A data stream integrity detection method, device, equipment and medium

Abstract

The present application relates to a kind of data stream integrity detection method, device, equipment and medium, its method includes: receiving the source code to be detected input by user generates original assembly file with line number information;According to read instruction and write instruction in original assembly file, define sdDFIx instruction and ldDFIx instruction using the EUI attribute of preset data;Again, code insertion is carried out to original assembly file, and new assembly file is generated;Using original instruction set architecture, the new instruction set architecture of the new assembly file containing sdDFIx instruction and ldDFIx instruction after compiling is extended to execute;Using the new instruction set architecture after extension, the new assembly file after compiling and linking is executed, and the inspection result to the code to be checked is obtained;The purpose of the present application is to solve the defects that performance overhead is large in prior art, cannot more efficiently monitor program abnormal behavior, cannot effectively protect the problems of program runtime.

Description

A method, apparatus, device and medium for data stream integrity detection Technical Field

[0001] This invention relates to the field of computer software technology, and in particular to a data flow integrity detection method, apparatus, device, and medium. Background Technology

[0002] Programs written in C / C++ are susceptible to various memory vulnerabilities. Memory vulnerabilities refer to timing or space errors in memory operations made by programmers during software development, resulting in security issues that may cause the program to behave in ways that violate its design. Attackers typically exploit these vulnerabilities to modify memory data and launch attacks, seriously threatening the runtime security of computer systems.

[0003] The key to an attacker's success lies in corrupting memory data during program execution, allowing arbitrary read and write operations. Currently, the mainstream defense technology is Data Flow Integrity (DFI) protection, which protects memory data during program execution, detects abnormal program behavior, and prevents such attacks. It obtains a set of legitimate write instructions through static analysis. Then, it employs a label-checking mechanism to detect runtime behavior. Specifically, DFI first uses static analysis to generate a Data Flow Graph (DFG) to express the definition-usage relationships of variables, assigning a unique label to each memory write instruction (store), thus obtaining a set of legitimate data labels. Next, it uses code instrumentation to instrument the memory read and write instructions, resulting in an executable file. During program execution, the labels of memory write instructions (stores) are calculated in real time; when a memory read instruction (load) is encountered, a label check is performed, that is, checking whether the label value of the most recent memory write instruction (store) that wrote this data is in the set of legitimate write instructions obtained from static analysis. If it is, execution continues; if not, it indicates that the data has been illegally corrupted, resulting in abnormal behavior, and program execution is terminated.

[0004] Currently, software-based DFI allocates 1GB of virtual memory to the program being monitored, with an additional 1GB / 2GB allocated to the data tag RDT. A 16-bit tag is assigned every 32 bits, meaning each store instruction and each piece of data is assigned a unique 16-bit tag. DFI execution incurs a performance overhead of over 100% and a memory overhead of 50%, making it impractical. Currently, hardware support is used to simplify and accelerate DFI. For example, existing technology uses hardware-assisted TMDFI to allocate 8-bit tags per 64 bits of virtual memory for the program being monitored; each store instruction and each piece of data is assigned a unique 8-bit tag. Hardware-assisted TMDFI performs DFI using a tag-based method, with a performance overhead of 39% and a memory overhead of 12.5%. Hardware-assisted PIM-DFI is consistent with software DFI, allocating 16-bit tags per 32-bit memory space. Hardware-assisted PIM-DFI is also a solution that introduces hardware support to accelerate DFI, with a performance overhead of approximately 37% and a memory overhead of 25%. Meanwhile, the existing RVDFI is also a solution that introduces hardware support to accelerate DFI, with a performance overhead of approximately 18% and a memory overhead of 25%. The performance overhead stems from cache misses caused by code bloat and frequent memory accesses. The existing performance overhead remains significant, making it difficult to efficiently monitor abnormal program behavior and provide effective protection during program runtime. Summary of the Invention

[0005] This invention provides a data flow integrity detection method, apparatus, device, and medium. It addresses the shortcomings of existing technologies, such as high performance overhead, inefficiency in monitoring abnormal program behavior, and inability to effectively protect programs during runtime.

[0006] This invention provides a data stream integrity detection method, comprising:

[0007] Receive the source code to be tested from the user and use a cross-compiler to generate the original assembly file with line number information;

[0008] Based on the read and write instructions in the original assembly file, and using the EUI attribute of the preset data, they are defined as sdDFIx and ldDFIx instructions.

[0009] The original assembly file is instrumented according to the sdDFIx and ldDFIx instructions to generate a new assembly file;

[0010] Using the original instruction set architecture of the original assembly file after execution and compilation, the new instruction set architecture of the new assembly file containing the sdDFIx and ldDFIx instructions after execution and compilation is extended;

[0011] Using the extended new instruction set architecture, the compiled and linked new assembly file is executed to obtain the inspection results of the code to be inspected;

[0012] The EUI attribute of the preset data is obtained by statically analyzing the data flow graph of the program after obtaining the program's data flow graph using the program analysis tool from the source code to be detected.

[0013] According to a data flow integrity detection method provided by the present invention, based on the read and write instructions in the original assembly file, and utilizing the EUI attribute of preset data, the instructions are defined as sdDFIx and ldDFIx instructions, including:

[0014] Based on the read and write instructions and the EUI attributes of the preset data in the original assembly file, the EUI tags corresponding to the EUI attributes of the read and write instructions are obtained.

[0015] The EUI tag corresponding to the read instruction and EUI attribute is stored in the tag of the read instruction to obtain the tag of the ldDFIx instruction. The EUI tag corresponding to the write instruction and EUI attribute is stored in the tag of the write instruction to obtain the tag of the sdDFIx instruction.

[0016] According to a data flow integrity detection method provided by the present invention, the storage space of the EUI tag is 3 bits.

[0017] According to a data flow integrity detection method provided by the present invention, a new assembly file is generated by instrumenting the original assembly file according to the sdDFIx and ldDFIx instructions, including:

[0018] The new assembly file is generated by replacing the read instruction in the original assembly file with the ldDFIx instruction and the write instruction in the original assembly file with the sdDFIx instruction.

[0019] According to the data flow integrity detection method provided by the present invention, the step of executing the compiled and linked new assembly file using the extended new instruction set architecture to obtain the inspection result of the code to be inspected further includes an inspection step:

[0020] When the newly compiled and linked assembly file executes the sdDFIx instruction, the label of the memory data is updated using the label of the sdDFIx instruction;

[0021] When the newly compiled and linked assembly file executes the ldDFIx instruction, the label of the updated memory data is compared with the label of the ldDFIx instruction.

[0022] If the label of the ldDFIx instruction matches the label of the updated memory data, the inspection result of the code to be inspected is normal.

[0023] If the label of the ldDFIx instruction is inconsistent with the label of the updated memory data, the inspection result of the code to be inspected is an anomaly.

[0024] According to the data flow integrity detection method provided by the present invention, the instruction set architecture adopts the RISC-V architecture.

[0025] According to a data flow integrity detection method provided by the present invention, the EUI attributes of the data include: input memory data, dangling / out-of-bounds pointers, and illegally tampered memory data;

[0026] The input memory data, dangling / out-of-bounds pointers, and illegally tampered memory data each correspond to a label.

[0027] According to the present invention, a data stream integrity detection device is also provided, comprising:

[0028] The compilation module is used to receive the source code to be tested from the user input and generate the original assembly file with line number information using a cross compiler;

[0029] The code instrumentation module is used to define sdDFIx and ldDFIx instructions based on the read and write instructions in the original assembly file, using the EUI attribute of preset data. The module then instruments the original assembly file using these sdDFIx and ldDFIx instructions to generate a new assembly file.

[0030] The inspection module is used to extend the instruction set architecture of the new assembly file containing the sdDFIx and ldDFIx instructions after execution by using the instruction set architecture of the original assembly file after execution, and to execute the new assembly file after compilation and linking using the extended instruction set architecture to obtain the inspection result of the code to be inspected.

[0031] The EUI attribute of the preset data is obtained by statically analyzing the data flow graph of the program after obtaining the program's data flow graph using the program analysis tool from the source code to be detected.

[0032] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the data flow integrity detection method as described above.

[0033] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data flow integrity detection method as described above.

[0034] This invention provides a data flow integrity detection method, apparatus, device, and medium. The data flow integrity detection method uses the read and write instructions of the original assembly file in the source code to be detected, and utilizes the EUI attributes of preset data, defined as sdDFIx and ldDFIx instructions. This not only checks the data flow integrity of the source code under test through the EUI attributes, reducing memory overhead, but also replaces the read and write instructions in the original assembly file with ldDFIx and sdDFIx instructions, almost eliminating code bloat and reducing the probability of cache misses during program execution, thereby reducing performance overhead. This enables more efficient monitoring of abnormal program behavior and provides effective protection during program runtime. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0036] Figure 1 is a flowchart illustrating the data flow integrity detection method provided by the present invention;

[0037] Figure 2 is a schematic diagram of the structure of the sdDFIx and ldDFIx instructions in this invention;

[0038] Figure 3 is a schematic diagram of the data flow integrity detection method device provided by the present invention;

[0039] Figure 4 is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0041] The following describes a data flow integrity detection method of the present invention with reference to Figures 1 and 2, including:

[0042] S1. Receive the source code to be tested from the user and generate the original assembly file with line number information using a cross-compiler. This step uses the RISC-CV-GCC cross-compiler to generate the original assembly file with line number information.

[0043] S2. Based on the read and write instructions in the original assembly file, and utilizing the EUI attributes of the preset data, define them as sdDFIx and ldDFIx instructions. Specifically: Please refer to Figure 2. Based on the read and write instructions in the original assembly file and the EUI attributes of the preset data, obtain the EUI tags corresponding to the EUI attributes for each read and write instruction. The storage space for each EUI tag is 3 bits.

[0044] The EUI tag corresponding to the read instruction and EUI attribute is stored in the tag of the read instruction to obtain the tag of the ldDFIx instruction. Similarly, the EUI tag corresponding to the write instruction and EUI attribute is stored in the tag of the write instruction to obtain the tag of the sdDFIx instruction. That is, a 3-bit EUI tag is stored in bits 12-14 of both the sdDFIx and ldDFIx instructions. In the sdDFIx instruction, imm refers to the immediate value, rs1 and rs2 refer to the source register, and opcode refers to the opcode. In the ldDFIx instruction, imm refers to the immediate value, rs1 refers to the source register, rd refers to the destination register, and opcode refers to the opcode.

[0045] Specifically, the sdDFIx instruction is an S-type instruction, using bits 12-14 as tag bits to store the sdDFIx instruction tag sitag. The ldDFIx instruction is an I-type instruction, also using bits 12-14 as tag bits to store the ldDFIx instruction tag litag.

[0046] When inspecting the source code to be inspected, this invention only allocates memory for the tags (dtags) of the data in the source code to be inspected, without allocating additional memory, thereby greatly reducing the memory overhead caused by tag storage.

[0047] S3. Perform code instrumentation on the original assembly file according to the sdDFIx and ldDFIx instructions to generate a new assembly file.

[0048] Specifically, the new assembly file is generated by replacing the read instructions in the original assembly file with the ldDFIx instructions and the write instructions in the original assembly file with the sdDFIx instructions. This invention replaces the read (store) and write (load) instructions in the original assembly file with the ldDFIx and sdDFIx instructions corresponding to the tags. Because this only increases storage space by 3 bits, it causes almost no code bloat, reduces the probability of cache misses during program execution, and thus reduces performance overhead.

[0049] S4. Using the original instruction set architecture of the original assembly file after execution and compilation, extend the new instruction set architecture of the new assembly file containing the sdDFIx and ldDFIx instructions after execution and compilation.

[0050] In this step, the original instruction set architecture can be a 64-bit RISC-V instruction set architecture. Simultaneously, the RISC-V-GNU-Toolchain is modified to provide assembly support for the new instructions, ensuring that the modified assembly files can correctly generate executable programs.

[0051] Specifically, by modifying the Rocket Core of the RISC-V instruction set architecture, the RISC-V instruction set architecture is extended to execute the new assembly file containing the sdDFIx and ldDFIx instructions after compilation.

[0052] S5. Using the extended new instruction set architecture, execute the compiled and linked new assembly file to obtain the inspection results of the code to be inspected. The EUI attribute of the preset data is obtained by performing static analysis on the data flow graph of the source code to be inspected after obtaining the program's data flow graph using a program analysis tool.

[0053] Specifically, the EUI attributes of the preset data include: whether it is input-related memory data (I), whether it is memory data of a dangling / out-of-bounds pointer (U), and whether it is illegally tampered memory data (E). Each memory data corresponds to a 1-bit tag.

[0054] Specifically, the step of using the extended instruction set architecture to execute the compiled and linked new assembly file to obtain the inspection result of the code to be inspected includes the following steps:

[0055] When the newly compiled and linked assembly file executes the sdDFIx instruction, the label of the memory data is updated using the label of the sdDFIx instruction.

[0056] When the newly compiled and linked assembly file executes the ldDFIx instruction, the label of the updated memory data is compared using the label of the ldDFIx instruction.

[0057] If the label of the ldDFIx instruction matches the label of the updated memory data, the check result of the code to be checked is normal. This indicates that the sdDFIx instruction is valid, does not violate the data flow, and execution continues.

[0058] If the label of the ldDFIx instruction does not match the label of the updated memory data, the check result for the code under inspection is abnormal. This indicates that the sdDFIx instruction is invalid, the program's data flow is abnormal, and an error is reported.

[0059] In this embodiment, the tag (sitag) of the sdDFIx instruction represents the EUI attribute of the memory address accessed when this instruction is executed, obtained through static analysis. This tag is used to update the tag (dtag) of the memory data corresponding to the source code being tested, thus obtaining the runtime tag of the data. Because the attacker maliciously tampered with the data—that is, modified the data using an illegal write instruction—the tag of this illegal write instruction will update the tag of the memory data. The sdDFIx instruction copies the value of the rs2 register to the memory corresponding to rs1+imm and copies the tag sitag to the tag dtag.

[0060] The tag (litag) of the ldDFIx instruction indicates the EUI attribute of the data stored at the accessed memory address when this instruction is executed. It is obtained by analyzing the data flow graph. The ldDFIx instruction copies the value of rs1+imm to the rd destination register and checks whether the tag dtag of the corresponding memory data is the same as the tag litag of the ldDFIx instruction, thus achieving the detection of the source code to be inspected. Please also refer to Table 1, which lists the ldDFIx and sdDFIx instructions. Memory accesses for tag checking of the source code to be inspected also incur performance overhead. To further reduce performance loss, the number of memory accesses for the ldDFIx and sdDFIx instructions is reduced. The default litag == 000 or sitag == 000 indicates that the data stored at the memory address to be accessed by the instruction is not input data, not insecure data, and has an extremely low probability of being modified by an attacker. Therefore, for sdDFIx instructions with sitag == 000, their instruction tags will not be stored in the tag table; for ldDFIx instructions with lita == 000, tag checking will not be performed. Tag updating and checking are implemented by modifying Rocket Core. According to Table 1, the ldDFIx and sdDFIx instructions corresponding to the tags replace the read instruction `store` and write instruction `load` in the assembly file. This process produces almost no code bloat, reduces the probability of cache misses during program execution, and thus reduces performance overhead.

[0061]

[0062] Table 1

[0063] Compared to existing technologies, which allocate space for tags on all instructions and data, resulting in a 50% memory overhead (32-bit / 64-bit), this invention allocates only three bits for in-memory data. Experimental results show that the resulting memory overhead is negligible. Performance testing was conducted using the riscv-test suite, showing a performance overhead of only 4.52%. Furthermore, a security assessment was performed using the RIPE test suite. Experimental results demonstrate that this invention does not weaken the security of the DFI defense mechanism and can effectively defend against some typical memory corruption attacks. Overall, this invention reduces the memory overhead and performance loss of existing data flow integrity DFI mechanisms, increasing the feasibility of practical deployment of data flow integrity DFI defense mechanisms.

[0064] The data flow integrity detection device provided by the present invention is described below. The data flow integrity detection device described below can be referred to in correspondence with the data flow integrity detection method described above.

[0065] Please refer to Figure 3. The present invention also provides a data flow integrity detection device, including a compilation module 310, a code instrumentation module 320, and an inspection module 330.

[0066] The compilation module 310 is used to receive the source code to be tested from the user input and use the cross compiler to generate the original assembly file with line number information.

[0067] The code instrumentation module 320 is used to define the read and write instructions in the original assembly file as sdDFIx and ldDFIx instructions using the EUI attribute of preset data, and to perform code instrumentation on the original assembly file according to the sdDFIx and ldDFIx instructions to generate a new assembly file.

[0068] The inspection module 330 is used to extend the instruction set architecture of the new assembly file containing the sdDFIx and ldDFIx instructions after execution by using the instruction set architecture of the original assembly file after execution, and then execute the new assembly file after compilation and linking using the extended instruction set architecture to obtain the inspection result of the code to be inspected.

[0069] The EUI attribute of the preset data is obtained by statically analyzing the data flow graph of the program after obtaining the program's data flow graph using the program analysis tool from the source code to be detected.

[0070] This invention uses a compilation module to generate a source assembly file with line number information from the source code to be inspected. A code instrumentation module then uses sdDFIx and ldDFIx instructions to instrument the source assembly file, generating a new assembly file. The inspection module then executes and links this new assembly file to obtain the inspection results for the code under inspection. This allows for more efficient monitoring of abnormal program behavior and provides protection during program runtime.

[0071] Figure 4 illustrates a schematic diagram of the physical structure of an electronic device. As shown in Figure 4, the electronic device may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440. The processor 410, communication interface 420, and memory 430 communicate with each other via the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute a data flow integrity detection method, which includes:

[0072] S1. Receive the source code to be tested from the user input and use a cross-compiler to generate the original assembly file with line number information.

[0073] S2. Based on the read and write instructions in the original assembly file, and using the EUI attribute of the preset data, define them as sdDFIx and ldDFIx instructions.

[0074] S3. Perform code instrumentation on the original assembly file according to the sdDFIx and ldDFIx instructions to generate a new assembly file.

[0075] S4. Using the instruction set architecture of the original assembly file after execution and compilation, extend the instruction set architecture of the new assembly file containing the sdDFIx and ldDFIx instructions after execution and compilation.

[0076] S5. Using the extended instruction set architecture, execute the compiled and linked new assembly file to obtain the inspection results of the code to be inspected.

[0077] The EUI attribute of the preset data is obtained by statically analyzing the data flow graph of the program after obtaining the program's data flow graph using the program analysis tool from the source code to be detected.

[0078] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0079] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium, wherein when the computer program is executed by a processor, the computer is able to execute the data flow integrity detection method provided by the above methods, the method comprising:

[0080] S1. Receive the source code to be tested from the user input and use a cross-compiler to generate the original assembly file with line number information.

[0081] S2. Based on the read and write instructions in the original assembly file, and using the EUI attribute of the preset data, define them as sdDFIx and ldDFIx instructions.

[0082] S3. Perform code instrumentation on the original assembly file according to the sdDFIx and ldDFIx instructions to generate a new assembly file.

[0083] S4. Using the original instruction set architecture of the original assembly file after execution and compilation, extend the new instruction set architecture of the new assembly file containing the sdDFIx and ldDFIx instructions after execution and compilation.

[0084] S5. Using the extended new instruction set architecture, execute the compiled and linked new assembly file to obtain the inspection results of the code to be inspected.

[0085] The EUI attribute of the preset data is obtained by statically analyzing the data flow graph of the program after obtaining the program's data flow graph using the program analysis tool from the source code to be detected.

[0086] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data flow integrity detection method provided by the methods described above, the method comprising:

[0087] S1. Receive the source code to be tested from the user input and use a cross-compiler to generate the original assembly file with line number information.

[0088] S2. Based on the read and write instructions in the original assembly file, and using the EUI attribute of the preset data, define them as sdDFIx and ldDFIx instructions.

[0089] S3. Perform code instrumentation on the original assembly file according to the sdDFIx and ldDFIx instructions to generate a new assembly file.

[0090] S4. Using the original instruction set architecture of the original assembly file after execution and compilation, extend the new instruction set architecture of the new assembly file containing the sdDFIx and ldDFIx instructions after execution and compilation.

[0091] S5. Using the extended new instruction set architecture, execute the compiled and linked new assembly file to obtain the inspection results of the code to be inspected.

[0092] The EUI attribute of the preset data is obtained by statically analyzing the data flow graph of the program after obtaining the program's data flow graph using the program analysis tool from the source code to be detected.

[0093] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0094] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data stream integrity detection method, characterized in that, include: Receive the source code to be tested from the user and use a cross-compiler to generate the original assembly file with line number information; Based on the read and write instructions in the original assembly file, and utilizing the EUI attribute of preset data, sdDFIx and ldDFIx instructions are defined. Code instrumentation is performed on the original assembly file using the sdDFIx and ldDFIx instructions to generate a new assembly file. The original instruction set architecture of the compiled original assembly file is used to extend the new instruction set architecture of the compiled new assembly file containing the sdDFIx and ldDFIx instructions. The compiled and linked new assembly file is executed using the extended new instruction set architecture to obtain the inspection results for the code to be inspected. The EUI attribute of the preset data is obtained by statically analyzing the data flow graph of the source code to be inspected using a program analysis tool. Defining sdDFIx and ldDFIx instructions based on the read and write instructions in the original assembly file, using the EUI attribute of the preset data, includes: obtaining the relationship between the read and write instructions and the EUI attribute of the preset data. The corresponding EUI tags; storing the EUI tags corresponding to the read instructions and EUI attributes in the tags of the read instructions to obtain the tag of the ldDFIx instruction; storing the EUI tags corresponding to the write instructions and EUI attributes in the tags of the write instructions to obtain the tag of the sdDFIx instruction; the step of using the extended new instruction set architecture to execute the compiled and linked new assembly file to obtain the inspection result of the code to be inspected also includes the following inspection steps: when the compiled and linked new assembly file executes the sdDFIx instruction, the tag of the memory data is updated using the tag of the sdDFIx instruction; when the compiled and linked new assembly file executes the ldDFIx instruction, the tag of the updated memory data is compared using the tag of the ldDFIx instruction; if the tag of the ldDFIx instruction is consistent with the tag of the updated memory data, the inspection result of the code to be inspected is normal; if the tag of the ldDFIx instruction is inconsistent with the tag of the updated memory data, the inspection result of the code to be inspected is abnormal.

2. The data stream integrity detection method according to claim 1, characterized in that, The EUI tag has a storage space of 3 bits.

3. The data stream integrity detection method according to claim 1, characterized in that, The original assembly file is instrumented according to the sdDFIx and ldDFIx instructions to generate a new assembly file, including: replacing the read instructions in the original assembly file with the ldDFIx instructions and replacing the write instructions in the original assembly file with the sdDFIx instructions to generate the new assembly file.

4. The data stream integrity detection method according to claim 1, characterized in that, The original instruction set architecture adopted the RISC-V architecture.

5. The data stream integrity detection method according to any one of claims 1-4, characterized in that, The EUI attributes of the data include: input memory data, dangling / out-of-bounds pointers, and illegally tampered memory data; each of the input memory data, dangling / out-of-bounds pointers, and illegally tampered memory data corresponds to a label.

6. A data stream integrity detection device, characterized in that, include: The compilation module is used to receive the source code to be tested from the user input and generate the original assembly file with line number information using a cross compiler; The code instrumentation module is used to define the read and write instructions in the original assembly file as sdDFIx and ldDFIx instructions using the EUI attribute of preset data, and to instrument the original assembly file according to the sdDFIx and ldDFIx instructions to generate a new assembly file; The module includes an inspection module, which uses the original instruction set architecture of the original assembly file after execution to extend the new instruction set architecture of the new assembly file containing the sdDFIx and ldDFIx instructions after execution. Using the extended new instruction set architecture, the module executes the compiled and linked new assembly file to obtain the inspection results for the code to be inspected. The EUI attributes of the preset data are obtained by statically analyzing the data flow graph of the source code to be inspected after obtaining the program's data flow graph using a program analysis tool. The code instrumentation module is also used to obtain the EUI tags corresponding to the EUI attributes for each read and write instruction based on the read and write instructions in the original assembly file and the EUI attributes of the preset data. The module stores the EUI tags corresponding to the EUI attributes of the read instructions in the read instruction... The label of the ldDFIx instruction is obtained from the labels, and the EUI label corresponding to the EUI attribute of the write instruction is stored in the label of the write instruction to obtain the label of the sdDFIx instruction; the checking module is also used to update the label of the memory data using the label of the sdDFIx instruction when the new assembly file after compilation and linking executes the sdDFIx instruction; when the new assembly file after compilation and linking executes the ldDFIx instruction, the updated label of the memory data is compared using the label of the ldDFIx instruction; if the label of the ldDFIx instruction is consistent with the updated label of the memory data, the checking result of the code to be checked is normal; if the label of the ldDFIx instruction is inconsistent with the updated label of the memory data, the checking result of the code to be checked is abnormal.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the data flow integrity detection method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the data flow integrity detection method as described in any one of claims 1 to 5.

Images