Using binary instrumentation to defend against Spectre v1 attacks

Abstract

This invention discloses a method for defending against Spectre v1 attacks on ARM architecture using binary instrumentation. The implementation steps are as follows: obtaining the disassembly information of the target binary file; analyzing the disassembly information; identifying code segments vulnerable to Spectre v1 attacks; adding these vulnerable code segments to a code segment set; determining if the code segment set is empty; if not empty, constructing defense instructions based on the vulnerable code segments; and using a binary instrumentation tool to insert the defense instructions into the target binary file. This invention is used to defend against Spectre v1 attacks, requires no source code, is applicable to commercial software and closed-source systems, does not increase system complexity, and has low development costs.

Description

Technical Field

[0001] This invention belongs to the field of processor information security technology, and further relates to a method for defending against Spectre v1 attacks using binary instrumentation within the field of computer malware detection or processing technology. This invention can be used to defend against Spectre v1 attacks at the software level of ARM architecture, primarily protecting vulnerable binary files. Background Technology

[0002] Currently, for hardware devices widely used in information processing, especially in already widely deployed systems, modifying existing hardware is impractical. Using serialization or speculative blocking instructions, or disabling branch prediction, can significantly reduce the processor's speculative execution efficiency, negatively impacting system performance. The Spectre v1 attack exploits a vulnerability in the processor's speculative execution mechanism. This attack leverages the CPU's speculative execution and side-channel leakage to train a branch predictor to make incorrect predictions, thereby reading sensitive data that should be restricted. Because the attack occurs during the speculative execution phase, rather than the actual execution phase, traditional security measures are insufficient to prevent data leakage. This characteristic makes Spectre v1 a difficult type of vulnerability to detect and defend against.

[0003] China Electronics Technology Group Corporation (CETC) Shentai Information Technology Co., Ltd. disclosed a method for disrupting speculative execution attacks on superscalar processors in its patent application, "Method for Disrupting Speculative Execution Attacks on Superscalar Processors" (Application No.: 202311344301.1, Authorization Announcement No.: CN 117077152B, Application Date: October 18, 2023). The method's implementation steps are as follows: Step 1: Code detection and marking; Code detection is performed on the input source code to detect and mark any possible speculative execution bypasses; Step 2: Branch filtering and closure; For the potentially speculative execution bypasses marked in Step 1, specific branch instructions are filtered out, the branch prediction unit at that location is closed, and secondary marking is performed; Step 3: Increasing access latency; The secondary markings in Step 1 are removed, and for the remaining marked locations, specific instructions following the branch instructions are detected, increasing the access latency of the Dcache. This method combines multiple means of detecting and closing branch predictors and delaying cache access, comprehensively defending against the two core mechanisms of Speculative attacks: erroneous branch prediction and cache side-channel leakage. By filtering branches and disabling branch prediction units, speculative execution can be directly prevented. Increasing cache access latency can effectively prevent attackers from using side channels to obtain information. However, this detection method still has three shortcomings: First, it requires operation on the source code, which cannot be applied to many commercial software and closed-source systems. Second, while disabling branch prediction units can eliminate the risk of Spectre attacks, it may cause processor pipeline stalls and instruction reordering, resulting in higher program overhead. Third, increasing Dcache access latency, while significantly reducing the risk of sensitive data from Spectre attacks, requires the system to wait longer for each data read or write, directly reducing data processing speed and further increasing program overhead.

[0004] The Institute of Information Engineering, Chinese Academy of Sciences, disclosed a method and system for resisting Spectre attacks based on flush operations in its patent application "A Method and System for Resisting Spectre Attacks Based on Flush Operations" (Application No.: 202010633770.5, Publication No.: CN 111898127A, Application Date: July 2, 2020). The method involves the following steps: executing a flush operation of a process and recording the current process information; calculating the time interval between two consecutive flush operations of the current process and determining whether this time interval falls within the malicious flush time range; if so, it is determined to be a malicious flush operation; if the number of malicious flush operations exceeds a threshold, it is determined to be a malicious process; disabling branch prediction, putting the malicious process to sleep, and preventing the CPU from speculatively executing, thereby resisting Spectre attacks based on flush operations. This method can monitor and record process flush operations in real time, detecting whether a process is engaging in malicious flush behavior. If a malicious process is detected, branch prediction is temporarily disabled to prevent the CPU from speculative execution. This not only resists Spectre attacks based on flush operations launched by attackers but also ensures the normal use of the system's flush function. However, this method still has shortcomings: it requires the introduction of a specially designed Flush-Detector API into the system and relies on hardware (such as timers and branch prediction registers) and kernel-level coordination. This means that the existing system architecture needs to be modified, increasing system complexity and the development cost of defense measures. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of the existing technology by proposing a method for defending against Spectre v1 attacks on the ARM architecture using binary instrumentation. This method solves the problems that existing technologies cannot be applied to many commercial software and closed-source systems, have high program overhead, increase system complexity, and have high development costs for defense measures.

[0006] The approach to achieving the objective of this invention is as follows: This invention disassembles the code segments of the target binary file, identifies vulnerable code segments, and then uses binary instrumentation technology to insert defensive instructions into these vulnerable Spectre v1 attack segments, thereby achieving defense against Spectre v1 attacks. This invention implements defensive measures starting from the binary file, disassembling the target binary file to identify vulnerable code segments and directly inserting instructions into the binary file through binary instrumentation. These methods can all be performed directly on the binary file without source code, solving the problem that existing technologies require source code and cannot be applied to commercial software and closed-source systems. This invention uses the method of inserting instructions into vulnerable code segments of the target binary file to defend against Spectre v1 attacks. The inserted instructions are used to check the index after the branch jump, thereby preventing speculative execution by Spectre v1 attacks. This does not disable the branch prediction unit or increase Dcache access latency, solving the problem of high program overhead in existing technologies. Furthermore, this invention modifies the target binary file only at the software level, automatically identifying vulnerable code and inserting instructions. It is an automated method at the software level, independent of the system level, requiring no hardware-software coordination, no modifications to the system architecture, and does not increase system complexity or the development cost of defense measures. This solves the problem of existing technologies requiring system modifications, which increases system complexity and defense development costs.

[0007] The implementation steps of this invention are as follows:

[0008] Step 1: Obtain the disassembly information of the target binary file;

[0009] Step 2: Analyze the disassembly information, identify code snippets vulnerable to Spectre v1 attacks, and add these vulnerable snippets to the code snippet set.

[0010] Step 3: Determine if the code snippet set is empty. If it is, the target binary file does not contain any code snippets vulnerable to Spectrev1 attacks; otherwise, proceed to step 4.

[0011] Step 4: Construct defense instructions based on code snippets vulnerable to Spectre v1 attacks;

[0012] Step 5: Use binary instrumentation to insert defensive commands into the target binary file.

[0013] Compared with the prior art, the present invention has the following advantages:

[0014] First, this invention employs disassembly and binary instrumentation methods, allowing direct manipulation of the target binary file without requiring source code. This makes it applicable to both commercial software and closed-source systems. Compared to traditional defense methods that require source code, this invention overcomes the limitations imposed by source code requirements, offering the advantage of implementing defensive measures directly on the target binary file without being restricted by source code.

[0015] Secondly, this invention employs an insert instruction method to defend against Spectre v1 attacks. By checking the index through insert instructions, the overhead of these instructions is relatively low. This overcomes the problems of existing technologies that require disabling branch prediction units and increasing Dcache access latency, resulting in higher program overhead. Therefore, this invention can achieve defense against Spectre v1 attacks with minimal impact on program performance.

[0016] Third, since the defense measures of this invention are based on the software level and do not involve the system architecture and underlying hardware, the defense against Spectre v1 attacks can be completed without modifying the system design. This does not increase the complexity of the system and the development cost of the defense measures is low. It overcomes the problems of increased system complexity and high development cost of existing defense measures. This invention can achieve the defense against Spectre v1 attacks without affecting the system and with low development cost. Attached Figure Description

[0017] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0018] The following is combined with Figure 1 The invention will be further described in detail with reference to two embodiments.

[0019] Example 1:

[0020] Step 1: Obtain the disassembly information of the target binary file.

[0021] The disassembler used in this embodiment of the invention is Capstone. The target binary file in the embodiment is an executable file under the ARMv8 architecture. The binary information in the executable file is disassembled by calling the methods in the Capstone framework through the Python language, and the disassembly information in the executable file is obtained. The assembly code is obtained from the obtained disassembly information.

[0022] Step 2: Analyze the disassembly information, identify code segments vulnerable to Spectre v1 attacks, and add the vulnerable code segments to the code segment set.

[0023] The embodiments of the present invention use Python to write a program to analyze disassembled information. The vulnerable code fragment set is obtained through the following steps, and the code fragments vulnerable to Spectre v1 attack are added to the code fragment set.

[0024] The first step is to initialize an empty collection named vulnerable_code_segments to store code segments in the executable file that are vulnerable to Spectre v1 attacks.

[0025] The second step is to select one unselected assembly instruction from the assembly code in turn.

[0026] The third step is to determine whether the selected instruction is a comparison instruction, that is, to determine whether the instruction format of the selected instruction conforms to "CMP". <reg> <reg>The assembly code format is "(reg represents the register operated on by this instruction), and the next instruction is a jump instruction. This means checking if the format of the next instruction after the selected instruction conforms to "B{cond}". <label>If the format is "(cond indicates the jump condition code, label indicates the jump destination), then the fourth step is executed after assuming that the selected instruction has a conditional branch; otherwise, the second step is executed."

[0027] The fourth step is to traverse the two branches in the conditional branch and identify the load instructions in the branches, i.e., those that conform to "LDR". <reg>,[<reg_adr> Assembly instructions in the format "[" (reg represents the target register operated on by the instruction, and reg_adr represents the register storing the memory address)" are considered vulnerable to Spectre v1 attacks if there are load instructions in one or both branches. This code segment from the comparison instruction to the end of the branch is added to vulnerable_code_segments before proceeding to step five.

[0028] Fifth step: Determine if all assembly instructions have been traversed. If yes, proceed to sixth step; otherwise, proceed to second step.

[0029] Step 6: Obtain a set of vulnerable code snippets.

[0030] Step 3: Determine if the set of code segments vulnerable_code_segments is empty. If it is, the executable file does not contain any code segments vulnerable to Spectre v1 attacks; otherwise, proceed to step 4.

[0031] Step 4: Construct defense instructions based on vulnerable code snippets.

[0032] The first step is to initialize a new set, defense_instructions, which will be used to store information about defense instructions.

[0033] The second step is to select one unselected assembly code segment from the set defense_instructions.

[0034] The third step is to use the general-purpose registers X9 and X10 under the ARM architecture to construct register assignment instructions. Set all bits of register X10 to 1, the assembly instruction is "MOV X10,0xFFFFFFFFFFFFFFFF". Set all bits of register X9 to 0, the assembly instruction is "MOV X9,0x0". The address to which the register assignment instruction "MOV X10,0xFFFFFFFFFFFFFFFF, MOVX9,0x0" is inserted is set to the address of the instruction preceding the comparison instruction.

[0035] The fourth step is to identify the conditional jump code {cond} of the jump instruction in the assembly code segment.

[0036] Step 5: Construct conditional selection instructions based on the jump condition code {cond}. The constructed conditional selection instructions are "CSEL X10,X10,X9,{~cond}" and "CSEL X10,X10,X9,{cond}". The address to which the instruction "CSEL X10,X10,X9,{~cond}" (where ~cond represents the condition code opposite to cond) is inserted is set to the address of the jump instruction "B{cond}". <label>The address of the next instruction after "CSEL X10,X10,X9,{cond}" is set to the address of the instruction after the jump destination "label".

[0037] Step 6: According to the load instruction "LDR" in the code snippet <reg>,[<reg_adr> The construct index check instruction stores the memory address in the register of the load instruction.<reg_adr> Perform an AND operation with general-purpose register X10 and store the result in the register.<reg_adr> In, "AND"<reg_adr><reg_adr> <x10>, will use the index check command "AND<reg_adr><reg_adr> <x10>"The insertion address is set to the address of the instruction preceding the load instruction."

[0038] The seventh step is to add the register assignment instruction, conditional selection instruction, index check instruction, and their insertion address information to the information set of the storage defense instruction.

[0039] Step 5: Insert the defense instructions into the target binary file.

[0040] This embodiment uses the binary static instrumentation tool Retrowrite to insert the required instructions into the corresponding positions in the executable file based on the instruction information in the defense_instructions set, thus completing the instrumentation of the target binary file. < / reg> < / label> < / reg> < / label> < / reg> < / reg>

Claims

1. A method for defending against Spectre v1 attacks using binary instrumentation, characterized in that, This method employs disassembly and binary instrumentation to directly manipulate the target binary file, checking the indexes through inserted instructions. The specific steps of this method are as follows: Step 1: Obtain the disassembly information of the target binary file; Step 2: Analyze the disassembly information, identify code segments vulnerable to Spectre v1 attacks, and add the vulnerable code segments to the code segment set; Step 3: Determine if the code snippet set is empty. If it is, the target binary file does not contain any code snippets vulnerable to Spectre v1 attacks; otherwise, proceed to step 4. Step 4: Construct defense instructions based on the code snippet vulnerable to Spectre v1 attacks. The steps are as follows: The first step is to initialize an information set for storing defense commands; The second step is to select one unselected assembly code segment from the set of code segments vulnerable to Spectre v1 attacks; The third step is to select two general-purpose registers that are not used in the context, construct a register assignment instruction, set all bits of one register R1 to 1 and all bits of the other register R2 to 0, and set the address where the register assignment instruction is inserted to the address of the instruction preceding the comparison instruction. The fourth step is to identify the jump condition codes of the jump instructions in the assembly code segment; Step 5: Construct two conditional selection instructions based on the jump condition codes: For each of these two conditional selection instructions, set the final selection result storage register of the instruction to R1, set the value source register when the condition is met to R1, and set the value source register when the condition is not met to R2. For the first of these two conditional selection instructions, set its condition code to be the opposite of the jump condition code and insert it into the position of the instruction following the jump instruction; For the second instruction of these two conditional selection instructions, set its condition code to be the same as the jump condition code, and insert it into the position of the instruction following the jump destination; The sixth step is to construct the corresponding index check instruction based on the load instruction in the code snippet. For the load instructions in both branches, construct the corresponding index check instruction, that is, perform a bitwise AND operation between the register storing the memory address in the load instruction and the R1 register, and store the result in the register storing the memory address; then set the address where the index check instruction is inserted to the address of the instruction preceding the load instruction. The seventh step is to add the register assignment instruction, conditional selection instruction, index check instruction, and their insertion address information to the information set of the storage defense instruction; Step 5: Use binary instrumentation to insert defensive commands into the target binary file.

2. The method for defending against Spectre v1 attacks using binary instrumentation according to claim 1, characterized in that, The step 1 mentioned above, obtaining the disassembly information of the target binary file, refers to using a binary disassembler to disassemble the binary information in the target binary file and extracting the assembly code from the disassembly information.

3. The method for defending against Spectre v1 attacks using binary instrumentation according to claim 1, characterized in that, The steps for identifying code snippets vulnerable to Spectre v1 attacks described in step 2 are as follows: The first step is to initialize a collection of code snippets that are vulnerable to Spectre v1 attacks; The second step is to select one unselected assembly instruction from the assembly code in sequence; The third step is to determine whether there is a conditional branch in the selected instruction. If so, proceed to the fourth step; otherwise, proceed to the second step. The fourth step is to traverse the two branches of the conditional branch and identify the load instructions in the branches, that is, the instructions used to load data from memory into the register. If there are load instructions in one or both branches, it is determined that the code segment from the comparison instruction to the end of the branch is vulnerable to Spectre v1 attack. After adding this part of the code segment to the code segment set, the fifth step is executed. Fifth step: Determine if all assembly instructions have been traversed. If yes, proceed to sixth step; otherwise, proceed to second step. Step 6: Obtain a set of code snippets vulnerable to Spectre v1 attacks.

4. The method for defending against Spectre v1 attacks using binary instrumentation according to claim 3, characterized in that, The conditional branch refers to an instruction that simultaneously satisfies the following conditions: Condition 1: The selected instruction is a comparison instruction; Condition 2: The next instruction after the selected instruction is a jump instruction.

5. The method for defending against Spectre v1 attacks using binary instrumentation according to claim 1, characterized in that, The binary instrumentation method described in step 5, which inserts defense instructions into the target binary file, refers to using a binary instrumentation tool to insert the required instructions into the corresponding positions in the target binary file based on the instruction information in the information set storing defense instructions, thereby completing the instrumentation of the target binary file.

Images