A method, system, device, and medium for control flow integrity based on full domain sensitivity and source sensitivity

Abstract

This invention discloses a control flow integrity method, system, device, and medium based on full domain sensitivity and source sensitivity. The method includes static analysis of the intermediate code of an open-source program to obtain its control flow graph; integrating the control flow graph with the intermediate code into an executable file; during program execution, detecting context information in the executable file and storing it in memory protected by Intel MPK; combining the detected context information and the control flow graph to check the validity of function pointer values ​​in indirect calls of the open-source program; if valid, program execution continues; otherwise, the program is immediately terminated. The system, device, and medium are used to implement this method. The high-precision control flow graph constructed by this invention enhances the program's ability to resist control flow hijacking attacks; utilizing Intel MPK hardware technology to protect runtime context information reduces additional performance consumption and improves system portability and robustness.

Description

Technical Field

[0001] This invention belongs to the field of computer security technology, and in particular relates to a control flow integrity method, system, device and medium based on full domain sensitivity and source sensitivity. Background Technology

[0002] While C and C++ programs offer excellent direct memory access capabilities, this also makes them vulnerable to memory corruption attacks. Attackers can exploit buffer overflow vulnerabilities to tamper with function pointers or return address data in memory, thereby reversing the program's control flow to an illegal location. Early control flow hijacking attacks typically employed code injection, injecting malicious code (shellcode) into the target program's memory and then hijacking control flow to execute this malicious code. To defend against this attack, later computer systems introduced Data Execution Protection (DEP) mechanisms, which restrict memory pages to having both write and execute permissions simultaneously to prevent the execution of malicious code. To bypass DEP defenses, attackers explored code reuse attacks. These attacks include Return-to-libc, Return Oriented Programming (ROP), and Jump Oriented Programming (JOP). These attacks utilize existing legitimate code snippets (gadgets) in the target program, piecing them together to construct malicious control flow transfers and achieve control of the target system. These new control flow hijacking attack methods do not rely on injecting malicious code but instead utilize the program's own legitimate code, making them more difficult to detect and defend against.

[0003] To defend against these new control flow hijacking attacks, Abadi et al. proposed the concept of Control Flow Integrity (CFI) (Martín Abadi, Mihai Budiu, Erlingsson and Jay Ligatti. 2005. Control-flow integrity. In Proceedings of the 12th ACM conference on Computer and communications security (CCS'05). Association for Computing Machinery, New York, NY, USA, (pp 340–353). and Abadi, M., Budiu, M., Erlingsson, U., & Ligatti, J. (2009). Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security (TISSEC), 13(1), (pp 1-40). The core idea of ​​this approach is to restrict control transfers during program execution, ensuring they remain within the scope of a predefined control flow graph, thereby defending against control flow hijacking attacks. However, this method only focuses on the target address of the control flow transfer, ignoring the context information of the transfer. Attackers may exploit legitimate control flow transfers to execute in different contexts, thus bypassing CFI protection. To address the security shortcomings of early CFI (Context-Sensitive Context-Based ... E., Gras, B., Sambuc, L., Slowinska, A., ... & Giuffrida, C. (2015, October). Practical context-sensitive CFI. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (pp. 927-940). Context-sensitive CFI performs correlation checks on control flow edges in the execution path, considering the context information of the execution path. It not only focuses on the legitimacy of the jump target but also checks whether the current context is consistent with expectations. This method can better capture the actual control flow of the program, thereby improving the defense capability against control flow hijacking attacks. Specifically, context-sensitive CFI collects the program's control flow information during the static analysis phase, tracks the execution path at runtime, and matches it with the static analysis results to detect whether control flow hijacking exists. This method provides stronger security protection compared to traditional CFI, but it also incurs certain performance overhead. Furthermore, these solutions require leveraging Intel hardware features to record runtime context information, and specific hardware limitations restrict the portability of these solutions. Summary of the Invention

[0004] To overcome the shortcomings of the prior art, the present invention aims to provide a control flow integrity method, system, device, and medium based on full domain sensitivity and source sensitivity. Utilizing rich contextual information in the intermediate program code, it achieves precise location of function pointers, their related variable assignments, and key variable offsets through static analysis, generating a high-precision control flow graph, thereby reducing the attacker's attack surface. Furthermore, the present invention only utilizes Intel MPK hardware technology to protect runtime memory pages, which can be easily replaced with relevant memory protection technologies on other platforms, improving the portability of the present invention across different platforms.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] A control flow integrity method based on full domain sensitivity and source sensitivity includes the following steps:

[0007] Step 1: Perform static analysis on the intermediate code of the open-source program to obtain the control flow graph of the open-source program, and integrate the control flow graph with the intermediate code into an executable file; the control flow graph includes the values ​​of key variable offsets, function pointer values, and function pointer addresses; the key variable offsets are the offsets of variables involved in the calculation of function pointer addresses;

[0008] Step 2: During program execution, the context information in the executable file is detected and stored in memory protected by Intel MPK. The detected context information and the control flow graph obtained in Step 1 are combined to check whether the function pointer values ​​of indirect calls in the open source program are valid. If valid, the program continues to execute; if invalid, the program is terminated immediately. The context information includes the offset of key variables, function pointer values, and function pointer addresses.

[0009] In step 1, source-sensitive static analysis is performed on the intermediate code of the open-source program to obtain the assignments of variables related to function pointers. Pointer analysis is then performed on the assignments of variables related to function pointers to obtain the control flow graph of the open-source program. Finally, full-domain-sensitive static analysis is performed on the intermediate code of the open-source program to obtain the positions of the offsets of key variables.

[0010] The specific process of static analysis in step 1 is as follows:

[0011] Step 1.1: Traverse the def-use chain of the function pointer of the current indirect call instruction in the intermediate code, define the indirect call instruction as the original instruction, and backtrack along the def-use chain of the function pointer until the root of the def-use chain is reached.

[0012] Step 1.2: Recursively traverse the `use` instruction at the root of the def-use chain. Check if the current `use` instruction can reach the original instruction. If the current `use` instruction can reach the original instruction, then perform the following judgment:

[0013] Full domain sensitivity check: Determine if the current use instruction is an address-of instruction and contains a variable offset. If the current use instruction is an address-of instruction and contains a variable offset, insert an instruction in the intermediate code to record the variable offset at runtime, and obtain the position of the critical variable offset.

[0014] Source sensitivity judgment: Determine whether the current use instruction is an assignment instruction. If the current use instruction is an assignment instruction for function pointer-related variables, perform pointer analysis on the assignment instruction to obtain the control flow graph of the open source program. The control flow graph includes the values ​​of key variable offsets, function pointer values, and function pointer addresses.

[0015] Step 1.3: After traversing the def-use chain of the function pointer of the current indirect call, continue traversing the next indirect call until all indirect calls have been traversed.

[0016] The def-use chain of instructions in the intermediate code is a tree structure, and each node except the root node has only one child node.

[0017] In step 2, when the open-source program reaches the location of the source point and the offset of the key variable, the source point information and the offset information of the key variable are written into a hash table protected by Intel MPK; the source point information includes function pointer value and function pointer address;

[0018] When the open-source program continues to execute to the point of indirect call, it first checks whether the function pointer value and function pointer address of the indirect call exist in the hash table. If they do not exist, it means that the function pointer has been tampered with by an attacker, and the program should be stopped immediately. If they exist, it searches in the control flow graph for the existence of key variable offset information, function pointer value, and function pointer address that match those in the hash table. If they do not match, the program is stopped; if they match, the program continues to execute.

[0019] A system for implementing control flow integrity methods based on full domain sensitivity and source sensitivity, comprising:

[0020] Static analysis module: Used to perform static analysis on the intermediate code of open source programs, obtain the control flow graph of the open source programs, and integrate the control flow graph with the intermediate code into an executable file;

[0021] Program judgment module: It is used to detect the context information in the executable file and store it in memory protected by Intel MPK. It combines the detected context information with the control flow graph in the static analysis module to check whether the function pointer value of the indirect call of the open source program is valid. If it is valid, the program continues to execute; if it is invalid, the program is terminated immediately.

[0022] A control flow integrity device based on full domain sensitivity and source sensitivity includes:

[0023] Memory: A computer-readable device used to store the computer program of the above-described control flow integrity method based on full domain sensitivity and source sensitivity;

[0024] Processor: Used to implement the above-described control flow integrity method based on full domain sensitivity and source sensitivity when executing the computer program.

[0025] A computer-readable storage medium storing a computer program that, when executed by a processor, enables the implementation of the aforementioned control flow integrity method based on full domain sensitivity and source sensitivity.

[0026] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0027] 1. Compared with existing context-based control flow integrity schemes, this invention extends the scope of the context to the assignment of all function pointer-related variables, enabling precise lookup and instrumentation of these assignments. At the same time, this invention can include the offsets of key variables in the scope of the context and construct a control flow graph containing the offsets of key variables through static pointer analysis, which greatly improves the accuracy of the control flow graph and thus enhances the security of the entire scheme.

[0028] 2. This invention utilizes Intel MPK hardware technology to protect the memory pages containing the runtime context from read and write operations. This not only increases the difficulty for attackers to tamper with the runtime context but also reduces the additional performance consumption during runtime. Furthermore, it is more robust and reliable than MPX, which relies on software implementation.

[0029] 3. This invention uses Intel MPK hardware technology to protect the runtime context information of the program. At the same time, this technology can be easily replaced by related memory protection technologies on other platforms, improving the portability of the system on various platforms.

[0030] In summary, compared with existing technologies, this invention utilizes the static, single-assignment characteristic of intermediate program code to perform a depth-first backtracking traversal of the def-use chain of function pointers to find all function pointer assignments. During the backtracking process, it identifies the variable offsets involved in calculating function pointer addresses. This static analysis based on full domain sensitivity and source sensitivity can fully utilize the obtained context information to segment the control flow graph, thereby significantly improving the accuracy of CFI. Furthermore, to protect this context information during program runtime, Intel MPK hardware technology is used to protect the memory storing the context information. Although this also relies on Intel's hardware features, corresponding memory protection technologies on other platforms can also protect the context information, thus improving the portability of this invention across various platforms. Attached Figure Description

[0031] Figure 1 This is a general structural diagram of the control flow integrity method provided by the present invention.

[0032] Figure 2 The flowchart is shown for the static analysis module in the control flow integrity method provided by this invention.

[0033] Figure 3 The control flow graph of the program judgment module in the control flow integrity method provided by the present invention.

[0034] Figure 4 This is a performance consumption graph of the present invention on different test sets. Detailed Implementation

[0035] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0036] like Figure 1 As shown, a control flow integrity method based on full domain sensitivity and source sensitivity includes the following steps:

[0037] Step 1: Perform static analysis on the intermediate code of the open source program to obtain the control flow graph of the open source program, and integrate the control flow graph with the intermediate code into an executable file;

[0038] Specifically, source-sensitive static analysis is performed on the intermediate code of the open-source program to obtain the assignments of variables related to function pointers. Pointer analysis is then performed on these assignments to obtain the control flow graph of the open-source program. Full-domain-sensitive static analysis is also performed on the intermediate code to obtain the locations of key variable offsets. The control flow graph includes the values ​​of key variable offsets, function pointer values, and function pointer addresses. The key variable offsets are the offsets of variables involved in the calculation of function pointer addresses.

[0039] The intermediate code is LLVM IR (Intermediate Representation), which is a highly readable, cross-platform intermediate code generated by the LLVM compiler frontend;

[0040] The specific process of pointer analysis is as follows:

[0041] The Static Value-Flow (SVF) analysis tool is used to analyze the assignment points of variables related to function pointers to find the corresponding function pointer values. Additionally, if the function pointer is located in a domain (structure or array), the function pointer value and its corresponding variable offset value need to be extracted. Through this analysis process, a control flow graph containing function pointer addresses, function pointer values, and key offset values ​​is obtained.

[0042] like Figure 2 As shown, the specific process of the static analysis is as follows:

[0043] Step 1.1: Traverse the def-use chain of the function pointer of the current indirect call instruction in the intermediate code, define the indirect call instruction as the original instruction, and backtrack along the def-use chain of the function pointer until the root of the def-use chain is reached.

[0044] The def-use chain of the intermediate code instructions is a tree structure, and each node except the root node has only one child node. Therefore, in this way, the assignment of function pointer-related variables can be accurately found.

[0045] Step 1.2: Recursively traverse the `use` instruction at the root of the def-use chain; check if the current `use` instruction can reach the original instruction. If the current `use` instruction can reach the original instruction, then perform the following judgment:

[0046] Full domain sensitivity check: Determine if the current use instruction is an address-of instruction and contains a variable offset. If the current use instruction is an address-of instruction and contains a variable offset, insert an instruction in the intermediate code to record the variable offset at runtime, and obtain the position of the critical variable offset.

[0047] Source sensitivity judgment: Determine whether the current use instruction is an assignment instruction. If the current use instruction is an assignment instruction for function pointer-related variables, this assignment instruction is the source point. Perform pointer analysis on the assignment instruction to obtain the control flow graph of the open source program. The control flow graph contains the values ​​of key variable offsets, function pointer values, and function pointer addresses.

[0048] Step 1.3: After traversing the def-use chain of the function pointer of the current indirect call, continue traversing the next indirect call until all indirect calls have been traversed;

[0049] Step 2: During program execution, the context information in the executable file is detected and stored in memory protected by Intel MPK. The detected context information and the control flow graph obtained in Step 1 are combined to check whether the function pointer values ​​of indirect calls in the open source program are valid. The context information includes the offset of key variables, function pointer values, and function pointer addresses.

[0050] Specifically, when the open-source program reaches the source point and the offset of the key variable, the source point information and the offset of the key variable are written into a hash table protected by Intel MPK. The hash table is chosen to reduce the additional performance consumption during runtime. The source point information includes the function pointer value and the function pointer address.

[0051] When the open-source program continues execution to an indirect call, it first checks whether the function pointer value and function pointer address of the indirect call exist in the hash table. If they do not exist, it means that the function pointer has been tampered with by an attacker, and the program should be stopped immediately. If they exist, it also checks whether there is a matching key variable offset information, function pointer value, and function pointer address in the control flow graph. If they do not match, the program is stopped; if they match, the program continues to execute. The purpose of this two-step verification is to ensure that the function pointer value is not tampered with throughout the entire process.

[0052] The value of the key variable offset corresponds one-to-one with the value of the function pointer in the current indirect call. Therefore, the value of the function pointer in the current indirect call is determined by the key variable offset.

[0053] A control flow integrity system based on full domain sensitivity and source sensitivity includes:

[0054] Static analysis module: Used to perform static analysis on the intermediate code of open source programs, obtain the control flow graph of the open source programs, and integrate the control flow graph with the intermediate code into an executable file;

[0055] Program judgment module: It is used to detect the context information in the executable file and store it in memory protected by Intel MPK. It combines the detected context information with the control flow graph in the static analysis module to check whether the function pointer value of the indirect call of the open source program is valid. If it is valid, the program continues to execute; if it is invalid, the program is terminated immediately.

[0056] A control flow integrity device based on full domain sensitivity and source sensitivity includes:

[0057] Memory: A computer-readable device used to store the computer program of the above-described control flow integrity method based on full domain sensitivity and source sensitivity;

[0058] Processor: Used to implement the above-described control flow integrity method based on full domain sensitivity and source sensitivity when executing the computer program.

[0059] A computer-readable storage medium storing a computer program that, when executed by a processor, enables the implementation of the aforementioned control flow integrity method based on full domain sensitivity and source sensitivity.

[0060] Simulation Experiment

[0061] This invention demonstrates outstanding security performance on the SPEC CPU2006 test set (400.perlbench, 401.bzip2, 403.gcc, 433.milc, 444.namd, 445.gobmk, 447.dealII, 450.soplex, 453.porvray, 456.hmmer, 458.sjeng, 464.h264ref, 471.omnetpp, 473.astar, 482.sphinx3, 483.xalancbmk), servers (Httpd, Lightpd, Nginx), databases (Redis), and browsers (Edbrowse, Firefox). The table below compares the security of this invention with LLVM CFI (a control flow integrity scheme based on the LLVM compiler) and OS-CFI (source-sensitive control flow integrity scheme) on the aforementioned software. Avg represents the average number of legitimate function pointer values ​​per indirect call in the control flow graph; the lower this value, the less likely an attacker is to hijack the control flow, and the more secure the program. Lg represents the maximum number of legitimate function pointer values ​​per single indirect call in the control flow graph; the lower this value, the more difficult it is for an attacker to hijack the control flow using that indirect call, and the more secure the program. % indicates how much this invention reduces security compared to corresponding technologies; - indicates that data for this technology is currently unavailable. As shown in Table 1, the average Avg and Lg of this invention are 1.7 and 15, respectively. Compared to LLVM CFI, these two values ​​are reduced by 94.7% and 90.3%, respectively; compared to OS-CFI, these two values ​​are reduced by 90.2% and 89.3%, respectively, indicating that the method of this invention significantly improves program security.

[0062] In addition, this invention also conducted performance tests on the test sets SPEC CP2006 and SPEC CPU2017 (500.perlbench, 502.gcc, 505.mcf, 508.namd, 510.parest, 520.omnetpp, 523.xalancbmk, 525.x264, 526.blender, 538.imagick, 544.nab, 557.xz) servers (Httpd, Lightpd, Nginx), database (Redis), and browser (Edbrowse, Firefox). The results are as follows. Figure 4 As shown, the horizontal axis represents the test software, and the vertical axis represents the percentage increase in software performance consumption. Overall, the average percentage increase in performance consumption of the present invention is only 7.2%, indicating that the method of the present invention reduces the performance consumption of the software.

[0063] Table 1 compares the security of the present invention and prior art under different test sets.

[0064]

Claims

1. A control flow integrity method based on full domain sensitivity and source sensitivity, characterized in that, Includes the following steps: Step 1: Perform static analysis on the intermediate code of the open-source program to obtain the control flow graph of the open-source program. Integrate the control flow graph and the intermediate code into an executable file. The control flow graph includes the values ​​of key variable offsets, function pointer values, and function pointer addresses. The key variable offsets are the offsets of variables involved in the calculation of function pointer addresses. The specific process of the static analysis is as follows: Step 1.1: Traverse the def-use chain of the function pointer of the current indirect call instruction in the intermediate code, define the indirect call instruction as the original instruction, and backtrack along the def-use chain of the function pointer until the root of the def-use chain is reached. Step 1.2: Recursively traverse the `use` instruction at the root of the def-use chain. Check if the current `use` instruction can reach the original instruction. If the current `use` instruction can reach the original instruction, then perform the following judgment: Full domain sensitivity check: Determine if the current use instruction is an address-of instruction and contains a variable offset. If the current use instruction is an address-of instruction and contains a variable offset, insert an instruction in the intermediate code to record the variable offset at runtime, and obtain the position of the critical variable offset. Source sensitivity judgment: Determine whether the current use instruction is an assignment instruction. If the current use instruction is an assignment instruction for function pointer-related variables, perform pointer analysis on the assignment instruction to obtain the control flow graph of the open source program. The control flow graph includes the values ​​of key variable offsets, function pointer values, and function pointer addresses. Step 1.3: After traversing the def-use chain of the function pointer of the current indirect call, continue traversing the next indirect call until all indirect calls have been traversed; Step 2: During program execution, the context information in the executable file is detected and stored in memory protected by Intel MPK. The detected context information and the control flow graph obtained in Step 1 are combined to check whether the function pointer values ​​of indirect calls in the open source program are valid. If valid, the program continues to execute; if invalid, the program is terminated immediately. The context information includes the offset of key variables, function pointer values, and function pointer addresses.

2. The control flow integrity method based on full domain sensitivity and source sensitivity according to claim 1, characterized in that: In step 1, source-sensitive static analysis is performed on the intermediate code of the open-source program to obtain the assignments of variables related to function pointers. Pointer analysis is then performed on the assignments of variables related to function pointers to obtain the control flow graph of the open-source program. Finally, full-domain-sensitive static analysis is performed on the intermediate code of the open-source program to obtain the positions of the offsets of key variables.

3. The control flow integrity method based on full domain sensitivity and source sensitivity according to claim 1, characterized in that, The def-use chain of instructions in the intermediate code is a tree structure, and each node except the root node has only one child node.

4. The control flow integrity method based on full domain sensitivity and source sensitivity according to claim 1, characterized in that, In step 2, when the open-source program reaches the location of the source point and the offset of the key variable, the source point information and the offset information of the key variable are written into a hash table protected by Intel MPK; the source point information includes function pointer value and function pointer address; When the open-source program continues to execute to the point of indirect call, it first checks whether the function pointer value and function pointer address of the indirect call exist in the hash table; If it does not exist, it means that the function pointer has been tampered with by an attacker, and the program should be terminated immediately; if it exists, at the same time, search in the control flow graph for the existence of key variable offset information, function pointer value and function pointer address that match the hash table. If they do not match, the program should be terminated; if they match, the program should continue to execute.

5. A system based on a control flow integrity method according to any one of claims 1-4, characterized in that, include: Static analysis module: Used to perform static analysis on the intermediate code of open source programs, obtain the control flow graph of the open source programs, and integrate the control flow graph with the intermediate code into an executable file; Program judgment module: It is used to detect the context information in the executable file and store it in memory protected by Intel MPK. It combines the detected context information with the control flow graph in the static analysis module to check whether the function pointer value of the indirect call of the open source program is valid. If it is valid, the program continues to execute; if it is invalid, the program is terminated immediately.

6. A control flow integrity device based on full domain sensitivity and source sensitivity, characterized in that, include: Memory: a computer program for storing a control flow integrity method based on full domain sensitivity and source sensitivity as described in any one of claims 1-4, and is a computer-readable device; Processor: Used to implement the control flow integrity method based on full domain sensitivity and source sensitivity as described in any one of claims 1-4 when executing the computer program.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program that, when executed by a processor, enables the implementation of a control flow integrity method based on full domain sensitivity and source sensitivity as described in any one of claims 1-4.

Images