Control flow integrity method, system and equipment based on complete domain sensitivity and source sensitivity and medium

Abstract

The invention discloses a control flow integrity method, system and equipment based on complete domain sensitivity and source sensitivity and a medium, and the method comprises the steps: carrying out static analysis on an intermediate code of an open source program to obtain a control flow diagram of the open source program, and integrating the control flow diagram and the intermediate code into an executable file; when the program runs, contextual information in an executable file is detected and stored in a memory protected by the Intel MPK, whether a function pointer value indirectly called by the open source program is legal or not is checked in combination with the detected contextual information and the control flow diagram, if yes, the program continues to be executed, and if not, the program is stopped immediately; systems, devices, and media for implementing the method; according to the high-precision control flow graph constructed by the method, the capability of the program for resisting the hijacking attack of the control flow is improved, the context information is protected by utilizing the Intel MPK hardware technology when the program runs, the extra performance consumption is reduced, and the transportability and robustness of the system are improved.

Description

Technical Field

[0001] The present invention belongs to the field of computer security technology, and in particular relates to a control flow integrity method, system, device and medium based on full domain sensitivity and source sensitivity. Background Art

[0002] Although C and C++ programs have excellent direct memory access capabilities, they also lead to memory corruption attacks. Attackers can tamper with function pointers or return address data in memory through buffer overflow vulnerabilities, thereby reversing the control flow of the program to an illegal position. Early control flow hijacking attacks usually used code injection, that is, injecting malicious code (shellcode) into the memory of the target program, and then hijacking the control flow to execute this malicious code. In order to defend against this attack, later computer systems introduced the Data Execution Protection (DEP) mechanism, which prevents the execution of malicious code by restricting memory pages from having both write and execute permissions. In order to bypass DEP's defense, attackers have explored code reuse attacks. Such attacks include Return-to-libc, ROP (Return Oriented Programming), and JOP (Jump Oriented Programming). These attacks use existing legitimate code fragments (gadgets) in the target program for splicing, thereby constructing malicious control flow transfers to achieve the purpose of controlling the target system. These new control flow hijacking attack methods do not rely on injecting malicious code, but instead use the program's own legitimate code, making them more difficult to detect and defend against.

[0003] In order to defend against the new control flow hijacking attack, Abadi et al. proposed the concept of Control Flow Integrity (CFI) (Martín Abadi, Mihai Budiu, Erlingsson, and Jay Ligatti. 2005. Control-flow integrity. In Proceedings of the 12th ACM conference on Computer and communications security (CCS'05). Association for Computing Machinery, New York, NY, USA, (pp 340–353). and Abadi, M., Budiu, M., Erlingsson, U., & Ligatti, J. (2009). Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security (TISSEC), 13 (1), (pp 1-40).), the core idea is to limit the control transfer in the program running, so that it is always within the scope of the pre-defined control flow graph, so as to defend against control flow hijacking attacks, but this method only focuses on the target address of the control flow transfer, but ignores the context information of the transfer. Attackers may use legitimate control flow transfers to execute in different contexts, thereby bypassing CFI protection. In order to solve the problem of insufficient security of early CFI, scholars proposed context-sensitive CFI (Van der Veen, V., Andriesse, D., E., Gras, B., Sambuc, L., Slowinska, A., ... & Giuffrida, C. (2015, October). Practical context-sensitive CFI. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (pp. 927-940).), Context-sensitive CFI performs interrelated checks on the control flow edges in the execution path, considering the context information of the execution path. It not only focuses on the legitimacy of the jump target, but also checks whether the current context is consistent with the expected one. This method can better capture the actual control flow of the program, thereby improving the defense capability against control flow hijacking attacks. Specifically, context-sensitive CFI collects the control flow information of the program during the static analysis phase, tracks the execution path at runtime and matches it with the static analysis results to detect whether there is control flow hijacking. This method can provide stronger security protection than traditional CFI, but it also brings certain performance overhead. In addition, these solutions need to use Intel hardware features to record the context information when the program is running, and the specific hardware limits the portability of these solutions. Summary of the invention

[0004] In order to overcome the shortcomings of the above-mentioned prior art, the purpose of the present invention is to provide a control flow integrity method, system, device and medium based on full domain sensitivity and source sensitivity, which utilizes the rich context information in the program intermediate code and realizes the precise positioning of function pointers, their related variable assignments and key variable offsets through static analysis methods, thereby generating a high-precision control flow graph, thereby reducing the attack surface of attackers; in addition, the present invention only utilizes Intel MPK hardware technology to provide protection for memory pages at runtime, and can be easily replaced with related memory protection technologies on other platforms, thereby improving the portability of the present invention between different platforms.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0006] A control flow integrity method based on full domain sensitivity and source sensitivity includes the following steps:

[0007] Step 1: statically analyze the intermediate code of the open source program to obtain the control flow graph of the open source program, and integrate the control flow graph and the intermediate code into an executable file; the control flow graph includes the value of the key variable offset, the function pointer value and the function pointer address; the key variable offset is the variable offset involved in the calculation of the function pointer address;

[0008] Step 2: When the program is running, the context information in the executable file is detected and stored in the memory protected by Intel MPK. The detected context information and the control flow graph obtained in step 1 are combined to check whether the function pointer value indirectly called by the open source program is legal. If it is legal, the program continues to be executed. If it is illegal, the program is terminated immediately. The context information is the key variable offset, function pointer value and function pointer address.

[0009] In the step 1, a source-sensitive static analysis is performed on the intermediate code of the open source program to obtain the assignment of function pointer-related variables, and pointer analysis is performed on the assignment of function pointer-related variables to obtain the control flow graph of the open source program; a full domain-sensitive static analysis is performed on the intermediate code of the open source program to obtain the position of the key variable offset.

[0010] The specific process of static analysis in step 1 is as follows:

[0011] Step 1.1: Traverse the def-use chain of the function pointer of the current indirect call instruction in the intermediate code, define the indirect call instruction as the original instruction, and backtrack along the def-use chain of the function pointer until it backtracks to the root of the def-use chain;

[0012] Step 1.2: Recursively traverse the use of the root instruction of the def-use chain to see if the current use instruction can reach the original instruction. If the current use instruction can reach the original instruction, make the following judgment:

[0013] Full domain-sensitive judgment: judge whether the current use instruction is an address-taking instruction and contains a variable offset. If the current use instruction is an address-taking instruction and contains a variable offset, insert an instruction to record the variable offset at runtime into the intermediate code to obtain the position of the key variable offset;

[0014] Source sensitivity judgment: judge whether the current use instruction is an assignment instruction. If the current use instruction is an assignment instruction for function pointer-related variables, perform pointer analysis on the assignment instruction to obtain the control flow graph of the open source program. The control flow graph contains the value of the key variable offset, the function pointer value, and the function pointer address.

[0015] Step 1.3: After traversing the def-use chain of the function pointer of the current indirect call, continue to traverse the next indirect call until all indirect calls are traversed.

[0016] The def-use chain of the instructions of the intermediate code is a tree structure, and nodes other than the root node have only one child node.

[0017] In step 2, when the open source program runs to the location of the source point and the key variable offset, the source point information and the key variable offset information are written into the hash table protected by Intel MPK; the source point information includes the function pointer value and the function pointer address;

[0018] When the open source program continues to execute to the indirect call, first check whether the function pointer value and function pointer address of the indirect call exist in the Hash table; if not, it means that the function pointer has been tampered with by the attacker, and the program must be terminated immediately; if so, check whether there is key variable offset information, function pointer value and function pointer address that match the Hash table in the control flow graph at the same time. If there is no match, the program is terminated; if it matches, the program continues to execute.

[0019] A system for implementing a control flow integrity method based on full domain sensitivity and source sensitivity, comprising:

[0020] Static analysis module: used to perform static analysis on the intermediate code of the open source program, obtain the control flow graph of the open source program, and integrate the control flow graph and the intermediate code into an executable file;

[0021] Program judgment module: used to detect the context information in the executable file and store it in the memory protected by Intel MPK. It combines the detected context information and the control flow graph in the static analysis module to check whether the function pointer value of the indirect call of the open source program is legal. If it is legal, the program will continue to be executed. If it is illegal, the program will be terminated immediately.

[0022] A control flow integrity device based on full domain sensitivity and source sensitivity, comprising:

[0023] Memory: a computer-readable device used to store the computer program of the control flow integrity method based on full domain sensitivity and source sensitivity;

[0024] Processor: used to implement the above-mentioned control flow integrity method based on full domain sensitivity and source sensitivity when executing the computer program.

[0025] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program can implement the above-mentioned control flow integrity method based on full domain sensitivity and source sensitivity.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] 1. Compared with the existing context-based control flow integrity scheme, the present invention extends the scope of the context to all the assignments of function pointer-related variables, and realizes the precise search and plugging of these assignments; at the same time, the present invention will be able to include the key variable offset into the scope of the context, and construct a control flow graph containing the key variable offset through static pointer analysis, which greatly improves the accuracy of the control flow graph, and thus improves the security of the entire scheme.

[0028] 2. The present invention utilizes Intel MPK hardware technology to perform read-write protection on the memory page where the runtime context is located, which not only increases the difficulty for attackers to tamper with the runtime context, but also reduces the additional performance consumption during runtime, and is more robust and reliable than MPX that relies on software implementation.

[0029] 3. The present invention uses Intel MPK hardware technology to protect the context information of the program when it is running. At the same time, this technology can be easily replaced by related memory protection technology on other platforms, thereby improving the portability of the system on various platforms.

[0030] In summary, compared with the prior art, the present invention utilizes the characteristics of static single assignment of program intermediate code to perform depth-first backtracking traversal of the def-use chain of function pointers to find the assignments of all function pointers, and identifies the variable offset involved in the calculation of the function pointer address during the backtracking process. In this way, the static analysis based on full domain sensitivity and source sensitivity can fully utilize the obtained context information to achieve the segmentation of the control flow graph, thereby greatly improving the accuracy of CFI. In addition, in order to provide protection for these context information when the program is running, Intel MPK hardware technology is used to protect the memory storing the context information. Although this also depends on the hardware characteristics of Intel, the corresponding technology with memory protection function on other platforms can also protect the context information, so the portability of the present invention on various platforms is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is the overall structural diagram of the control flow integrity method provided by the present invention.

[0032] Figure 2 This is a flow chart of the static analysis module in the control flow integrity method provided by the present invention.

[0033] Figure 3 A control flow graph of a program judgment module in the control flow integrity method provided by the present invention.

[0034] Figure 4 The figure is a performance consumption diagram of the present invention on different test sets. DETAILED DESCRIPTION

[0035] The technical solution of the present invention is further described below in conjunction with the accompanying drawings.

[0036] like Figure 1 As shown, a control flow integrity method based on full domain sensitivity and source sensitivity includes the following steps:

[0037] Step 1: Perform static analysis on the intermediate code of the open source program to obtain the control flow graph of the open source program, and integrate the control flow graph and the intermediate code into an executable file;

[0038] Specifically, the intermediate code of the open source program is subjected to source-sensitive static analysis to obtain the assignment of function pointer-related variables, and the assignment of function pointer-related variables is subjected to pointer analysis to obtain the control flow graph of the open source program; the intermediate code of the open source program is subjected to full-domain-sensitive static analysis to obtain the location of the key variable offset; the control flow graph includes the value of the key variable offset, the function pointer value and the function pointer address; the key variable offset is the variable offset involved in the calculation of the function pointer address;

[0039] The intermediate code is LLVM IR (Intermediate Representation), which is a highly readable cross-platform intermediate code generated by the LLVM compiler front end;

[0040] The specific process of the pointer analysis is as follows:

[0041] Use the static value flow analysis tool SVF (Static Value-Flow) to analyze the assignment of function pointer related variables to find out the value of the function pointer corresponding to the assignment; at the same time, if the function pointer is located in a domain (structure or array), it is necessary to sort out the function pointer value and its corresponding variable offset value; through the above analysis process, a control flow graph containing the function pointer address, function pointer value and key offset value is obtained;

[0042] like Figure 2 As shown, the specific process of the static analysis is as follows:

[0043] Step 1.1: Traverse the def-use chain of the function pointer of the current indirect call instruction in the intermediate code, define the indirect call instruction as the original instruction, and backtrack along the def-use chain of the function pointer until it backtracks to the root of the def-use chain;

[0044] The def-use chain of the instructions of the intermediate code is a tree structure, and the nodes other than the root node have only one child node, so in this way, the assignment of the function pointer related variables can be accurately found;

[0045] Step 1.2: Recursively traverse the use of the root instruction of the def-use chain; whether the current use instruction can reach the original instruction, if the current use instruction can reach the original instruction, make the following judgment:

[0046] Full domain-sensitive judgment: judge whether the current use instruction is an address-taking instruction and contains a variable offset. If the current use instruction is an address-taking instruction and contains a variable offset, insert an instruction to record the variable offset at runtime into the intermediate code to obtain the position of the key variable offset;

[0047] Source sensitivity judgment: judge whether the current use instruction is an assignment instruction. The current use instruction is an assignment instruction for function pointer related variables. The assignment instruction is the source point, and the assignment instruction is analyzed by pointer to obtain the control flow graph of the open source program. The control flow graph contains the value of the key variable offset, the function pointer value and the function pointer address;

[0048] Step 1.3: After traversing the def-use chain of the function pointer of the current indirect call, continue to traverse the next indirect call until all indirect calls are traversed;

[0049] Step 2: When the program is running, the context information in the executable file is detected and stored in the memory protected by Intel MPK. The detected context information and the control flow graph obtained in step 1 are combined to check whether the function pointer value indirectly called by the open source program is legal; the context information is the key variable offset, function pointer value and function pointer address;

[0050] Specifically, when the open source program runs to the location of the source point and the offset of the key variable, the source point information and the offset of the key variable are written into the hash table protected by Intel MPK. The hash table storage is selected to reduce the additional performance consumption during runtime; the source point information includes the function pointer value and the function pointer address;

[0051] When the open source program continues to execute to the indirect call, first check whether the function pointer value and function pointer address of the indirect call exist in the hash table; if not, it means that the function pointer has been tampered by the attacker, and the program should be terminated immediately; if it exists, check whether there is key variable offset information, function pointer value and function pointer address matching those in the hash table in the control flow graph at the same time, if there is no match, the program will be terminated, and if it matches, the program will continue to execute; the purpose of the two-step verification is to ensure that the function pointer value of the entire process is not tampered;

[0052] The value of the key variable offset corresponds to the function pointer value of the current indirect call one by one, so the function pointer value of the current indirect call is determined by the key variable offset.

[0053] A control flow integrity system based on full domain sensitivity and source sensitivity, comprising:

[0054] Static analysis module: used to perform static analysis on the intermediate code of the open source program, obtain the control flow graph of the open source program, and integrate the control flow graph and the intermediate code into an executable file;

[0055] Program judgment module: used to detect the context information in the executable file and store it in the memory protected by Intel MPK. It combines the detected context information and the control flow graph in the static analysis module to check whether the function pointer value of the indirect call of the open source program is legal. If it is legal, the program will continue to be executed. If it is illegal, the program will be terminated immediately.

[0056] A control flow integrity device based on full domain sensitivity and source sensitivity, comprising:

[0057] Memory: a computer-readable device used to store the computer program of the control flow integrity method based on full domain sensitivity and source sensitivity;

[0058] Processor: used to implement the above-mentioned control flow integrity method based on full domain sensitivity and source sensitivity when executing the computer program.

[0059] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program can implement the above-mentioned control flow integrity method based on full domain sensitivity and source sensitivity.

[0060] Simulation experiment

[0061] The security performance of the present invention on the test set SPEC CPU2006 (400.perlbench, 401.bzip2, 403.gcc, 433.milc, 444.namd, 445.gobmk, 447.dealII, 450.soplex, 453.porvray, 456.hmmer, 458.sjeng, 464.h264ref, 471.omnetpp, 473.astar, 482.sphinx3, 483.xalancbmk), servers (Httpd, Lightpd, Nginx), databases (Redis) and browsers (Edbrowse, FireFox) is outstanding. The following table shows the security comparison between the present invention and LLVM CFI (control flow integrity scheme based on LLVM compiler) and OS-CFI (source-sensitive control flow integrity scheme) on the above software, where Avg represents the average number of legal function pointer values ​​for each indirect call in the control flow graph. The lower the value, the less likely the attacker is to hijack the control flow, and the safer the program; Lg represents the maximum value of the number of legal function pointer values ​​for a single indirect call in the control flow graph. The lower the value, the more difficult it is for an attacker to hijack the control flow using the indirect call, and the safer the program; % represents how much the present invention has reduced compared with other technical corresponding projects; - represents that the data is not available at present. As can be seen from Table 1, the average Avg and Lg of the present invention are 1.7 and 15 respectively. Compared with LLVM CFI, these two items are reduced by 94.7% and 90.3% respectively; compared with OS-CFI, these two items are reduced by 90.2% and 89.3% respectively, indicating that the method of the present invention greatly improves the security of the program.

[0062] In addition, the present invention also performs performance tests on the test sets SPEC CP2006, SPEC CPU2017 (500.perlbench, 502.gcc, 505.mcf, 508.namd, 510.parest, 520.omnetpp, 523.xalancbmk, 525.x264, 526.blender, 538.imagick, 544.nab, 557.xz), servers (Httpd, Lightpd, Nginx), databases (Redis) and browsers (Edbrowse, FireFox), and the results are as follows: Figure 4 As shown, the horizontal axis represents the test software, and the vertical axis represents the percentage of increase in software performance consumption. Overall, the average percentage of increase in performance consumption of the present invention is only 7.2%, indicating that the method of the present invention reduces the performance consumption of the software.

[0063] Table 1 is a security comparison between the present invention and the prior art under different test sets

[0064]

Claims

1. A control flow integrity method based on full domain sensitivity and source sensitivity, characterized in that: The steps include: Step 1: statically analyze the intermediate code of the open source program to obtain the control flow graph of the open source program, and integrate the control flow graph and the intermediate code into an executable file; the control flow graph includes the value of the key variable offset, the function pointer value and the function pointer address, and the key variable offset is the variable offset involved in the calculation of the function pointer address; Step 2: When the program is running, the context information in the executable file is detected and stored in the memory protected by Intel MPK. The detected context information and the control flow graph obtained in step 1 are combined to check whether the function pointer value indirectly called by the open source program is legal. If it is legal, the program continues to be executed. If it is illegal, the program is terminated immediately. The context information is the key variable offset, function pointer value and function pointer address.

2. A control flow integrity method based on full domain sensitivity and source sensitivity according to claim 1, characterized in that: In the step 1, a source-sensitive static analysis is performed on the intermediate code of the open source program to obtain the assignment of function pointer-related variables, and pointer analysis is performed on the assignment of function pointer-related variables to obtain the control flow graph of the open source program; a full domain-sensitive static analysis is performed on the intermediate code of the open source program to obtain the position of the key variable offset.

3. A control flow integrity method based on full domain sensitivity and source sensitivity according to claim 1 or 2, characterized in that: The specific process of static analysis in step 1 is as follows: Step 1.1: Traverse the def-use chain of the function pointer of the current indirect call instruction in the intermediate code, define the indirect call instruction as the original instruction, and backtrack along the def-use chain of the function pointer until it backtracks to the root of the def-use chain; Step 1.2: Recursively traverse the use of the root instruction of the def-use chain to see if the current use instruction can reach the original instruction. If the current use instruction can reach the original instruction, make the following judgment: Full domain-sensitive judgment: judge whether the current use instruction is an address-taking instruction and contains a variable offset. If the current use instruction is an address-taking instruction and contains a variable offset, insert an instruction to record the variable offset at runtime into the intermediate code to obtain the position of the key variable offset; Source sensitivity judgment: judge whether the current use instruction is an assignment instruction. If the current use instruction is an assignment instruction for function pointer-related variables, perform pointer analysis on the assignment instruction to obtain the control flow graph of the open source program. The control flow graph contains the value of the key variable offset, the function pointer value, and the function pointer address. Step 1.3: After traversing the def-use chain of the function pointer of the current indirect call, continue to traverse the next indirect call until all indirect calls are traversed.

4. A control flow integrity method based on full domain sensitivity and source sensitivity according to claim 3, characterized in that: The def-use chain of the instructions of the intermediate code is a tree structure, and nodes other than the root node have only one child node.

5. A control flow integrity method based on full domain sensitivity and source sensitivity according to claim 1, characterized in that: In step 2, when the open source program runs to the location of the source point and the key variable offset, the source point information and the key variable offset information are written into the hash table protected by Intel MPK; the source point information includes the function pointer value and the function pointer address; When the open source program continues to execute to the indirect call, first check whether there is the function pointer value and function pointer address of the indirect call in the hash table; If it does not exist, it means that the function pointer has been tampered by the attacker and the program should be terminated immediately. If it does exist, check in the control flow graph whether there is key variable offset information, function pointer value and function pointer address that match the hash table. If they do not match, the program should be terminated, and if they match, the program should continue to be executed.

6. A system for implementing a control flow integrity method based on full domain sensitivity and source sensitivity, characterized in that: include: Static analysis module: used to perform static analysis on the intermediate code of the open source program, obtain the control flow graph of the open source program, and integrate the control flow graph and the intermediate code into an executable file; Program judgment module: used to detect the context information in the executable file and store it in the memory protected by Intel MPK. It combines the detected context information and the control flow graph in the static analysis module to check whether the function pointer value of the indirect call of the open source program is legal. If it is legal, the program will continue to be executed. If it is illegal, the program will be terminated immediately.

7. A control flow integrity device based on full domain sensitivity and source sensitivity, characterized in that: include: Memory: a computer-readable device used to store a computer program of a control flow integrity method based on full domain sensitivity and source sensitivity as described in any one of claims 1 to 5; Processor: used to implement a control flow integrity method based on full domain sensitivity and source sensitivity as described in any one of claims 1-5 when executing the computer program.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it can implement a control flow integrity method based on full domain sensitivity and source sensitivity as described in any one of claims 1 to 5.

Images