Controlled channel vulnerability automated detection method based on control flow page access analysis

Abstract

The application discloses a controlled channel vulnerability automatic detection method based on control flow page access analysis, which comprises the following steps: building a conditional control flow memory page access real-time attack environment; using a memory management unit to allocate a limited number of physical memory page frames to a target application program; when the target application program starts to execute, recording the physical memory page numbers corresponding to triggered system interrupts or page fault exceptions, and generating a page fault exception sequence; analyzing the page fault exception sequence, searching for repeatedly occurring longest subsequences, and recording each longest subsequence and its repetition number; calculating the distance vector, average value and variance between two adjacent longest subsequences; and using machine learning to analyze the correlation between the page fault exception feature information and the target application program, so as to detect the controlled channel vulnerability of a sensitive target application program. The application has good detection target universality, and can automatically collect and analyze sensitive information leakage, output detection results, and is easy to deploy.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of computer information security, and relates to an automatic detection method for controlled channel vulnerability, in particular to an automatic detection method for controlled channel vulnerability based on conditional control flow memory page access mode analysis, which is used for detecting the vulnerability of sensitive information leakage of various cryptographic algorithms and application programs. BACKGROUND

[0002] In recent years, researchers have proposed a variety of attack techniques against sensitive application programs. Attackers can cause serious security threats to target processes containing private data and code by using the privileges of malicious operating systems, and make them face the risk of sensitive information leakage. In order to resist such attacks, researchers have proposed a trusted execution environment (Trusted Execution Environment, TEE) to build a secure area on the central processor to support the covert execution of programs. The current mainstream TEE technology includes Intel SGX of x86 instruction set architecture and TrustZone of ARM instruction set architecture. For TEE, its security only depends on the application program code itself and the hardware implementation of the CPU. Even in the case that the underlying privileged software (such as the operating system) is untrusted, TEE can still ensure the confidentiality and integrity of the application program and data.

[0003] However, researchers have subsequently proposed a controlled channel attack (Controlled Channel Attack, CCA) against TEE. The threat model assumes that the attacker is a malicious operating system with almost all control permissions of the platform, and can build a powerful and noiseless side channel from the trusted execution environment that depends on the kernel service. When the CPU executes a program to access a certain memory page, and this memory page is not mapped to the physical memory by the memory management unit (MMU), a page fault will be triggered. Since the virtual-physical address translation page table of the sensitive application program and the MMU are controlled by the operating system, the malicious operating system can observe all the page fault information. For the conditional control flow or data access situation of the attacked process being executed, the malicious operating system can deliberately manipulate the access permissions of the memory page to observe the page fault sequence used to uniquely identify a specific memory access pattern, thereby bypassing the security protection of TEE and inferring a large amount of sensitive information.

[0004] Although many defense techniques against controlled channel attacks have been proposed by researchers, such as system process routine redistribution, process memory distribution layout, etc., controlled channel attacks have been proven to be difficult to completely resist. These defense techniques are only proposals in academic research, relying on customized or redesigned hardware architecture for specific purposes, and have not been used in production practice. Therefore, program developers need to analyze the risk of suffering from controlled channel attacks from the sensitive application program itself, and consider improving or patching the algorithm that exists controlled channel leakage. Currently, how to automatically detect whether various sensitive application programs exist controlled channel vulnerability during execution has become a key problem to be solved in the field of computer information security technology. SUMMARY

[0005] The purpose of the embodiment of the present application is to provide a controlled channel vulnerability automatic detection method based on control flow page access analysis, which solves the problem of detecting the risk of suffering from controlled channel attacks in the dynamic execution process of sensitive application programs under the condition that the operating system is not trusted, so as to protect the security of sensitive information during application execution.

[0006] In order to achieve the above purpose, the technical scheme adopted by the embodiment of the present application is: the embodiment of the present application proposes a controlled channel vulnerability automatic detection method based on control flow page access analysis, which comprises the following steps:

[0007] Step 1: build a real-time attack environment of conditional control flow memory page access, and control the target application program to start execution on the allocated physical memory area;

[0008] Step 2: allocate a limited number of physical memory page frames to the target application program by using the memory management unit (MMU), and record the physical memory page number corresponding to the triggered system interrupt or page fault exception when the target application program starts execution, to generate a page fault exception sequence;

[0009] Step 3: analyze the page fault exception sequence obtained in step 2, search for the longest sub-sequence that repeatedly appears in it, and record each longest sub-sequence and its repetition number;

[0010] Step 4: analyze the page fault exception sequence obtained in step 2, calculate the distance vector, average value and variance between two adjacent longest sub-sequences based on the longest sub-sequence searched in step 3;

[0011] Step 5: take each longest sub-sequence and its repetition number, the distance vector, average value and variance between two adjacent longest sub-sequences as page fault exception feature information, analyze the correlation between the page fault exception feature information and the target application program by using machine learning, and detect the controlled channel vulnerability of the sensitive target application program.

[0012] Compared with the prior art, the present application has the following beneficial effects:

[0013] 1. Considering the detection and analysis of the controlled channel vulnerability of the application itself, the present application obtains the page fault exception sequence, searches for the longest sub-sequence with the most repeated times in the page fault exception sequence, takes each longest sub-sequence and its repeated times, the distance vector between the adjacent two longest sub-sequences, the average value and the variance as the page fault exception feature information, analyzes the correlation between the page fault exception feature information and the target application by using machine learning, and thus detects the controlled channel vulnerability of the sensitive application. The present application method solves the defects existing in the current defense or detection method, and avoids the dependence on the hardware architecture redesigned for a specific purpose or the generation of a large time and manual analysis overhead.

[0014] 2. The present application method is aimed at a variety of sensitive application programs or official password library algorithms, and avoids the singleness of the detection target.

[0015] 3. After configuring the attack environment, the detection tool automatically collects the Page Fault information, analyzes the sensitive information leakage, outputs the detected controlled channel vulnerability, and the overall detection process is user-friendly and has good detection target universality.

[0016] 4. The present application method is easy to deploy, calls the attack framework SGX-Step executed by the control Enclave, effectively detects the controlled channel vulnerability and resistance of the target application program based on Page Fault, and the system can automatically adjust the configuration parameters to maximize the detection effect and reduce the manual overhead. DETAILED DESCRIPTION

[0017] The accompanying drawings used to be explained here are used to provide further understanding of the present application, and constitute a part of the present application. The illustrative embodiments of the present application and the description thereof are used to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 A flowchart of a controlled channel vulnerability automatic detection method based on control flow page access analysis provided for the embodiments of the present application;

[0019] Figure 2 A schematic diagram of a page fault exception information acquisition and analysis execution module in the embodiments of the present application. DETAILED DESCRIPTION

[0020] In order to make the purposes, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be clearly and completely described below in combination with specific embodiments of the present application and drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work belong to the scope of protection of the present application.

[0021] The controlled channel attack can intentionally manipulate the memory page access permission to observe the page fault exception sequence for uniquely identifying a specific memory access mode, thereby bypassing the security protection of mainstream TEE to steal a large amount of private information of sensitive applications, which poses a great threat to information security. At present, the defense technology against the controlled channel attack depends on the customized or redesigned hardware architecture for specific purposes, and has not been put into use in production practice. In view of this problem, the present application detects the controlled channel vulnerability existing in the program design itself by analyzing the execution trace of the sensitive application. The technical problem to be solved by the present application is to analyze the risk of the execution trace of the sensitive application suffering from the controlled channel attack under the condition that the underlying operating system is untrusted, so as to perfect or patch the algorithm existing the controlled channel leakage, and solve the problem of controlled channel leakage of sensitive information from the source.

[0022] The present application uses an open source Library OS framework Gramine to rewrap the conventional operating system kernel service into the application library in the user mode, so that an application with as few system call requests as possible can be run. The present application develops the detection tool as an extended implementation of the Gramine framework in the untrusted runtime, and does not change the library component in the trusted runtime. The advantage is that the redeployment of the detection code and the target application is facilitated. On the one hand, it is easy to realize the transplantation of attack code under different malicious operating systems to simulate different threat models. On the other hand, it is easy to deploy the target application to be detected into the trusted world (Intel SGX Enclave) to complete the controlled channel vulnerability analysis of different detection targets.

[0023] Figure 1 A flowchart of a controlled channel vulnerability automatic detection method based on control flow page access analysis is provided for the embodiments of the present application. The controlled channel vulnerability automatic detection method based on control flow page access analysis provided by the present embodiment comprises the following steps:

[0024] Step 1: build a conditional control flow memory page access real-time attack environment, and control the target application to start execution on the allocated physical memory area;

[0025] Specifically, by simulating the attacker in the standard Intel SGX controlled channel attack threat model through the open-source side-channel attack framework SGX-Step, the attacker obtains the privilege of controlling the system software, such as the operating system. At this time, the memory management unit MMU can be manipulated to manage the memory pages corresponding to the trusted world Enclave, such as mapping (Map) and un-mapping (Unmap), but cannot directly obtain the data information on the memory page. When an application in the trusted world Enclave attempts to read or write a memory page, and the memory page resides in the external memory, or the target page exists in the main memory but lacks a reference to the page, the operating system can receive a page fault exception signal and start executing the page fault exception handler. The attacker injects malicious code into the page fault exception handler (Page_Fault_Handler), maliciously manipulates the configuration of the page table (Page Table), and thus builds a powerful controlled channel to obtain the page fault exception information uniquely identifying a specific memory access, corresponding to obtaining the key-related conditional control flow or data access flow existing in the target application. The open-source side-channel attack framework SGX-Step controls the target application to start executing on the allocated physical memory area, and monitors the page fault exception state of the memory area in real time, thereby building a real-time attack environment for conditional control flow memory page access.

[0026] Step 2: Allocate a limited number of physical memory page frames (PageFrame) to the target application using the memory management unit MMU, and record the physical memory page number corresponding to the triggered system interrupt or page fault exception when the target application starts executing, to generate a page fault exception sequence;

[0027] Obtain the physical memory page number triggering the page fault exception, generate the page fault exception sequence, and the specific implementation includes the following sub-steps:

[0028] Step 2.1: Monitor the memory page fault exception information during program execution using the performance counter (Performance Counter), and repeatedly adjust the attack parameters multiple times to detect the anti-controlled channel attack performance of the target program.

[0029] Specifically, the performance counter sets the common indicators to reflect the running status of the process, and provides the basis for application system monitoring or tracking optimization. The counter (Page Fault / sec) in the performance counter records the speed of the page fault exception caused by the execution thread in the process. Based on the counter (Page Fault / sec), the memory performance data of the target program during running is monitored, and the page fault exception rate is monitored in real time to adjust the number of physical memory page frames pre-allocated to the target process. When the number of allocated memory page frames is set to 1, the binary code of the target program is loaded as instructions and stored in the allocated physical memory page. If the adjacent two instructions are mapped to two different memory page frames, a page fault exception will be generated and a system interrupt will be triggered, and the side channel attack framework SGX-Step will obtain the exception information, including the memory page frame number causing the page fault exception. For example, the first instruction I1 and the second instruction I2 in the adjacent two instructions are mapped to the first memory page P1 and the second memory page P2 respectively, and in order to execute the first instruction I1, the first memory page P1 is loaded into the physical memory. Subsequently, the OS tries to fetch the second instruction I2 and finds that it is located on the second memory page P2. Since the number of allocated physical memory page frames is only one, a page fault exception is triggered, and the first memory page P1 needs to be evicted from the memory and the second memory page P2 needs to be loaded into the allocated memory page. In this way, the side channel attack framework SGX-Step can obtain the sequence of memory page numbers of the page fault exception triggered during the running of the target program, that is, the page fault trace.

[0030] wherein the page fault exception rate is related to the number of allocated physical memory page frames. The more the number of allocated frames, the larger the memory space available for program running, and therefore fewer page faults or interrupts will be triggered, and the shorter the page fault trace obtained.

[0031] Step 2.2: Set the executable flag bit of the memory page to simulate whether it is loaded into the allocated memory space. When the number of allocated physical memory page frames is set to be greater than 1, a queue is defined to record the executable memory pages in the current state. When a page fault exception occurs, the page number of the triggered page fault exception is recorded in the queue and marked as executable.

[0032] Specifically, when the number of physical memory page frames is set to 1, it means that 1 physical memory page frame is allocated for the application to execute, i.e. the application can only execute on this memory page frame. At this time, the controlled channel leakage will be maximized, because when any two adjacent instructions are mapped to two different memory pages in the process space, the memory page exchange (the page where the previous instruction is located is evicted, and the page where the next instruction is located is read in) occurs, i.e. the process of triggering the page fault exception is triggered. When the number of physical memory page frames is set to be greater than 1, at least 2 page frames are allocated to the application for execution, and at this time a queue needs to be defined to record the memory page numbers loaded into the allocated memory space under the current state.

[0033] Specifically, the executable flag bit of the memory page is used to simulate whether it is loaded into the allocated memory space. In the attack initialization phase, all memory pages are set to be non-executable, and then the target application is waited to start execution. When the application accesses an instruction on a memory page, a page fault exception is triggered because the attribute of this memory page is non-executable. At this time, the malicious operating system can obtain the corresponding memory page number, set the corresponding memory page flag bit to executable, and record the memory page number in a queue. The memory page numbers recorded in this queue indicate that these memory pages are marked as executable, i.e. loaded into the allocated memory space. The capacity of the queue is equal to the size of the set number of physical memory page frames. Thereafter, the target application continues to execute and access the memory page that triggered the system interrupt before, until the next page fault occurs, and the cycle is repeated to obtain the complete page fault sequence. It should be noted that when the memory page number is recorded in the queue, the memory page is executable, and the next access will no longer trigger a page fault exception until it is marked as non-executable again.

[0034] Step 2.3: The executable memory page queue is maintained and managed by replacing the strategy FIFO, LRU or LFU, when the queue is full, the memory page number evicted from the queue is marked as non-executable, when the non-executable memory page number is accessed again, a page fault exception will be generated and a system interrupt will be triggered, at this time the open source side channel attack framework SGX-Step will obtain the exception information, i.e. the memory page frame number causing the page fault exception, and a plurality of memory page frame numbers causing the page fault exception constitute a page fault sequence.

[0035] Specifically, when the executable memory page queue is full, the allocated memory space has been completely occupied by the application. If a page fault exception is triggered again at this time, it indicates that the application accesses a memory page that is not recorded in the queue. In the interrupt processing function Page_Fault_Handler, memory page exchange needs to be controlled, a certain page recorded in the queue is selected to be evicted from the physical memory space, and the page to be accessed is loaded. At this time, a replacement strategy needs to be used to maintain and manage the executable memory page queue, that is, when the executable memory page queue is full, a memory page to be evicted is selected according to the pre-set strategy, which is marked as non-executable (Non-executable) and its page number is deleted from the queue. There are usually three different replacement strategies for evicting memory pages, which are: First In First Out (FIFO), Least Recently Used (LRU) and Least Frequently Used (LFU). In the embodiment of the application, when the queue is full, the least recently used algorithm (LRU) is selected as a reference, the least recently used memory page number is evicted from the queue, and the corresponding memory page is marked as non-executable (Non-executable), so as to realize the replacement of elements in the queue.

[0036] If a memory page is accessed recently, it is also more likely to be accessed again in the future for a period of time. The idea of LRU replacement strategy is to evict the least recently requested memory page to maximize the reduction of page faults. In the executable memory page queue based on LRU replacement strategy, whenever an already recorded memory page in the queue is accessed, its page number will be moved to the head of the queue, and all the remaining page numbers in the queue will be moved one bit back. When the queue is full and a memory page not recorded in the queue is accessed, the page number recorded at the end of the queue will be deleted, that is, the corresponding memory page will be marked as non-executable (Non-executable), and then all the remaining page numbers in the queue will be moved one bit back, and the memory page number to be accessed will be recorded at the head of the queue. Using this method to maintain and manage the executable memory page queue, the sequence of memory page numbers corresponding to the triggered page fault exceptions is recorded, and the page fault exception sequence is obtained.

[0037] The step 2 can further include:

[0038] Step 2.4: Adjust the attack parameters, and repeat steps 2.2-2.3 to detect the anti-controlled channel attack performance of the target application.

[0039] The open-source side channel attack framework SGX-Step simulates an attacker performing vulnerability analysis, and can adjust the number of allocated memory page frames in real time according to the rate of page fault exceptions. For different numbers of allocated physical memory page frames, corresponding page fault exception traces are output, and sensitive information related leaks in the traces are extracted according to subsequent steps.

[0040] The size of the physical memory page frame is set to 1 at initialization and is constantly expanded (i.e., the number of allocated physical memory page frames is constantly increased from 1). In each case, an attempt is made to recover sensitive information, and the amount of recoverable information is recorded. Until no useful information can be recovered, the current size of the physical memory page frame is recorded as a critical parameter, indicating the resistance of the sensitive application to controlled channel attacks, indicating that when the number of allocated physical memory page frames is greater than this critical value, the sensitive application does not exist. Controlled channel leakage. Traverse the value of the size of the physical memory page frame, output all captured page fault exception traces, and draw a curve of the amount of page fault exception leakage with the size of the allocated physical memory space to maximize the detection effect.

[0041] Step 3: Analyze the page fault exception sequence obtained in step 2, search for the longest subsequence that repeatedly appears in it, and record each longest subsequence and its repetition number;

[0042] Specifically, there are usually loop structure instructions (such as For-loop) in the algorithm of the target application program. When the program executes the loop structure instructions, the control flow (Control-flow) is the same, i.e., the underlying function is called, and the instruction execution trace is the same. Therefore, there should be the same subsequence trace in the page fault exception sequence collected using the above steps, which corresponds to the program loop structure instruction control flow. Analyze the obtained page fault exception sequence from a global perspective, search for the longest subsequence with a repetition number within a certain range, which corresponds to those loop structure instructions in the program control flow, so that part of the controlled channel leakage during program execution can be obtained. Among them, combined with the algorithm structure of the target application program, the longest subsequence obtained is related to the loop instructions in the source code of the target application program.

[0043] Exemplarily, the longest subsequence with a repetition number equal to the length of sensitive information is: in the EdDSA, RSA, ElGamal, etc. algorithms of the official password library Libgcrypt, the same loop structure instructions are executed when processing each bit of sensitive information, and the same subsequence trace can be obtained, so the repetition number is approximately equal to the number of sensitive information bits; the longest subsequence with the most repetition number is: in the application software FreeType, the same loop structure instructions are executed multiple times when processing each input character, and the same subsequence trace can be obtained, so the repetition number is the most.

[0044] In this step, the key is to search the longest sub-sequence with specific range and repetition times. The DC3 algorithm based on suffix array (Suffix Array) is used for searching, and the specific implementation includes the following sub-steps:

[0045] Step 3.1: For a page fault sequence Str with length n, define a string array Suffix[n] to record all suffixes of the page fault sequence Str.

[0046] Step 3.2: To reduce the time complexity, use the DC3 algorithm to sort all suffixes recorded in the string data Suffix[n] defined in step 3.1 in alphabetical order, and record the first letter sequence number of these sorted suffixes in a new array Sa[n] in order. Sa[n] is the suffix array of the page fault sequence, and Sa[i] represents the index of the first letter of the suffix ranked i in all suffixes recorded in Suffix[n].

[0047] Step 3.3: According to the suffix array Sa[n] constructed in step 3.2, the corresponding rank array Rank[n] can be constructed to record the rank of all suffixes in Suffix[n]. That is, Rank[i] represents the rank of Suffix[i] in all suffixes.

[0048] Step 3.4: According to Sa[n] and Rank[n], construct the height array Height[n] to record the length of the longest common prefix between two adjacent suffixes with the same rank. That is, Height[i] represents the length of the longest common prefix between Suffix[Sa[i]] and Suffix[Sa[i-1]], which can be calculated by comparing the suffix array Sa[n] in order. Obviously, the maximum value in Height[n] records the length of the longest sub-sequence that appears repeatedly in the sequence, and the index value of MAX(Height[n]) can be used to obtain the position of the longest sub-sequence in the entire page fault sequence, that is, the longest sub-sequence with the most repetition times can be searched.

[0049] Step 4: Analyze the page fault sequence obtained in step 2, based on the longest sub-sequence searched in step 3, calculate the distance vector, average value, and variance between two adjacent longest sub-sequences;

[0050] In the embodiment of the present application, the subsequence found in step 3 is used to segment the page fault exception sequence, all the longest subsequences in the sequence are marked as LRS, and the distance vector, mean value, variance and other information between two adjacent LRSs are calculated. The distance information between two adjacent longest subsequences in a page fault exception sequence can be used for further analysis of sensitive information. The distance vector, mean value, variance and other information between the longest subsequences obtained have correlation with sensitive information in the target application program.

[0051] Distance vector: according to step 3.4, the indices corresponding to all the maximum values in the height array Height[n] are taken, and the subscript values are recorded in order to obtain an index array LRS[k]. That is, in the index array LRS[k], for any i∈[0,k-1], it satisfies Height[LRS[i]]=MAX(Height[n]. The index array LRS[k] records the position sequence number of all searched longest subsequences in the page fault exception sequence. According to LRS[k], the distance vector dist[k-1] between all adjacent two LRSs in the page fault exception sequence is calculated. That is, for any i∈[0,k-2], dist[i]=LRS[i+1]-LRS[i] is calculated.

[0052] Mean value: the mean value of all distances in the distance vector is calculated The ratio of the number of 0 and 1 bits in the sensitive information of the application program can be represented.

[0053] Variance: the variance of all distances in the distance vector is calculated The deviation of each bit value from the mean value of the sensitive information of the application program can be represented. Combined with the mean value, it can be used to analyze the composition of the sensitive information.

[0054] Step 5: according to the model of controlled channel attack, for each page fault exception sequence, all the longest subsequences and their repetition times, the distance vector, mean value, variance and other information between two adjacent longest subsequences are taken as the page fault exception feature information, and machine learning and other methods are used to analyze the correlation between the page fault exception feature information and the target application program, so as to detect the controlled channel vulnerability of the sensitive application program.

[0055] Specifically, taking the machine learning method as an example, the above steps 2 to 4 are repeated several times according to the program complexity of the measured object to collect a sufficient number of data sets, wherein each set of data in the data set contains an input data (the page fault exception information obtained in steps 3 and 4) and a label (the target application sensitive information). The data set is divided into a training set and a test set according to a self-defined ratio. Among them, on the training set, the page fault exception information (the length of the searched LRS, the number of repetitions, the distance vector between the two adjacent LRSs in the whole sequence, the average value, the variance, etc.) is subjected to data enhancement processing. In the embodiment of the application, a neural network such as LSTM, RNN or CNN is selected for training to obtain a trained neural network model. Subsequently, on the test set, the accuracy of the neural network model is tested. According to the measured accuracy of the neural network model, the correlation between the page fault exception feature information and the application sensitive information is analyzed, and the accuracy of the neural network model is taken as the controlled channel vulnerability of the target application.

[0056] Embodiment 1

[0057] Taking the double-and-add as an example, which is a classical algorithm in the scalar point multiplication method of the target application, the controlled channel vulnerability in the loop instruction module is analyzed. The algorithm is implemented as Q = scalar_mul(r[·], G), wherein Q is a point on an elliptic curve, r[·] is a scalar coefficient, and G is a base point. The calculation process is as follows: r[·] is expressed in binary form and each bit is selected from left to right. When the selected bit is 0, a double-point calculation Func_double is performed. When the selected bit is 1, in addition to the double-point calculation Func_double, a point addition calculation Func_add is also performed. Therefore, for each bit in the scalar coefficient r[·], the target application will call the double-point function once, and only when the bit is 1, the target application will additionally call the point addition function once. The difference of this algorithm in the controlled channel leakage is that, compared with the bit being 0, when the bit is 1, the program will execute more instructions, which corresponds to triggering more page faults, i.e. the distance between the two adjacent sub-sequences searched will be larger.

[0058] The double-and-add program is tested by using the controlled channel vulnerability automatic detection method based on the control flow page access analysis provided by the application, which specifically includes the following steps:

[0059] Step 1: Build a real-time attack environment for conditional control flow memory page access, and control the target application to start executing on the allocated physical memory area;

[0060] Step 2: The number of restricted physical memory page frames allocated to the target application by the memory management unit (MMU) is recorded when the target application starts executing, and the physical memory page numbers corresponding to the triggered system interrupts or page fault exceptions are recorded to generate a page fault exception sequence;

[0061] Step 3: Analyze the page fault exception sequence obtained in step 2, search for the longest subsequence that repeatedly appears in it, and record each longest subsequence and its repetition times;

[0062] Step 4: Analyze the page fault exception sequence obtained in step 2, based on the longest subsequence searched in step 3, calculate the distance vector, mean value, and variance between adjacent two longest subsequences;

[0063] Step 5: According to the model of controlled channel attack, for each page fault exception sequence, the searched longest subsequence and its repetition times, the distance vector, mean value, and variance between adjacent two longest subsequences are used as page fault exception feature information, and machine learning or other methods are used to analyze the correlation between the page fault exception feature information and the target application, so as to detect the controlled channel vulnerability of the sensitive application.

[0064] Specifically, the open source side channel attack framework SGX-Step controls the target algorithm to implement double-and-add to start executing on the allocated physical memory area, and the detection source code of the present application is injected into the loadable kernel module of the side channel attack framework SGX-Step to realize editing page table entry (PTE) and registering page fault exception handling function Page_Fault_Handler. A random number is generated as a scalar coefficient r[·] input to the double-and-add algorithm for calculation, and this random number is used as sensitive information of the target application, and the subsequent steps obtain page fault exception feature information related to this random number.

[0065] The number of allocated physical memory page frames is set to start increasing from 1, and in each case, the obtained page fault exception feature information is recorded. Specifically, the present embodiment sets the number of allocated physical memory page frames to 8 pages, and inputs a 512-bit random number as a scalar coefficient r[·] into the double-and-add algorithm to start executing.

[0066] According to step 2, the side channel attack framework SGX-Step captures the physical memory page numbers corresponding to the triggered system interrupts or page fault exceptions to generate a page fault exception sequence, which contains 121836 page fault exceptions. According to the double-and-add algorithm, the number of times the loop instruction module is repeatedly executed is equal to the number of bits of the input scalar coefficient, i.e. 512.

[0067] According to step 3, the longest sub-sequence with a repetition number of about 512 times in the page fault exception sequence is searched to obtain a longest sub-sequence LRS = [38, 17B, 17C, 179, 17F, 3B, 3D, …, 33], with a length of 72 and a repetition number of 511.

[0068] According to step 4, the page fault exception sequence is segmented using the searched sub-sequence, all the longest sub-sequences in the sequence are marked as LRS, and the distance vector between two adjacent LRSs is calculated, obtaining two different distance values, 143 and 331. According to the algorithm characteristics, 143 corresponds to the execution bit of 0, that is, the double-point calculation Func_double is performed only once; 331 corresponds to the execution bit of 1, that is, in addition to the double-point calculation Func_double, the point addition calculation Func_add is also performed once. The obtained distance vector is dist[n] = [143, 331, 143, 331, 331, 143, 143, 331, 143, …], and the average value is 238 and the variance is 8837 according to the calculation.

[0069] According to step 5, the correlation between the page fault exception feature information obtained in the above steps and the sensitive information of the target application program is analyzed. The double-and-add algorithm is repeatedly executed 1000 times, and the corresponding page fault exception information is collected to construct a data set, wherein each group of data in the data set contains input data (page fault exception feature information) and a label (target application program sensitive information). The page fault exception feature information includes the searched longest sub-sequence and its repetition number, the calculated distance vector dist[n] and its average value and variance; the target application program sensitive information is the scalar coefficient r[·] of the input program. The data set is divided into a training set and a test set according to a self-defined ratio. In the embodiment of the present application, a TCN neural network model is selected for training, and a TCN model includes a plurality of causal convolution blocks, each causal convolution block is composed of 2 convolution layers, 2 rectification layers, 2 linear rectification ReLU activation layers and 2 random inactivation Dropout layers. The cross-entropy loss function is used as the loss function, the SGD is used as the optimization strategy, the batch_size is set to 16, the dropout rate is set to 0.45, and the total number of training rounds epoch is set to 100. Since the label is a 512-bit scalar coefficient r[·], it is too large, and it is considered to be decomposed into 32 16-bit groups for training and finally considering the model accuracy. The model accuracy calculated by the embodiment of the present application on the test set is 92.5%, that is, the page fault exception feature information and the application program sensitive information have high correlation, and the double-and-add algorithm implementation is relatively fragile and vulnerable to controlled channel attacks.

[0070] It should be noted that the embodiment 1 described above is only a preferred detection target of the present application, and is not intended to limit the present application. For any application, as long as the algorithm complexity of the loop instruction module in the conditional control flow is related to the application sensitive information, the leakage information detected by the embodiment can be used for controlled channel analysis.

[0071] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for controlled channel vulnerability automated detection based on control flow page access analysis, characterized in that, The method comprises the following steps: Step 1: build a conditional control flow memory page access real-time attack environment, and control the target application program to start executing on the allocated physical memory area; Step 2: allocate a limited number of physical memory page frames to the target application program by using a memory management unit (MMU), and record the physical memory page numbers corresponding to the triggered system interrupts or page fault exceptions when the target application program starts executing, to generate a page fault exception sequence; Step 3: analyze the page fault exception sequence obtained in step 2, search for the longest sub-sequence that repeatedly appears in the sequence, and record each longest sub-sequence and its repetition times; Step 4: analyze the page fault exception sequence obtained in step 2, calculate the distance vector, mean value and variance between adjacent longest sub-sequences based on the longest sub-sequences searched in step 3; Step 5: use machine learning to analyze the correlation between the page fault exception feature information and the target application program, and detect the controlled channel vulnerability of the sensitive target application program, by taking each longest sub-sequence and its repetition times, the distance vector, mean value and variance between adjacent longest sub-sequences as the page fault exception feature information.

2. The controlled channel vulnerability automated detection method based on control flow page access analysis according to claim 1, characterized in that, The step 1 is specifically: simulate the attacker in the standard Intel SGX controlled channel attack threat model by using a side channel attack framework SGX-Step, obtain the permission to control the system software with privileges, and control the memory management unit (MMU) to manage the memory pages corresponding to the trusted world Enclave; the side channel attack framework SGX-Step controls the target application program to start executing on the allocated physical memory area, and monitors the page fault exception state of the memory area in real time, thereby building a conditional control flow memory page access real-time attack environment.

3. The controlled channel vulnerability automated detection method based on control flow page access analysis according to claim 1, wherein, The step 2 specifically comprises the following sub-steps: Step 2.1: monitor the memory page fault exception information of the target application program during runtime by using a performance counter; Step 2.2: set the executable flag bit of the memory page to simulate whether it is loaded into the allocated memory space; when the number of allocated physical memory page frames is greater than 1, define a queue to record the executable memory pages in the current state; when a page fault exception occurs, record the page number that triggers the page fault exception in the queue and mark it as executable; Step 2.3: maintain and manage the executable memory page queue by using a replacement strategy such as FIFO, LRU or LFU; when the queue is full, the memory pages that are evicted from the queue are marked as non-executable; when the non-executable memory page is accessed again, a page fault exception will be caused and a system interrupt will be triggered, and the exception information, i.e. the memory page number that causes the page fault exception, is obtained, and the memory page numbers that cause the page fault exception form a page fault exception sequence.

4. The controlled channel vulnerability automated detection method based on control flow page access analysis according to claim 3, wherein, The step 2 further comprises: Step 2.4: adjust the attack parameters and repeat steps 2.2-2.3 several times to detect the anti-controlled channel attack performance of the target application program.

5. The controlled channel vulnerability automated detection method based on control flow page access analysis of claim 3, wherein, The step 2.2 comprises: When the number of physical memory page frames is set to 1, the target application can only execute on this memory page frame; at this time, the controlled channel leakage will be maximized, triggering the page fault exception interrupt process; when the number of physical memory page frames is set to be greater than 1, the memory space allocated to the target application for execution is at least 2 page frames, and a queue needs to be defined to record the memory page numbers loaded into the allocated memory space under the current state; The executable flag bit of the memory page is used to simulate whether it is loaded into the allocated memory space; in the attack initialization stage, all memory pages are set as non-executable, and then the target application is waited to start execution; when the target application accesses the instructions on a memory page, if the memory page attribute is non-executable, a page fault exception will be triggered; at this time, the malicious operating system can obtain the corresponding memory page number, set the corresponding memory page flag bit as executable, and record the memory page number in a queue; the memory page numbers recorded in the queue represent that these memory pages are marked as executable, that is, loaded into the allocated memory space; the capacity of the queue is equal to the size of the set physical memory page frame number; the target application continues to execute and access the memory page that triggered the system interrupt before, until the next page fault exception occurs, and the cycle is repeated to obtain the complete page fault exception sequence.

6. The controlled channel vulnerability automated detection method based on control flow page access analysis according to claim 3, wherein, The process of selecting LRU replacement strategy to maintain and manage the executable memory page queue in step 2.3 includes: The LRU replacement strategy is used to evict the least recently requested memory page; in the executable memory page queue based on the LRU replacement strategy, whenever a memory page recorded in the queue is accessed, its page number will be moved to the head of the queue, and all the remaining page numbers in the queue will be moved one position back; when the queue is full and a memory page not recorded in the queue is accessed, the page number recorded at the end of the queue will be deleted, that is, the corresponding memory page will be marked as non-executable, and then all the remaining page numbers in the queue will be moved one position back; the accessed memory page number is recorded at the head of the queue, thereby recording the memory page number sequence corresponding to the triggered page fault exception, and obtaining the page fault exception sequence.

7. The controlled channel vulnerability automated detection method based on control flow page access analysis of claim 1, wherein, The step 3 of searching for the longest subsequence with the most repetitions includes the following two cases: (A) searching for the longest subsequence with the number of repetitions equal to the length of the sensitive information in the page fault exception sequence obtained in step 2: in algorithms such as EdDSA, RSA, and ElGamal including the official password library Libgcrypt, the same loop structure instruction is executed when processing each bit of sensitive information, and the same subsequence trace can be obtained, so the number of repetitions is approximately equal to the number of bits of sensitive information; (B) searching for the longest subsequence with the most repetitions in the page fault exception sequence obtained in step 2.

8. The controlled channel vulnerability automated detection method based on control flow page access analysis according to claim 1, wherein, The DC3 algorithm is used to search for the longest subsequence in step 3, which includes the following substeps: Step 3.1: for a page fault exception sequence Str with a length of n, define a string array Suffix[n] to record all the suffixes of the page fault exception sequence Str; Step 3.2: Sort all suffixes recorded in the string data Suffix[n] defined in step 3.1 in alphabetical order, and sequentially record the first letter ordinal numbers of these sorted suffixes into a new array Sa[n]; Sa[n] is a suffix array of the page fault sequence, and Sa[i] represents the index of the first letter position of the suffix ranked i among all suffixes recorded in Suffix[n]; Step 3.3: According to the suffix array Sa[n] constructed in step 3.2, construct a corresponding rank array Rank[n] for recording the rankings of all suffixes in Suffix[n]; that is, Rank[i] represents the ranking of Suffix[i] among all suffixes; Step 3.4: According to Sa[n] and Rank[n], construct a height array Height[n] for recording the length of the longest common prefix between two suffixes with adjacent rankings; that is, Height[i] represents the length of the longest common prefix between Suffix[Sa[i]] and Suffix[Sa[i-1]], which can be calculated by sequentially comparing the suffix array Sa[n]; The maximum value in Height[n] records the length of the longest repeated subsequence in the sequence, and the index value of MAX(Height[n]) can be used to search for the position of the longest repeated subsequence in the entire page fault sequence, that is, to search for the longest repeated subsequence.

9. The controlled channel vulnerability automated detection method based on control flow page access analysis according to claim 8, wherein, The step 4 is specifically: Analyzing the page fault sequence obtained in step 2, based on the longest subsequence searched in step 3, marking all longest subsequences in the sequence as LRS, calculating the distance vector, mean value, and variance between adjacent longest subsequences LRS; The calculation process of the distance vector is as follows: according to the indices corresponding to all maximum values in the height array Height[n] constructed in step 3.4, sequentially record the subscript values to obtain an index array LRS[k]; that is, for any i∈[0,k-1], it satisfies Height[LRS[i]]=MAX(Height[n]); The index array LRS[k] records the position sequence number of all searched longest subsequences in the page fault sequence, and according to LRS[k], the distance vector dist[k-1] between all adjacent LRS in the page fault sequence is calculated; that is, for any i∈[0,k-2], calculate dist[i]=LRS[i+1]-LRS[i]; The calculation process of the average value is: calculating the average value of all distances in the distance vector The process of calculating the variance is: calculating the variance of all distances in the distance vector 10. The controlled channel vulnerability automated detection method based on control flow page access analysis of claim 1, wherein, The step 5 is specifically: The longest subsequence, the number of repetitions of each longest subsequence, the distance vector between two adjacent longest subsequence, the average value and the variance are taken as the page fault exception characteristic information, a neural network model is constructed, the neural network model is trained based on the page fault exception characteristic information and sensitive information of the target application program, the trained neural network model is tested, the accuracy of the neural network model is obtained, the correlation between the page fault exception characteristic information and the target application program is analyzed, so as to detect the controlled channel vulnerability of the sensitive target application program; the higher the accuracy of the neural network model is, the higher the correlation between the page fault exception characteristic information and the target application program is, and the more vulnerable the target application program is.

Images