Pointer replacement attack defense method based on trusted platform module
By replacing the attack defense method based on the trusted platform module, using the forced sign-checking mechanism and the lightweight encryption algorithm HIGHT, the problems of incompatibility and security defects in the existing technology are solved, and the attack surface instruction address is realized Effectively protect and key security to prevent kernel memory key leakage.
Patent Information
- Application Number
- CN202411315467.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-20
- Publication Date
- 2024-12-27
AI Technical Summary
The existing pointer replacement attack defense technology has incompatibility and its own security flaws, making it difficult to effectively defend against target address replacement attacks, especially the kernel memory key leakage problem, which causes the key to be read by the attacker to bypass protection.
Using pointers based on trusted platform modules to replace attack defense methods, generate random numbers and keys, identify attack surface instructions, encrypt pointer addresses using forced signature verification mechanism, and store ciphertext in TPM, using lightweight grouping The encryption algorithm HIGHT implements fast encryption and decryption, ensuring that only authorized users can access the key.
Effectively protect the attack surface instruction address, prevent key leakage, ensure that the key cannot be read even if the attacker has user and kernel space access rights, and provides fast encryption and decryption operations, suitable for resource-limited environments.
Smart Images
Figure CN119203157A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of information security, and in particular relates to a pointer replacement attack defense method based on a trusted platform module. Background Art
[0002] With the rapid development of information technology and the rapid popularization of the Internet, network security issues have gradually become the focus of attention in various fields. What follows is the continuous evolution and intensification of network security threats, especially the continuous renewal of attack methods against software vulnerabilities, which has brought severe challenges to network security. Among the many software vulnerability attack methods, the target address replacement attack method represented by Return-Oriented Programming has attracted much attention. This attack method uses the code segments of existing programs to construct a series of code snippets that perform specific operations to implement attacks. It can bypass traditional memory protection technologies such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), allowing attackers to execute malicious code and thus control the victim system.
[0003] Many scholars have conducted research on the defense mechanism of such attacks and proposed some solutions from the hardware and software levels. However, they still face several technical challenges in actual deployment, which makes it impossible to achieve effective defense, such as: 1. The hardware assistance has poor universality. Since ARM Matterhorn and Intel Tiger Lake, each has proposed a mitigation solution for instruction replacement technology. However, both ARM's Pointer Authentication Code and Intel's Shadow Stack and Indirect Branch Tracker rely on new assembly instructions and registers that can only be recognized by their own architecture CPUs, that is, a program using the ARM PAC mechanism will not be able to run on Intel CPUs. Therefore, many software developers will not use this hardware assistance to mitigate instruction replacement attacks in order to ensure the compatibility of the software itself. 2. Kernel memory key leakage. Apple Inc. has provided protection measures against pointer-related attacks at the operating system level since iOS12 and macOS Mojave. In Apple's protection strategy for pointers, the key required for setting encryption is stored in a specific register that is not visible in user space. However, when the kernel is about to sleep, the key will be assigned from the register to the kernel memory for storage. Therefore, an attacker with kernel space memory access rights may read the key and use it to bypass pointer protection.
[0004] In summary, despite the continuous development of pointer replacement attack defense technology, existing solutions still have defects such as incompatibility and inherent security. Summary of the invention
[0005] In order to solve the above problems in the prior art, the present invention proposes a pointer replacement attack defense method based on a trusted platform module, the method comprising:
[0006] S1, loading the program to be tested;
[0007] S2. The trusted platform module generates a random number and a key, and stores the generated random number and key in a memory;
[0008] S3, identify all attack surface instructions and extract the pointer address of each attack surface instruction;
[0009] S4. Encrypt the pointer address using a mandatory signature verification mechanism based on the key, and store the encrypted ciphertext in a temporary file;
[0010] S5, determine whether the program to be tested has been completed, if yes, then end, otherwise wait for hitting the hardware interrupt trap and obtain the current pointer address;
[0011] S6. Use the key to encrypt the current pointer address, and compare the encrypted ciphertext with the ciphertext in the temporary file to determine whether they are consistent. If they are consistent, return to step S5; otherwise, the program ends and the trusted signature verification is completed;
[0012] S7. Defend the system based on the trusted signature verification results.
[0013] Beneficial effects of the present invention:
[0014] The present invention utilizes the protected hardware facilities in the trusted platform module, combined with the operating system exception handler, to achieve effective protection of the attack surface instruction address; the trusted platform module of the present invention allows the application to write the key and random number of the encryption algorithm into the NV storage and RAM storage through specific commands and interfaces. These storage areas are protected by hardware inside the TPM and can only be accessed by authorized users during the TPM operation. Even attackers with user and kernel space access rights cannot read the key, effectively avoiding the risk of key leakage. In the present invention, when a hardware interrupt exception occurs in the application, the operating system transfers control to the exception handler, thereby intercepting the normal execution process of the application. This means that the application will inevitably enter the operating system exception handling. The encryption algorithm of the present invention is implemented based on the lightweight block encryption algorithm HIGHT, has a faster encryption and decryption speed, and can also provide fast encryption and decryption operations on devices with limited resources; and the code and storage space required by the algorithm are relatively small, which is suitable for environments with limited memory and storage resources. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are introduced below, and the technical solutions are described completely and clearly. Obviously, the drawings described below are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0016] Figure 1 A schematic diagram of a trusted signature verification method provided by an embodiment of the present invention;
[0017] Figure 2 A schematic diagram of a mandatory signature verification mechanism provided by an embodiment of the present invention;
[0018] Figure 3 A schematic diagram of a pointer encryption signature verification algorithm provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0020] A pointer replacement attack defense method based on a trusted platform module, such as Figure 1 As shown, the method includes:
[0021] S1, loading the program to be tested;
[0022] S2. The trusted platform module generates a random number and a key, and stores the generated random number and key in a memory;
[0023] S3, identify all attack surface instructions and extract the pointer address of each attack surface instruction;
[0024] S4. Encrypt the pointer address using a mandatory signature verification mechanism based on the key, and store the encrypted ciphertext in a temporary file;
[0025] S5, determine whether the program to be tested has been completed, if yes, then end, otherwise wait for hitting the hardware interrupt trap and obtain the current pointer address;
[0026] S6. Use the key to encrypt the current pointer address, and compare the encrypted ciphertext with the ciphertext in the temporary file to determine whether they are consistent. If they are consistent, return to step S5; otherwise, the program ends and the trusted signature verification is completed;
[0027] S7. Defend the system based on the trusted signature verification results.
[0028] In this embodiment, the trusted platform module generates random numbers and keys including: first, using the TPM Manager (TPM Management Console), TPM Device Driver Interface (DDI) or TPM Base Services (TBS) API to obtain TPM access rights and establish a communication session with the TPM. Then, the TPM is instructed to generate a 64-bit random number and a 128-bit key, and store them in the TPM protected RAM storage for use in subsequent pointer address encryption.
[0029] In this embodiment, if Figure 2 As shown, when the mandatory signature verification mechanism is used to encrypt the pointer address, the mandatory signature verification mechanism identifies all attack surface instructions and applies for memory space with read and write permissions in the program process space to store temporary files. Extract the pointer address in each attack surface instruction. In the X64 architecture, the pointer address is 64-bit data, and the pointer encryption algorithm is used as the input data after bit-by-bit XOR operation with the random number obtained in the above step S1, and write the obtained ciphertext data into the temporary file with the instruction address as the unique identifier. After all attack surface instructions are encrypted, change the temporary file page attribute to read-only.
[0030] Temporary files are files created using the Temporary File System and mapped into the program process space to store pointer ciphertext. The temporary file memory is released when the signature verification algorithm is abnormally interrupted or ends.
[0031] The pointer encryption signature verification algorithm is based on the Hight algorithm, which is a lightweight block cipher algorithm with a Feistel structure. The algorithm inputs a 64-bit plaintext block and a 128-bit master key, and outputs a 64-bit ciphertext after 32 rounds of iterations. Compared with the classic Feistel structure encryption algorithm DES, the Hight algorithm makes up for the defect of DES's short key, and uses a key expansion algorithm and an 8-branch generalized Feistel to provide higher security and computing speed. Figure 3 It is the flowchart of Hight's algorithm. The following are the specific implementation steps of Hight's algorithm:
[0032] (1) Key expansion. Divide the 128-bit master key into 16 groups, each with 8 bits, which can be recorded as K 15 ,…,K0; and generate the subkeys required for 32 rounds of iterative encryption through the key expansion algorithm.
[0033] (2) Grouping. Divide the 64-bit plaintext data into 8 groups, each with 8 bits, denoted as (M7, M6, M5, M4, M3, M2, M1, M0).
[0034] (3) Round function iteration. The eight Feistel branches can be equally divided into four groups of iterative branches, each of which independently runs a different round function.
[0035] (4) Output ciphertext. After 32 rounds of iterative operations, the output of each group of iterative branches is permuted and XORed again, and the final output data (C7, C6, C5, C4, C3, C2, C1, C0) is the ciphertext.
[0036] The key expansion algorithm consists of a constant generator and a subkey generator. First, a constant generator composed of a linear feedback shift register is used to generate 128 7-bit constants, which can be recorded as δ0,…,δ 127 ; Then in the subkey generator, let the master key K 15 ,…,K0 and δ0,…,δ 127 After performing modular addition operation, the subkey SK is obtained 16*i+j (i∈[0,7],j∈[0,15]). The subkey calculation formula is as follows:
[0037] SK 16*i+j =K ω +δ 16*i+j
[0038] The corresponding relationship between the master key K subscript ω (ω∈[0, 15]) used in the calculation of the subkey and i, j is shown in Table 1.
[0039] Table 1 Subscript correspondence
[0040]
[0041] Round functions include XOR, modulo 2 8 Addition operation and auxiliary functions G and H. G and H are linear functions with both input and output being 8 bits. The specific formulas are as follows:
[0042]
[0043]
[0044] Among them, M <<<1 It means to shift M 1 bit to the left. Represents a bitwise exclusive-or operation.
[0045] When the program has calculated all the attack surface instruction pointer addresses, the operating system will return control to the application. When the application hits the hardware interrupt trap placed by the mandatory signature verification mechanism during normal operation, the operating system exception handler will gain control of the application. At this time, the exception handler obtains the random number and key from the TPM memory, and passes them together with the pointer address to the pointer address encryption signature verification algorithm, and saves the obtained ciphertext in the TPM memory.
[0046] Using the instruction address as an index, obtain the ciphertext data corresponding to the instruction at the address from the temporary file, and transfer the ciphertext data to the TPM memory. Compare the consistency of the two ciphertext values in the TPM to complete the verification of the authenticity and validity of the pointer address. When the signature verification of an instruction pointer fails, the application is terminated.
[0047] In this embodiment, the use of a mandatory signature verification mechanism to encrypt the pointer address includes: determining whether the program to be detected is a sensitive program, if not, ending the mandatory signature verification mechanism; if yes, identifying the function call instructions, return instructions, and jump instructions in the .text section of the sensitive program; using a trusted signature verification method to encrypt the pointer of each instruction; and storing the encrypted ciphertext in the memory. The specific steps are:
[0048] Step 101, the user can start the application by double-clicking the mouse, starting the program automatically, or using the command line. However, no matter how the program is run, the specified executable program will eventually be started by the process creation function of the operating system. In Windows, Win32API ShellExecute / ShellExecuteEx is the key function for creating a process. It accepts a series of parameters, including the path of the executable file to be executed, command line parameters, security descriptor, etc.; while in Linux, the system calls fork to create a new process. Therefore, placing a Hook function at the process creation function can intercept the process startup flow and obtain information about the process based on the process creation function parameters.
[0049] The Hook function uses the IShellExecuteHook COM interface in Windows. The definition of this COM interface is in the Shlobj.h header file, which contains the Execute() method, which receives a structure pointer parameter IShellExecuteHookImpl, which contains the parameter information of the ShellExecute / ShellExecuteEx function. In particular, the handler of the IShellExecuteHook interface (i.e., the COM server) must be registered in the system registry.
[0050] Step 102: Obtain the file path, operation mode, etc. of the process to be executed from the IShellExecuteHookImpl structure obtained in step 101 to determine whether it is a sensitive program recognized by this system. If it is not a sensitive program, terminate the signature verification.
[0051] For step 103, attack surface instructions in the .text section of the software program are identified based on the hard-coded mechanism.
[0052] Determining whether the program to be detected is a sensitive program includes: evaluating whether the program to be detected is sensitive to attacks. During the evaluation process, the evaluated data includes the data type, network interface, security of the operating environment, and the degree of dependence of the system on the program; if the data type in the program to be detected is not critical data, the network interface is secure, the program operating environment is secure, and the system's dependence on the program is low, then the program is not a sensitive program, otherwise the program is a sensitive program.
[0053] The hard-coding mechanism refers to the technology of embedding the opcode and operand of the instruction directly into the program code. This means that the instruction execution method and operand value of any CPU architecture are determined at compile time and exist in the machine code of the program in a fixed form. Therefore, sensitive instructions in the program can be detected based on the opcode. The attack surface instruction hard-coding information corresponding to Intel and ARM architecture CPUs is shown in Table 2:
[0054] Table 2 Instruction hard-coded information
[0055]
[0056] Step 104: First, the operands of the identified attack surface instructions and the addresses of the instructions are sent to the trusted signature verification module, which completes the encryption and storage of the pointer address. The address of each attack surface instruction is recorded in the temporary file in the trusted signature verification module, so the breakpoint address can be dynamically set based on it to complete the hardware interrupt trap placement operation.
[0057] Dynamic setting means dynamically updating the address of the hardware interrupt during program execution. Whether it is the debug register in Intel CPU or the JTAG debug interface supported by Arm CPU, only 2 to 3 hardware interrupts are allowed at the same time; and there are far more than 2 to 3 attack surface instructions in the .text section of a program. In order to interrupt all attack surface instructions, a dynamic update strategy can be adopted: every time the program implements a jump, the hardware interrupt address in the CPU is updated to the address of the next two attack surface instructions at the address of the new RIP / PC register value.
[0058] Step 105: After all attack surface instructions are encrypted, the control is returned to the application. Meanwhile, the operating system monitors the exception message and waits for the application to hit the hardware trap to perform the trusted signature verification.
[0059] The above embodiments further illustrate the purpose, technical solutions and advantages of the present invention in detail. It should be understood that the above embodiments are only preferred implementation modes of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made to the present invention within the spirit and principles of the present invention should be included in the protection scope of the present invention.
Claims
1. A pointer replacement attack defense method based on a trusted platform module, characterized in that: include: S1, loading the program to be tested; S2. The trusted platform module generates a random number and a key, and stores the generated random number and key in a memory; S3, identify all attack surface instructions and extract the pointer address of each attack surface instruction; S4. Encrypt the pointer address using a mandatory signature verification mechanism based on the key, and store the encrypted ciphertext in a temporary file; S5, determine whether the program to be tested has been completed, if yes, then end, otherwise wait for hitting the hardware interrupt trap and obtain the current pointer address; S6. Use the key to encrypt the current pointer address, and compare the encrypted ciphertext with the ciphertext in the temporary file to determine whether they are consistent. If they are consistent, return to step S5; otherwise, the program ends and the trusted signature verification is completed; S7. Defend the system based on the trusted signature verification results.
2. A pointer replacement attack defense method based on a trusted platform module according to claim 1, characterized in that: The trusted platform module generates random numbers and keys, including: the hardware random number generator in the trusted platform module generates high-quality random numbers by debiasing and entropy expansion processing on noise sampling; and uses a key generation algorithm to process the random numbers to generate encryption keys.
3. A pointer replacement attack defense method based on a trusted platform module according to claim 2, characterized in that: The random number is 64 bits and the key size is 128 bits.
4. The pointer replacement attack defense method based on a trusted platform module according to claim 1, characterized in that: The use of a mandatory signature verification mechanism to encrypt the pointer address includes: determining whether the program to be detected is a sensitive program, and if not, terminating the mandatory signature verification mechanism; if so, identifying the function call instructions, return instructions, and jump instructions in the .text section of the sensitive program; using a trusted signature verification method to encrypt the pointer of each instruction; and storing the encrypted ciphertext in a memory.
5. A pointer replacement attack defense method based on a trusted platform module according to claim 4, characterized in that: Determining whether the program to be detected is a sensitive program includes: evaluating whether the program to be detected is sensitive to attacks. During the evaluation process, the evaluated data includes the data type, network interface, security of the operating environment, and the degree of dependence of the system on the program; if the data type in the program to be detected is not critical data, the network interface is secure, the program operating environment is secure, and the system's dependence on the program is low, then the program is not a sensitive program, otherwise the program is a sensitive program.
6. A pointer replacement attack defense method based on a trusted platform module according to claim 4, characterized in that: Using the trusted signature method to encrypt the pointer of each instruction includes: extracting the pointer address plaintext of the instruction; encrypting the pointer address plaintext using the Hight algorithm, and writing the generated ciphertext into a temporary file; the whole process is expressed as: C=EK(P), where EK represents the encryption process of the Hight algorithm, P is the pointer address plaintext, and C is the generated ciphertext.
7. The pointer replacement attack defense method based on a trusted platform module according to claim 1, characterized in that: Comparing the encrypted ciphertext with the ciphertext in the temporary file includes: when the hardware interrupt is triggered and hits an instruction, the system calls the signature verification algorithm to generate a pointer ciphertext; using the instruction address as an index, the corresponding ciphertext data in the temporary file is retrieved; and the ciphertext values obtained twice are compared in the trusted platform module to verify the consistency of the two ciphertext values.