Padding oracle attack detection and evaluation system for ssl algorithm library

Abstract

The application discloses a padding oracle attack detection and evaluation system for an SSL algorithm library, and comprises an attack vector generator, a dynamic modification detector and an analyzer, wherein the attack vector generator is used for generating attack vectors by attacking ciphertexts by using various padding oracle attack algorithms; the dynamic modification detector is used for performing dyeing analysis on the decryption process of the attack vectors and the ciphertexts by various decryption algorithms in the SSL algorithm library by using a dynamic plug-in mode and based on a dynamic dyeing algorithm, so that dyeing analysis tracking results of the ciphertext decryption process and dyeing analysis tracking results of the attack vector decryption process are obtained; and the analyzer is used for comparing and analyzing the dyeing analysis tracking results to detect attack ability and evaluate defense ability. The system has a wider coverage of attack detection effect.

Description

TECHNICAL FIELD

[0001] The application belongs to the security technical field of SSL algorithm library, and particularly relates to a Padding Oracle attack detection and evaluation system for SSL algorithm library. BACKGROUND

[0002] The SSL algorithm library is an open source solution for the secure socket layer, which is used to protect the transmission of sensitive data on computer networks. It provides secure authentication and data encryption functions for network communication by using encryption certificates and digital certificates.

[0003] The SSL algorithm library includes three types of algorithms, the first type of symmetric encryption algorithm, specifically including DSE algorithm, AES algorithm, RC4 algorithm, the second type of asymmetric encryption algorithm, specifically including RSA algorithm, DH algorithm, and the third type of information digest algorithm (one-way hash algorithm), specifically including MD5 algorithm, SHA algorithm.

[0004] Different SSL algorithm libraries have implemented the widely used AES encryption algorithm, which also includes the AES-CBC encryption algorithm. CBC (Cipher Block Chaining) mainly introduces an initialization vector (IV) to enhance the randomness of the ciphertext, ensuring that the same plaintext encrypted by the same key will not produce the same result. This is a kind of block chaining mode, and the purpose is to make the independent block cipher encryption process form iteration, so that the result of each encryption affects the next encryption. The block brings a problem, that is, the plaintext cannot be an integer multiple of the block size, and the remaining part of the data involves padding operation.

[0005] The most commonly used padding operation is PKCS#7: in the last block, the number of bits that are not enough are filled as values, and n 0x0n are filled for n bits, for example, if the last block is missing 3 bits, 3 0x03 are filled to the end. When decrypting, the padding of the plaintext is checked to see if it meets the rule, if it ends with N 0x0N, it means that the decryption operation is successful, otherwise the decryption operation fails.

[0006] A famous attack on the AES-CBC encryption algorithm is the Padding Oracle attack. The Padding Oracle attack modifies the padding part of the ciphertext and obtains the plaintext according to the difference in the server's return state. In more than ten years of development, the Padding Oracle attack has produced multiple variants, including Padding Oracle timing attack, Lucky13 attack, etc., which has caused a great security risk to SSL algorithm libraries including OpenSSL.

[0007] Therefore, there is an urgent need for an attack detection method to detect and evaluate the attack defense capability of the algorithm in the SSL algorithm library against the Padding Oracle attack. SUMMARY

[0008] In view of the deficiencies in the prior art, the purpose of the present application is to provide a Padding Oracle attack detection and evaluation system for SSL algorithm library, which can comprehensively detect the defense capability of different SSL algorithm libraries against Padding Oracle and its variant attacks.

[0009] To achieve the above-mentioned purpose, the Padding Oracle attack detection and evaluation system for SSL algorithm library provided by the embodiment comprises an attack vector generator, a dynamic modification detector and an analyzer.

[0010] The attack vector generator is configured to generate attack vectors by attacking ciphertexts using various Padding Oracle attack algorithms.

[0011] The dynamic modification detector is configured to perform dyeing analysis on the decryption process of the attack vectors and the ciphertexts by various decryption algorithms in the SSL algorithm library in a dynamic insertion manner and based on a dynamic dyeing algorithm, to obtain dyeing analysis tracking results of the original ciphertext decryption process and dyeing analysis tracking results of the attack vector decryption process.

[0012] The analyzer is configured to compare and analyze the dyeing analysis tracking results of the ciphertext decryption process and the dyeing analysis tracking results of the attack vector decryption process, to detect the attack capability of each type of Padding Oracle attack algorithm on each type of decryption algorithm, and to evaluate the defense capability of each type of Padding Oracle attack algorithm against each type of decryption algorithm.

[0013] Preferably, in the attack vector generator, the attack vectors are generated by attacking the ciphertexts using various Padding Oracle attack algorithms, including:

[0014] The data in the MAC segment and / or the Padding segment of the ciphertext conforming to the SSL specification is modified, and during the modification, the last byte, the first byte and the middle byte of each segment are flipped, and the modified ciphertext is the attack vector.

[0015] Preferably, for the original Padding Oracle attack algorithm and the Padding Oracle time attack algorithm, the attack vectors are obtained by modifying the data in the Padding segment.

[0016] For the Lucky13 attack algorithm, an attack vector is obtained by modifying only the MAC segment data, modifying only the Padding segment data, or modifying both the MAC segment data and the Padding segment data.

[0017] Preferably, in the dynamic modification detector, a dynamic patching method is adopted and a dynamic coloring algorithm is used to color and analyze the decryption process of each type of decryption algorithm in the SSL algorithm library on the attack vector and the ciphertext, including:

[0018] The initial color of each type of decryption algorithm parameter is set, and the color of the initial memory address and / or register of each type of decryption algorithm parameter is kept consistent with the initial color;

[0019] During program execution, a data group is maintained to track the coloring state of different memory addresses and / or registers;

[0020] When different assembly instructions are executed, the program determines whether color transfer operation is needed according to the type of assembly instruction, i.e. transferring the color of the source register and / or memory address to the destination register and / or memory address.

[0021] Preferably, the specific coloring analysis process includes:

[0022] (1) According to the SSL algorithm library, select the decryption algorithm function and assembly instruction that need to be dynamically patched and the decryption algorithm parameter that needs to be colored;

[0023] (2) Set the color of the initial memory address and / or register of these parameters;

[0024] (3) Initialize the array recording the coloring state of different memory addresses and / or registers;

[0025] (4) Traverse the assembly instruction that is dynamically patched, when it is determined that the traversed assembly instruction needs to be colored, obtain the triple information of the source register and / or memory address, color, destination register and / or memory address, and record it to the array;

[0026] (5) When it is determined that the traversed instruction does not need to be colored, re-traverse the next instruction.

[0027] Preferably, in the analyzer, the coloring analysis tracking results of the ciphertext decryption process and the coloring analysis tracking results of the attack vector decryption process are compared and analyzed, including:

[0028] Traverse each piece of data in the coloring analysis tracking results, obtain the triple information in each piece of data, which includes the source register and / or memory address, color, destination register and / or memory address;

[0029] When it is judged that the source register and / or memory address and the destination register and / or memory address are not in the current data flow graph, a node representing the source register and / or memory address and the destination register and / or memory address is newly built in the current data flow graph, and an edge from the node corresponding to the source register and / or memory address to the node corresponding to the destination register and / or memory address is built, and the color in the triple information is taken as the edge information;

[0030] When the coloring analysis tracking result is the coloring analysis tracking result of the ciphertext decryption process, the corresponding first data flow graph is obtained;

[0031] When the coloring analysis tracking result is the coloring analysis tracking result of the attack vector decryption process, the corresponding second data flow graph is obtained;

[0032] The comparison result is obtained by comparing the first data flow graph and the second data flow graph, and attack capability analysis and defense capability analysis are performed based on the comparison result.

[0033] Preferably, the attack capability analysis based on the comparison result comprises:

[0034] The comparison result shows the gap between the first data flow graph and the second data flow graph, and the gap represents the attack capability of the Padding Oracle attack algorithm on the decryption algorithm, and the greater the gap, the greater the attack capability of the Padding Oracle attack algorithm on the decryption algorithm.

[0035] Preferably, the defense capability analysis based on the comparison result comprises:

[0036] The comparison result shows the gap between the first data flow graph and the second data flow graph, and the gap represents the defense capability of the Padding Oracle attack algorithm on the decryption algorithm, and the smaller the gap, the stronger the defense capability of the decryption algorithm on the Padding Oracle attack algorithm.

[0037] Preferably, the system further comprises:

[0038] Based on the defense capability evaluation result, a decryption algorithm with strong defense capability is selected from the SSL algorithm library to decrypt the ciphertext.

[0039] Compared with the prior art, the present application has at least the following beneficial effects:

[0040] Compared with the prior art, the present application has at least the following beneficial effects: BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0042] Figure 1 FIG. 1 is a structural schematic diagram of a Padding Oracle attack detection and evaluation system for an SSL algorithm library provided by an embodiment.

[0043] Figure 2 FIG. 4 is a generation process of a data flow graph provided by an embodiment. DETAILED DESCRIPTION

[0044] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the protection scope of the present application.

[0045] Figure 1 FIG. 1 is a structural schematic diagram of a Padding Oracle attack detection and evaluation system for an SSL algorithm library provided by an embodiment. As shown in FIG. 1, the Padding Oracle attack detection and evaluation system for the SSL algorithm library provided by the embodiment includes an attack vector generator, a dynamic modification monitor and an analyzer. Figure 1

[0046] In the embodiment, the attack vector generator is used to generate attack vectors by attacking the ciphertext by using various Padding Oracle attack algorithms. Specifically, for the representative Padding Oracle and its variant attack algorithms, including the original Padding Oracle attack, the Padding Oracle time attack, the Lucky13 attack algorithm, etc., a series of attack vectors are refined according to the characteristics of each attack variant. The attack vector refers to the input that can be used for attack, i.e. the modified correct SSL ciphertext. By modifying the head, middle and tail of the correct SSL ciphertext, different attack vectors are constructed to maximize the coverage of all attack scenarios.

[0047] ​The attack vector is generated by modifying the data in the MAC segment and / or the padding segment of the cipher text conforming to the SSL specification, and the last byte, the first byte and the middle byte of each segment are flipped during the modification. Specifically, for the original padding oracle attack algorithm and the padding oracle time attack algorithm, the attack vector is obtained by modifying the padding segment data; for the Lucky13 attack algorithm, the attack vector is obtained by modifying only the MAC segment data, only the padding segment data, or both the MAC segment data and the padding segment data.

[0048] In the embodiment, the dynamic modification detector is configured to track the data flow of the target variable (i.e., the parameter of the decryption function) using dynamic instrumentation and a dynamic coloring algorithm. Specifically, the dynamic coloring algorithm is used to analyze the decryption process of the attack vector and the cipher text by each decryption algorithm in the SSL algorithm library, and the coloring analysis tracking results of the cipher text decryption process and the attack vector decryption process are obtained.

[0049] Specifically, the initial color of each type of decryption algorithm parameter is set, different parameters can be set with different colors, and the color of the initial memory address and / or register of each type of decryption algorithm parameter is consistent with the initial color; during the program running, a data group is maintained to track the coloring state of different memory addresses and / or registers; when different assembly instructions are executed, the program determines whether the color transfer (coloring) operation is needed according to the type of the assembly instruction, i.e., the color of the source register and / or memory address is transferred to the destination register and / or memory address, and the direction and register / memory address of each color transfer are recorded for subsequent analysis. More specifically, the coloring analysis process includes:

[0050] (1) selecting the decryption algorithm function and assembly instruction to be dynamically instrumented and the decryption algorithm parameter to be colored according to the SSL algorithm library;

[0051] (2) setting the color of the initial memory address and / or register of the parameter;

[0052] (3) initializing an array for recording the coloring state of different memory addresses and / or registers;

[0053] (4) traversing the dynamically instrumented assembly instructions, and when it is determined that the traversed assembly instruction needs to be colored, obtaining the three-tuple information of the source register and / or memory address, color, and destination register and / or memory address of the assembly instruction, and recording the information to the array;

[0054] (5) When it is judged that the instruction traversed does not need to be colored, the next instruction is re-traversed.

[0055] In the embodiment, the analyzer is configured to compare the colored analysis tracking result of the ciphertext decryption process with the colored analysis tracking result of the attack vector decryption process, to analyze the attack ability of each type of Padding Oracle attack algorithm on each type of decryption algorithm and to evaluate the defense ability of each type of Padding Oracle attack algorithm against each type of decryption algorithm. The specific process is as follows:

[0056] Each piece of data in the colored analysis tracking result is traversed to obtain the triple information in each piece of data. When it is judged that the source register and / or memory address and the destination register and / or memory address are not in the current data flow graph, a node is newly created in the current data flow graph to represent the source register and / or memory address and the destination register and / or memory address, and an edge is established from the node corresponding to the source register and / or memory address to the node corresponding to the destination register and / or memory address, and the color in the triple information is stored as edge information. In this way, the source data obtained from the dynamic modification detector is converted into a data flow graph. It should be noted that when there are at least two nodes pointing to a pointed node, the colors of the at least two nodes are mixed to obtain the color of the pointed node.

[0057] In the embodiment, the colored analysis tracking result of the ciphertext decryption process and the colored analysis tracking result of the attack vector decryption process are respectively converted into data flow graphs, and then a first data flow graph corresponding to the colored analysis tracking result of the ciphertext decryption process and a second data flow graph corresponding to the colored analysis tracking result of the attack vector decryption process are obtained. Then, the first data flow graph and the second data flow graph are compared to determine whether they have the same structure (node and edge information), and the similarity of the two graphs is determined as the comparison result. Based on the comparison result, the attack ability analysis and the defense ability analysis are performed.

[0058] Specifically, the comparison result shows the difference between the first data flow graph and the second data flow graph, and the difference represents the attack ability of the Padding Oracle attack algorithm on the decryption algorithm. The greater the difference, the greater the attack ability of the Padding Oracle attack algorithm on the decryption algorithm.

[0059] Specifically, the comparison result shows the difference between the first data flow graph and the second data flow graph, and the difference represents the defense ability of the Padding Oracle attack algorithm against the decryption algorithm. The smaller the difference, the stronger the defense ability of the decryption algorithm against the Padding Oracle attack algorithm.

[0060] The SSL algorithm library includes encryption and decryption algorithms such as OpenSSL and Mbed-TLS. The following section uses the OpenSSL encryption algorithm library as an example to determine its ability to defend against Lucky13 attacks. The detailed process is as follows:

[0061] (1) Dynamically instrument the AES decryption function of the OpenSSL library and set the variable that needs to be colored to the parameter of the AES decryption function;

[0062] (2) Use the AES decryption function of the OpenSSL library to decrypt the input ciphertext;

[0063] (3) During the decryption operation in the AES decryption function of the OpenSSL library, dynamic instrumentation and dynamic coloring algorithms are used to track the data flow of the target variable and record the tracking results;

[0064] (4) Convert the tracking results in (3) into the form of a first data flow graph and store them;

[0065] (5) Construct the attack vector based on the Lucky13 attack;

[0066] (6) Using the attack vector constructed in (5) as input, the AES decryption function of the OpenSSL library is used to decrypt the input attack vector, and the target variable is tracked using dynamic instrumentation and dynamic coloring algorithms, and the tracking results are recorded.

[0067] (7) Convert the tracking results in (6) into the form of a second data flow graph and store them;

[0068] (8) Compare the first data flow graph stored in (7) with the second data flow graph generated in (4) and output the result.

[0069] by Figure 2 Let's take an example to illustrate the data flow graph generation process. For the instruction `mov 0x800040, RAX`, the color 0x01 of RAX will be passed to memory 0x800040. In the data flow graph, this is represented by creating two nodes: register RAX and memory 0x800040, and setting the edge connecting these two nodes to the color 0x01. For the memory node 0x800080, since it is connected to both memory nodes 0x8000F0 and 0x800040, its color is a mixture of both, i.e., (0x01 OR 0x02 = 0x03). Therefore, memory 0x800080 will also pass its color to memory 0x8000A0.

[0070] The above detailed description of the specific embodiments of the present application has described the technical solutions and beneficial effects of the present application, and it should be understood that the above description is only the most preferred embodiment of the present application and is not intended to limit the present application. Any modifications, supplements and equivalent replacements made within the principle range of the present application shall be included in the protection range of the present application.

Claims

1. A Padding Oracle Attack Detection and Evaluation System for SSL Algorithm Libraries, characterized in that, This includes an attack vector generator, a dynamic modification monitor, and an analyzer; The attack vector generator is used to attack the ciphertext and generate attack vectors using various Padding Oracle attack algorithms. The dynamic modification monitor is used to perform color analysis on the decryption process of attack vectors and ciphertext by various decryption algorithms in the SSL algorithm library using dynamic instrumentation and based on dynamic coloring algorithm, so as to obtain the color analysis tracking results of the original ciphertext decryption process and the color analysis tracking results of the attack vector decryption process. The method employs dynamic instrumentation and a dynamic coloring algorithm to analyze the decryption process of various decryption algorithms in the SSL algorithm library on attack vectors and ciphertexts. This includes: setting the initial color of each type of decryption algorithm parameter and ensuring that the color of the initial memory address and / or register where each type of decryption algorithm parameter is located is consistent with its initial color; maintaining a data set during program execution to track the coloring status of different memory addresses and / or registers; and determining whether color passing is required based on the type of assembly instruction when different assembly instructions are executed, i.e., passing the color of the source register and / or memory address to the destination register and / or memory address. The analyzer is used to compare and analyze the color analysis tracking results of the ciphertext decryption process and the color analysis tracking results of the attack vector decryption process to detect the attack capability of each type of Padding Oracle attack algorithm against each type of decryption algorithm, and to evaluate the defense capability against each type of Padding Oracle attack algorithm against each type of decryption algorithm.

2. The Padding Oracle Attack Detection and Evaluation System for SSL Algorithm Libraries according to claim 1, characterized in that, The attack vector generator employs various Padding Oracle attack algorithms to attack the ciphertext and generate attack vectors, including: Modify the data in the MAC segment and / or Padding segment of the ciphertext conforming to the SSL specification. When modifying, flip a few bits of the last byte, the first byte, and the middle byte of each segment. The modified ciphertext is the attack vector.

3. The Padding Oracle Attack Detection and Evaluation System for SSL Algorithm Libraries according to claim 2, characterized in that, The attack vector is obtained by modifying the padding segment data, targeting the original padding oracle attack algorithm and the padding oracle time attack algorithm. To counter the Lucky13 attack algorithm, attack vectors can be obtained by modifying only the MAC segment data, only the Padding segment data, or both the MAC segment data and the Padding segment data.

4. The Padding Oracle Attack Detection and Evaluation System for SSL Algorithm Libraries according to claim 1, characterized in that, The specific staining analysis process includes: (1) Select the decryption algorithm functions and assembly instructions that need to be dynamically instrumented and the decryption algorithm parameters that need to be colored according to the SSL algorithm library; (2) Set the color of the memory address and / or register where these parameters are initially located; (3) Initialize an array that records the coloring states of different memory addresses and / or registers; (4) Traverse the dynamically instrumented assembly instructions. When it is determined that the traversed assembly instructions need to be colored, obtain the triplet information of the source register and / or memory address, color, destination register and / or memory address of the assembly instructions, and record it in the array. (5) When it is determined that the instruction being traversed does not need to be colored, the next instruction is traversed again.

5. The Padding Oracle Attack Detection and Evaluation System for SSL Algorithm Libraries according to claim 1, characterized in that, The analyzer performs a comparative analysis of the color analysis tracking results based on the ciphertext decryption process and the color analysis tracking results based on the attack vector decryption process, including: Traverse each data point in the staining analysis tracking results and obtain the triplet information in each data point. The triplet information includes the source register and / or memory address, color, and destination register and / or memory address. When it is determined that the source register and / or memory address, and the destination register and / or memory address are not in the current data flow graph, a new node is created in the current data flow graph to represent the source register and / or memory address and the destination register and / or memory address. At the same time, an edge is established from the node corresponding to the source register and / or memory address to the node corresponding to the destination register and / or memory address, and the color in the triplet information is used as the edge information. When the staining analysis tracking result is the staining analysis tracking result of the ciphertext decryption process, the corresponding first data flow graph is obtained; When the color analysis tracing result is the color analysis tracing result of the attack vector decryption process, the corresponding second data flow graph is obtained; The first and second data flow graphs are compared to obtain the comparison results, and attack capability analysis and defense capability analysis are performed based on the comparison results.

6. The Padding Oracle Attack Detection and Evaluation System for SSL Algorithm Libraries according to claim 5, characterized in that, Attack capability analysis is performed based on the comparison results, including: The comparison results show the difference between the first data flow graph and the second data flow graph. This difference represents the attack capability of the Padding Oracle attack algorithm against the decryption algorithm. The larger the difference, the greater the attack capability of the Padding Oracle attack algorithm against the decryption algorithm.

7. The Padding Oracle Attack Detection and Evaluation System for SSL Algorithm Libraries according to claim 5, characterized in that, Based on the comparison results, a defense capability analysis is conducted, including: The comparison results show the difference between the first data flow graph and the second data flow graph. This difference represents the decryption algorithm's defense capability against the PaddingOracle attack algorithm. The smaller the difference, the stronger the decryption algorithm's defense capability against the PaddingOracle attack algorithm.

8. The Padding Oracle Attack Detection and Evaluation System for SSL Algorithm Libraries according to claim 1 or 7, characterized in that, Also includes: Based on the defense capability assessment results, decryption algorithms with strong defense capabilities are selected from the SSL algorithm library to decrypt the ciphertext.

Images