A state variable inference-based Internet of Things trusted execution environment kernel fuzzing method and system

Abstract

The application discloses a state variable inference-based Internet of Things trusted execution environment kernel fuzzing method and system, and belongs to the field of Internet of Things trusted execution environment kernel testing. The method comprises the following steps: constructing a test sample template file based on document analysis to assist in fuzzing; collecting feedback information based on the fuzzing execution of a hardware simulator; inferring a state variable structure member of the Internet of Things trusted execution environment kernel by using an active testing method; scoring the fuzzing seeds by comprehensively testing sample code coverage information and system state information, and optimizing high-score seeds for fuzzing. The state variable inference-based Internet of Things trusted execution environment kernel fuzzing method and system can efficiently test the Internet of Things trusted execution environment kernel.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of Internet of Things Trusted Execution Environment kernel testing, and in particular to an Internet of Things Trusted Execution Environment fuzzing method and system based on state variable inference. BACKGROUND

[0002] With the continuous development of information technology, more and more Internet of Things devices are widely used in privacy-related scenarios such as face recognition, fingerprint unlocking, and permission allocation. In order to protect data security and prevent illegal intrusion, the industry proposes a Trusted Execution Environment (TEE) to divide the program running space into a secure world and an insecure world. The insecure world cannot access the secure world, thereby providing a trusted execution environment for the key data and trusted applications of Internet of Things devices stored in the secure world.

[0003] However, in recent years, security research and real-life events have shown that there may be defects in the implementation of Internet of Things Trusted Execution Environments. For example, the functions implemented by the Trusted Execution Environment require a data constraint relationship between the input parameters, but no check is performed on it internally; related trusted application developers may ignore or omit this constraint relationship, causing the Trusted Execution Environment to crash and triggering data leakage or denial-of-service attacks.

[0004] The main challenges in designing an efficient automated testing analysis method for Internet of Things Trusted Execution Environments are as follows: (1) heavy reverse analysis workload. Most Internet of Things Trusted Execution Environments are closed-source implementations, and different manufacturers design customized implementation schemes with significant differences; (2) Internet of Things Trusted Execution Environments have state information. Since Internet of Things Trusted Execution Environments are mainly used to execute cryptography-related algorithms, they rely on system state in sequence operations such as algorithm selection, key padding, and encryption and decryption operations, making it difficult for traditional fuzzing tools to effectively use state information to guide fuzzing.

[0005] In summary, there is currently no efficient automated testing analysis method for Internet of Things Trusted Execution Environments, and it is important and necessary to design a method and system that automatically infers state variables from Internet of Things Trusted Execution Environments and performs efficient fuzzing. SUMMARY

[0006] In view of the above, the purpose of the present application is to provide an Internet of Things Trusted Execution Environment kernel fuzzing method and system based on state variable inference, which realizes efficient security testing.

[0007] The state variable inference-based Internet of Things trusted execution environment kernel fuzz testing method of the application first uses a hardware simulator to track parameter information transmitted when an Internet of Things trusted application interacts with a trusted execution environment, infers global state variable structure member variables by using an active testing method, and comprehensively covers performance of a fuzz testing seed code and state access performance, so that a fuzz testing seed with higher code coverage and more inclined to access rare states is preferred, and the efficiency of the fuzz testing is improved.

[0008] In order to achieve the above-mentioned purpose, the specific technical scheme adopted by the application is as follows:

[0009] A state variable inference-based Internet of Things trusted execution environment kernel fuzz testing method, comprising the following steps:

[0010] Step 1: according to the Internet of Things trusted execution environment document, a test sample template file is constructed and a state variable structure body is initially selected;

[0011] Step 2: a trusted application program is run, and execution logs of the trusted application program are collected and analyzed, a fuzz testing seed queue is constructed according to the log information, fuzz testing is carried out on the seed queue, and fuzz testing feedback information is collected;

[0012] Step 3: according to the initially selected state variable structure body and the current fuzz testing feedback information, the member variable information of the Internet of Things trusted execution environment kernel state variable structure body is inferred by using an active testing method, and is used as the Internet of Things trusted execution environment kernel state information;

[0013] Step 4: according to the Internet of Things trusted execution environment kernel state information inferred in step 3 and the current fuzz testing feedback information, a comprehensive selection score of the fuzz testing seed is calculated, a fuzz testing seed with a higher score is preferably selected for testing, and fuzz testing feedback information is collected;

[0014] Step 5: steps 3-4 are repeatedly executed until the fuzz testing is completed.

[0015] As a preferred embodiment of the application, step 1 comprises:

[0016] Step 1-1: function interface information and global variable information defined by the trusted execution environment kernel are extracted from the Internet of Things trusted execution environment document; the function interface information comprises function name, function parameter number, function parameter type and function return value type, and the global variable information comprises variable name, variable type, structure variable sub-member name and type;

[0017] Step 1-2: the function interface information and the global variable information obtained in step 1-1 are expressed as a trusted execution environment test sample template in a formal language, and structure variables commonly used by the function interfaces are selected as the state variable structure.

[0018] As a preferred embodiment of the present application, the step 2 comprises:

[0019] Step 2-1: randomly selecting a function call sequence executed in the trusted application running process as a fuzzing initial seed, randomly mutating the seed based on the test sample template file obtained in step 1 and carrying out fuzzing test;

[0020] Step 2-2: while carrying out the fuzzing test in step 2-1, collecting fuzzing feedback information in real time using a hardware simulator.

[0021] As a preferred embodiment of the present application, the fuzzing feedback information comprises code coverage information, function name of the function call sequence, function parameters and function return value.

[0022] As a preferred embodiment of the present application, the step 3 comprises:

[0023] Step 3-1, initializing the state variable structure obtained in step 1;

[0024] Step 3-2: comparing the function parameter memory data before and after the function call according to the function parameter information in the current fuzzing feedback information collected, and inferring the offset of the integer type, enumeration type, string or array pointer type sub-member variable in the state variable structure;

[0025] Step 3-3: according to the offset information inferred in step 3-2, screening out the integer type and enumeration type sub-members from the state variable structure as the trusted execution environment kernel state.

[0026] As a preferred embodiment of the present application, the step 4 comprises:

[0027] Step 4-1: calculating the fuzzing seed code coverage score according to the code coverage information in the current fuzzing feedback information collected;

[0028] Step 4-2: calculating the fuzzing seed state variable score according to the Internet of Things trusted execution environment kernel state information inferred in step 3;

[0029] Step 4-3: calculating the fuzzing seed comprehensive score according to the seed code coverage score and the state variable score calculated in step 4-1 and step 4-2, and preferably mutating and testing the seed with a higher comprehensive score.

[0030] As a preferred embodiment of the present application, the fuzzing seed state variable score is Wherein, X p is the number of rare state information accessed by the fuzzing seed p, and Y is the total number of all rare state information in the current fuzzing test.

[0031] The application further provides a state variable inference-based Internet of Things trusted execution environment kernel fuzzing test system, which is used for the Internet of Things trusted execution environment kernel fuzzing test method.

[0032] An initialization module is configured to extract function interface information and global variable information defined by the trusted execution environment kernel from an Internet of Things trusted execution environment document, construct a test sample template file and preliminarily select a state variable structure;

[0033] A test and feedback module is configured to perform fuzzing test on the seed queue and collect fuzzing test feedback information in real time by using a hardware simulator;

[0034] A state variable inference module is configured to infer sub-member information of the state variable structure of the Internet of Things trusted execution environment kernel based on an active learning algorithm according to the feedback information collected by the test and feedback module and the state variable structure preliminarily selected by the initialization module, and use the sub-member information as the state information of the trusted execution environment kernel;

[0035] A seed score calculation module is configured to calculate the score of each seed according to the fuzzing test feedback information collected by the test and feedback module and the state information of the trusted execution environment kernel obtained by the state variable inference module, and preferably perform fuzzing test on the seed with a high score.

[0036] Compared with the prior art, the application has at least the following beneficial effects:

[0037] (1) The application provides a state variable inference-based Internet of Things trusted execution environment kernel fuzzing test method, which analyzes the relationship between the state variable structure and the function parameters required by different kernel function calls through active test analysis, efficiently realizes a data flow-based mutation method, and improves the fuzzing test efficiency;

[0038] (2) The application uses a hardware simulator to obtain the memory information of the Internet of Things device in real time, avoids the huge manual cost caused by rehosting in the traditional scene, avoids the distortion of the vulnerability caused by software simulation, improves the accuracy of vulnerability discovery, and reduces the false positive rate;

[0039] (3) The application has good scalability. When migrating between trusted execution environments of Internet of Things developed by different manufacturers, the function interface information and global variable information are extracted according to the corresponding document, the test sample template is updated synchronously, the state variable inference-based fuzzing test method is realized, and the fuzzing test efficiency is improved. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0041] Figure 1 is a flowchart of the state variable inference-based Internet of Things trusted execution environment kernel fuzz testing method provided by the present embodiment;

[0042] Figure 2 is a schematic diagram of the state variable inference method based on active testing provided by the present embodiment;

[0043] Figure 3 is a structural diagram of the state variable inference-based Internet of Things trusted execution environment kernel fuzz testing system provided by the present embodiment. DETAILED DESCRIPTION

[0044] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the protection scope of the present application.

[0045] In view of the deficiencies in the academic and industrial fields in testing the Internet of Things trusted execution environment kernel, the present embodiment provides a state variable inference-based Internet of Things trusted execution environment kernel testing method and system, which realizes efficient fuzz testing. Specifically, by analyzing the Internet of Things trusted execution environment document, a test sample template file is constructed, a trusted application program is run, and an analysis program execution log is collected to construct a fuzz testing seed queue. According to the template information and the fuzz testing feedback information, the method of active testing is used to infer the sub-member variable information of the Internet of Things trusted execution environment kernel state variable structure, which is used to evaluate the state variable score of the fuzz testing seed. At the same time, the code coverage information is combined to evaluate the code coverage score of the fuzz testing seed. The state score and the code coverage score are comprehensively used as the evaluation score of the fuzz testing seed, and the high-score seed is optimized for fuzz testing.

[0046] As shown in Figure 1 , the state variable inference-based Internet of Things trusted execution environment kernel fuzz testing method provided by the present embodiment includes the following steps:

[0047] Step 1, analyze the Internet of Things trusted execution environment document, and construct a test sample template file.

[0048] In this embodiment, the test example template file is constructed from the trusted execution environment development document provided by the Internet of Things manufacturer, and specifically includes the following steps:

[0049] Step 1-1, analyze the Internet of Things trusted execution environment document, and extract the function interface information and global variable information defined by the trusted execution environment kernel.

[0050] In this embodiment, the extracted function interface information includes function name, function parameter number, function parameter type, and function return value type; and the extracted global variable information includes variable name, variable type, structure variable sub-member name, and type. The function interface refers to the function declaration provided by the Internet of Things trusted execution environment kernel to the trusted application, which is used to generate a fuzz test function call sequence; and the global variable refers to the macro definition and structure variable used when the Internet of Things trusted execution environment kernel interacts with the trusted application. It should be noted that the macro definition includes but is not limited to various encryption, decryption, and hash algorithm numbers and key lengths used by the algorithms specified in the trusted execution document; and the structure variable includes but is not limited to various encryption and decryption algorithm operation sub-members specified in the trusted execution document.

[0051] Step 1-2, according to the function interface information and global variable information obtained in step 1-1, analyze the structure variable commonly used by the function interface, and determine it as a state variable structure. In this embodiment, the structure variable commonly used by the function interface refers to the structure variable commonly used by multiple function interfaces, which is used to store algorithm parameters and algorithm execution phase information.

[0052] Step 1-3, express the function interface information and global variable information obtained in step 1-1 in a formal language as a trusted execution environment test example template.

[0053] In this embodiment, the test example template is constructed using the formal language Syzlang. The test example template includes function name, function parameters and types, function return value type, global variable type, and the like.

[0054] Step 2, run the trusted application program, collect and analyze program execution logs, construct a seed queue and expand the fuzz test, and collect fuzz test feedback information.

[0055] In this embodiment, the trusted application program is first run and the program execution logs are collected and analyzed, including function name, function parameters, function return values, and the like of the system call sequence. On this basis, the function call sequence executed during the running of the trusted application program is extracted as the initial seed for the fuzz test, and the fuzz test is performed. During the test, according to the trusted execution environment test example template obtained in step 1, the fuzz test seed is mutated, and the feedback information such as code coverage information, function name, function parameters, and function return values of the function call sequence is collected synchronously using a hardware emulator.

[0056] Step 3, according to the state variable structure collected in step 1-2 and the current collected fuzzy test feedback information, deduce the sub-member variable information of the state variable structure in the Internet of Things trusted execution environment kernel. In this embodiment, the method of active testing is used to deduce the sub-members of the state variable structure, which specifically includes the following steps:

[0057] Step 3-1, initialize the state variable structure obtained in step 1-2.

[0058] In this embodiment, when the active test starts, the field indicating the memory size in the header of the state variable structure memory block is read through the hardware emulator to determine the maximum memory space occupied by the state variable structure, and a memory space of the same size is initialized locally to save the memory data of the state variable structure.

[0059] Step 3-2, according to the global variable information obtained in step 1-1 and the function parameter information in the current collected fuzzy test feedback information, compare the changes of the state variable structure memory data before and after the function call to deduce the sub-member variables.

[0060] In order to further facilitate the understanding of those skilled in the art, the process of deducing the sub-members of the state variable structure by the method of active testing is as shown in Figure 2 First, compare the memory of the state variable structure that changes before and after the function call to filter the sub-member variables that are irrelevant to the function parameters; compare the function parameters of integer type and enumeration type with the memory data in turn every four bytes and every eight bytes, if they are equal, it is considered that the memory area stores the corresponding function parameter, and the starting address and the ending address of the memory data in the state variable structure are recorded as the offset of the sub-member variable. According to this offset deducing method, further, the same fuzzy test seed is executed repeatedly for many times, a memory allocation function (TEE_Malloc) is inserted before each execution, and different sizes of memory space are allocated, by comparing the changes of the state variable structure memory data in different execution rounds, the sub-member variables of string pointer and array type and their offsets are deduced. Finally, the constant sub-members and their offsets are deduced according to the memory data that does not change during multiple executions.

[0061] Step 3-3, according to the offset of the sub-member variable determined in step 3-2, filter out the integer type and enumeration type sub-members from the state variable structure as the Internet of Things trusted execution environment kernel state information.

[0062] Step 4, according to the Internet of Things trusted execution environment kernel state information deduced in step 3-3, combine the code coverage information in the current collected fuzzy test feedback information, optimize the fuzzy test seed for testing, and collect the fuzzy test feedback information.

[0063] In this embodiment, the comprehensive score of each fuzzing seed is obtained by calculating the code coverage score and the state variable score of the seed. In the fuzzing process, the seeds with higher comprehensive scores are selected with higher probability for mutation and testing. Specifically, it includes:

[0064] Step 4-1, according to the code coverage information in the current collected fuzzing feedback information, the code coverage score of the fuzzing seed is calculated. For each fuzzing seed p, the ETM (Embedded Trace Macrocell) data packet generated by the Internet of Things hardware device during runtime is collected using a hardware emulator, and the actual executed branch jump address sequence Covs p = {Addr1, Addr2, …, Addr N} is calculated, and the number of addresses in the address sequence N is taken as the code coverage score, denoted as Cov p .

[0065] Step 4-2, according to the state information of the Internet of Things trusted execution environment kernel obtained in step 3-3, the state variable score of the fuzzing seed is calculated. For each state information s collected in the fuzzing process, its access times are denoted as Hit(s). Let the total number of state information collected in the fuzzing process be L, and for each state information s, if then the state information is rare, where s k is the kth state information collected in the fuzzing process. The total number of rare state information in the fuzzing process is denoted as Y, and the number of rare state information accessed by a single fuzzing seed p is denoted as X p , then the state variable score is calculated as

[0066] Step 4-3, according to the code coverage score and the state variable score obtained in steps 4-1 and 4-2, the comprehensive score of the fuzzing seed is calculated. For each fuzzing seed p, its comprehensive score is Further, in the fuzzing seed selection stage, the fuzzing seed p selection probability is where I is the set of all fuzzing seeds, Cov i is the code coverage score of the i-th fuzzing seed, and X i is the number of rare state information accessed by the i-th fuzzing seed.

[0067] In this embodiment, the fuzzing seeds with higher comprehensive scores can more fully explore the deep code of the Internet of Things trusted execution environment kernel, and mutating the system function parameters used by them can efficiently change the state of the Internet of Things trusted execution environment kernel, thereby improving the efficiency of fuzzing.

[0068] Based on the same inventive concept, the embodiment also proposes an Internet of Things trusted execution environment kernel fuzzing system based on state variable inference. As shown in Figure 3 The system comprises an initialization module, a test and feedback module, a state variable inference module and a seed score calculation module.

[0069] The initialization module is configured to analyze an Internet of Things trusted execution environment document, extract function interface information and global variable information defined by a trusted execution environment kernel from the document, and preliminarily select a state variable structure.

[0070] The test and feedback module is configured to perform fuzzing test on a seed queue and collect fuzzing test feedback information in real time using a hardware simulator.

[0071] The state variable inference module is configured to infer sub-member variable information of the state variable structure of the Internet of Things trusted execution environment kernel based on an active learning method according to the feedback information collected by the test and feedback module and the preliminarily selected state variable structure by the initialization module, and use the sub-member variable information as the state information of the trusted execution environment kernel.

[0072] The seed score calculation module is configured to calculate a score of each seed according to the feedback information collected by the test and feedback module and the state information of the trusted execution environment kernel obtained by the state variable inference module, and perform fuzzing test on a seed with a high score.

[0073] As to the system in the above embodiment, the specific manner in which the various units or modules perform operations has been described in detail in the embodiment of the method, and will not be described in detail here.

[0074] For the system embodiment, since it basically corresponds to the method embodiment, the relevant part can be referred to the part of the method embodiment. The system embodiment described above is only illustrative, and each module described above can be or can not be physically separated. In addition, each functional module in the present application can be integrated in one processing unit, or each module can be physically separated, or two or more modules can be integrated in one unit. The integrated module or unit can be realized in the form of hardware or software functional unit, and part or all of the modules can be selected to realize the purpose of the present application according to actual needs.

[0075] The above embodiments describe the technical solutions and advantages of the present application in detail. It should be understood that the above description is only a specific embodiment of the present application, and is not used to limit the present application. Any modification, supplement and equivalent replacement within the principle range of the present application shall be included in the protection range of the present application.

Claims

1. A kernel fuzzing method for a trusted execution environment of the Internet of Things based on state variable inference, characterized in that, Includes the following steps: Step 1: Based on the IoT Trusted Execution Environment documentation, construct a test case template file and initially select the state variable structure; Step 2: Run the trusted application, collect and analyze the trusted application execution logs, construct a fuzz test seed queue based on the log information, conduct fuzz tests on the seed queue, and collect fuzz test feedback information; Step 2 includes: Step 2-1: Randomly select the function call sequence executed during the operation of the trusted application as the initial seed for fuzz testing, and randomly mutate the seed based on the test sample template file obtained in Step 1 and carry out fuzz testing; Step 2-2: While conducting fuzz testing in step 2-1, use a hardware emulator to collect fuzz test feedback information in real time; Step 3: Based on the initially selected state variable structure and the current fuzz test feedback information, the sub-member variable information of the IoT Trusted Execution Environment kernel state variable structure is inferred using the active testing method, and used as the IoT Trusted Execution Environment kernel state information; Step 3 includes: Step 3-1: Initialize the state variable structure obtained in Step 1; Step 3-2: Based on the function parameter information collected in the current fuzzy test feedback information, compare the memory data of the function parameters before and after the function call, and infer the offset of the sub-member variables of integer type, enumeration type, string or array pointer type in the state variable structure; Step 3-3: Based on the offset information inferred in Step 3-2, select the integer and enumeration type sub-members from the state variable structure as the trusted execution environment kernel state; Step 4: Based on the IoT trusted execution environment kernel state information and current fuzz test feedback information inferred in Step 3, calculate the comprehensive selection score of the fuzz test seed, select the fuzz test seed with the higher score for testing, and collect fuzz test feedback information. Step 4 includes: Step 4-1: Calculate the fuzz test seed code coverage score based on the code coverage information collected in the current fuzz test feedback information; Step 4-2: Calculate the fuzz test seed state variable score based on the IoT trusted execution environment kernel state information inferred in Step 3; Step 4-3: Based on the seed code coverage score and state variable score calculated in Step 4-1 and Step 4-2, calculate the fuzzy test seed comprehensive score, and select the seed with the higher comprehensive score for mutation and testing; Step 5: Repeat steps 3-4 until the fuzz test is complete.

2. The method for kernel fuzz testing of a trusted execution environment for the Internet of Things based on state variable inference as described in claim 1, characterized in that, Step 1 includes: Step 1-1: Extract the function interface information and global variable information defined by the trusted execution environment kernel from the IoT trusted execution environment document; the function interface information includes function name, number of function parameters, function parameter types, and function return value type; the global variable information includes variable name, variable type, and the name and type of sub-members of structure variables. Step 1-2: Express the function interface information and global variable information obtained in Step 1-1 in a formal language as a test case template for the trusted execution environment, and select the structure variables shared by the function interfaces as state variable structures.

3. The method for kernel fuzz testing of a trusted execution environment for the Internet of Things based on state variable inference as described in claim 1, characterized in that, The fuzz test feedback information includes code coverage information, function names, function parameters, and function return values ​​in the function call sequence.

4. The method for kernel fuzz testing of a trusted execution environment for the Internet of Things based on state variable inference as described in claim 1, characterized in that, The fuzzy test seed state variable score is ,in, Seed for fuzz testing p The number of rare state information accessed, where Y is the total number of rare state information in the current fuzz test.

5. A kernel fuzz testing system for a trusted execution environment of the Internet of Things based on state variable inference, characterized in that, include: The initialization module is used to extract the function interface information and global variable information defined by the trusted execution environment kernel from the IoT trusted execution environment document, build the test case template file and initially select the state variable structure; The testing and feedback module is used to perform fuzz testing on the seed queue and collect fuzz test feedback information in real time using a hardware emulator. Specifically, it randomly selects the function call sequence executed during the operation of a trusted application as the initial seed for fuzz testing, randomly mutates the seed based on the test case template file, and conducts fuzz testing. While conducting fuzz testing, it uses a hardware emulator to collect fuzz test feedback information in real time. The state variable inference module is used to infer the sub-member information of the IoT trusted execution environment kernel state variable structure based on the feedback information collected by the test and feedback module and the state variable structure initially selected by the initialization module, and to use it as the trusted execution environment kernel state information. Specifically: Initialize the state variable structure; Based on the function parameter information in the current fuzzing feedback information, compare the memory data of the function parameters before and after the function call, and infer the offset of the sub-member variables of integer type, enumeration type, string or array pointer type in the state variable structure; Based on the inferred offset information, select the sub-members of integer type and enumeration type from the state variable structure as the kernel state of the trusted execution environment; The seed scoring calculation module is used to comprehensively calculate the score of each seed based on the fuzzing feedback information collected by the testing and feedback module and the trusted execution environment kernel state information obtained by the state variable inference module, and select the seeds with higher scores for fuzzing. Specifically, it calculates the fuzzing seed code coverage score based on the code coverage information in the collected current fuzzing feedback information; it calculates the fuzzing seed state variable score based on the inferred IoT trusted execution environment kernel state information; and it calculates the fuzzing seed comprehensive score based on the calculated seed code coverage score and state variable score, and selects the seeds with higher comprehensive scores for mutation and testing.

Images