the variable assignment position of the second get function to obtain a cross-process reference point; and The cross-process reference point is used as the taint introduction point.

11. The device safety detection method according to claim 1, characterized in that: In the child function call tree, the call instruction in the backend program is used as an edge connecting the parent and child nodes, and the preset target function is used as a leaf node; The strategy of tainted execution includes: judging whether the current sub-function is on the sub-function call tree, if so, directly following up the execution; if not, judging whether the parameters of the current sub-function are contaminated by taint diffusion; if the parameters of the current sub-function are not contaminated, skipping the execution of the current sub-function without processing; if the parameters of the current sub-function are contaminated, when the parameters of the current sub-function have a return value, diffusing the taint to the return value; when the parameters of the current sub-function have no return value, diffusing the taint to other writable address parameters of the current sub-function; The step of determining whether the device firmware has a security vulnerability based on whether the parameters of the preset target function are contaminated specifically includes: when the preset target function is a function that can cause a buffer overflow, determining whether the length parameter of the preset target function is contaminated; if the length parameter does not exist, determining whether the data source of the preset target function is contaminated; wherein, when the length parameter is contaminated, or the data source of the preset target function is contaminated, determining that the device firmware has a security vulnerability; when the preset target function is a function that can cause a command injection, determining whether there is contaminated byte content in the calling parameters of the preset target function; if there is contaminated byte content in the calling parameters, determining that the device firmware has a security vulnerability.

12. An equipment safety detection device, characterized in that: include: An acquisition module is used to acquire front-end files and back-end programs in the device firmware; An extraction module, used to extract the character string used to mark the user input data in the front-end file to obtain a character string set; A matching module, used for matching the backend program with a string in the string set; A determination module, used to determine a stain introduction point according to the matched character string; The analysis module is used to perform taint analysis on the backend program with the taint introduction point as the analysis starting point to detect whether the device firmware has a security vulnerability, including: taking the taint introduction point as the root node, extracting the sub-function call tree of the function at the taint introduction point, tainting the backend program according to the sub-function call tree, and when the taint is executed to a preset target function, determining whether the device firmware has a security vulnerability based on whether the parameters of the preset target function are contaminated.

13. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 11 are implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images