Control flow integrity acceleration method, apparatus, device and readable storage medium

Abstract

The application relates to a control flow integrity acceleration method, device, equipment and readable storage medium. The method comprises the following steps: identifying all indirect jump instructions needing control flow integrity protection in a program, determining a jump target cache table of each indirect jump instruction; the jump target cache table comprises verified legal jump target addresses; checking a control flow transition in program execution, for a current control flow, when indirect jump of a target indirect jump instruction corresponding to the current control flow occurs, acquiring a current target address corresponding to the target indirect jump instruction; according to a first checking path, checking whether there is an address matched with the current target address in the jump target cache table, and if there is a matched address, executing the current control flow transition. The method can improve the CFI checking efficiency.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and in particular to a method, apparatus, device and readable storage medium for accelerating control flow integrity. Background Technology

[0002] With the rapid development of intelligent connected vehicles, in-vehicle systems are exhibiting significant distributed and heterogeneous characteristics. To ensure the secure execution and processing of critical code and data, Trusted Execution Environments (TEEs) are widely used in various in-vehicle subsystems. Control Flow Integrity (CFI) is one of the key technologies for ensuring the security of code execution within the TEE. It rigorously checks the control flow transitions during program execution to prevent attackers from performing code injection, redirection, and other attacks by tampering with the control flow.

[0003] However, in distributed embedded systems such as intelligent vehicles, the system is usually composed of multiple functional domain nodes, and the control flow frequently transfers across domains. The traditional CFI mechanism has the problem of low CFI checking efficiency, which makes it difficult to meet the strict requirements of vehicle systems for real-time performance and low overhead. Summary of the Invention

[0004] Therefore, it is necessary to provide a control flow integrity acceleration method, apparatus, computer device, computer-readable storage medium, and computer program product that can improve the efficiency of CFI inspection in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for accelerating control flow integrity, including:

[0006] Identify all indirect jump instructions in the program that require control flow integrity protection, and determine the jump target cache table for each indirect jump instruction; the jump target cache table includes verified and valid jump target addresses;

[0007] The control flow transfer during program execution is checked. For the current control flow, when an indirect jump occurs when the execution of the target indirect jump instruction corresponding to the current control flow is performed, the current target address corresponding to the target indirect jump instruction is obtained.

[0008] According to the first check path, check whether there is an address matching the current target address in the jump target cache table. If a matching address exists, then execute the current control flow transfer.

[0009] In one embodiment, the method further includes:

[0010] If no matching address is found, a control flow integrity check is performed on the current control flow according to the second check path. If the control flow integrity check passes, the current control flow transfer is executed, and the current target address is updated to the jump target cache table. The path length of the second check path is greater than the path length of the first check path.

[0011] If the control flow integrity check fails, it is determined to be a current control flow hijacking attack, triggering the security protection mechanism.

[0012] In one embodiment, determining the jump target cache table of the indirect jump instruction includes:

[0013] Determine the inspection type for the control flow transfer;

[0014] If the check type is a local control flow integrity check, then the cache structure of the jump target cache table of each indirect jump instruction is a single-entry CFI target function cache, which includes only the legal target function address determined most recently through the local control flow integrity check;

[0015] If the check type is a control flow integrity check across dynamic shared objects, then the cache structure of the jump target cache table for each of the indirect jump instructions is a multi-entry CFI target function cache;

[0016] Each entry in the multi-entry CFI target function cache includes a first field for characterizing a legitimate target address and a second field for characterizing an identifier of the dynamic shared library to which the legitimate target address belongs.

[0017] In one embodiment, the check type is a local control flow integrity check, and the control flow integrity check of the current control flow according to the second check path includes:

[0018] According to the second check path corresponding to the local control flow integrity check, obtain the type identifier of the target indirect jump instruction;

[0019] If the type identifier is a preset type identifier, then the protected target jump table is queried according to the type identifier to determine the list of legal target addresses allowed by the target indirect jump instruction;

[0020] If the current target address exists in the list of valid target addresses, then the current control flow transfer is executed, and the current target address is updated to the jump target cache table;

[0021] If the current target address does not exist in the list of legitimate target addresses, it is determined to be a current control flow hijacking attack, triggering a security protection mechanism.

[0022] In one embodiment, the indirect jump is a cross-module indirect jump, and the step of checking whether there is an address matching the current target address in the jump target cache table according to the first check path includes:

[0023] According to the first inspection path, check whether there is an address matching the current target address in the jump target cache table, and whether the first identifier of the dynamic shared library corresponding to the address matches the second identifier of the dynamic shared library to which the current target address belongs;

[0024] If a matching address exists and the first identifier and the second identifier match, then the current control flow transfer of the program is executed.

[0025] In one embodiment, the check type is a control flow integrity check across dynamically shared objects, and the control flow integrity check of the current control flow according to the second check path includes:

[0026] If no matching address exists, and / or the first identifier and the second identifier do not match, then the verification function corresponding to the target indirect jump instruction is searched from the global shadow map according to the second check path corresponding to the control flow integrity check across the dynamic shared object.

[0027] The type of the target function of the current control flow is verified according to the verification function. If the type of the target function is a preset function type, the current control flow is transferred, and the current target address and the second identifier are determined as a new entry and updated to the jump target cache table.

[0028] If the type of the target function is not a preset function type, it is determined to be the current control flow hijacking attack, triggering the security protection mechanism.

[0029] Secondly, this application also provides a control flow integrity acceleration device, comprising:

[0030] The caching module is used to identify all indirect jump instructions in the program that require control flow integrity protection, and to determine the jump target cache table for each indirect jump instruction; the jump target cache table includes verified and valid jump target addresses;

[0031] The control flow inspection module is used to inspect the control flow transfer during the execution of the program. For the current control flow, when an indirect jump occurs when the execution of the target indirect jump instruction corresponding to the current control flow is performed, the current target address corresponding to the target indirect jump instruction is obtained.

[0032] According to the first check path, check whether there is an address matching the current target address in the jump target cache table. If a matching address exists, then execute the current control flow transfer.

[0033] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0034] Identify all indirect jump instructions in the program that require control flow integrity protection, and determine the jump target cache table for each indirect jump instruction; the jump target cache table includes verified and valid jump target addresses;

[0035] The control flow transfer during program execution is checked. For the current control flow, when an indirect jump occurs when the execution of the target indirect jump instruction corresponding to the current control flow is performed, the current target address corresponding to the target indirect jump instruction is obtained.

[0036] According to the first check path, check whether there is an address matching the current target address in the jump target cache table. If a matching address exists, then execute the current control flow transfer.

[0037] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0038] Identify all indirect jump instructions in the program that require control flow integrity protection, and determine the jump target cache table for each indirect jump instruction; the jump target cache table includes verified and valid jump target addresses;

[0039] The control flow transfer during program execution is checked. For the current control flow, when an indirect jump occurs when the execution of the target indirect jump instruction corresponding to the current control flow is performed, the current target address corresponding to the target indirect jump instruction is obtained.

[0040] According to the first check path, check whether there is an address matching the current target address in the jump target cache table. If a matching address exists, then execute the current control flow transfer.

[0041] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0042] Identify all indirect jump instructions in the program that require control flow integrity protection, and determine the jump target cache table for each indirect jump instruction; the jump target cache table includes verified and valid jump target addresses;

[0043] The control flow transfer during program execution is checked. For the current control flow, when an indirect jump occurs when the execution of the target indirect jump instruction corresponding to the current control flow is performed, the current target address corresponding to the target indirect jump instruction is obtained.

[0044] According to the first check path, check whether there is an address matching the current target address in the jump target cache table. If a matching address exists, then execute the current control flow transfer.

[0045] The aforementioned control flow integrity acceleration method, apparatus, computer device, computer-readable storage medium, and computer program product, before checking the control flow transfer during program execution, pre-identify all indirect jump instructions in the program that require control flow integrity protection, and determine that each indirect jump instruction includes a jump target cache table containing verified and valid jump target addresses. When checking the control flow transfer during program execution, if an indirect jump occurs, following a first check path, the current target address corresponding to the acquired target indirect jump instruction is verified against the verified and valid jump target addresses cached in the jump target cache table. It is determined whether the current target address exists in the jump target cache table. If the current target address exists in the jump target cache table, the check path can be significantly shortened, effectively reducing CFI check latency, reducing memory access and function call counts, and avoiding repeated checks on similar calls within a recent period. This bypasses the time-consuming conventional check process, achieving a significant performance improvement without sacrificing security, thereby meeting the stringent requirements of vehicle systems for real-time performance and low overhead. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a flowchart illustrating a control flow integrity acceleration method in one embodiment;

[0048] Figure 2 This is an architectural flowchart of a control flow integrity acceleration method in one embodiment;

[0049] Figure 3 This is a schematic diagram illustrating local CFI optimization acceleration in one embodiment;

[0050] Figure 4 This is a schematic diagram illustrating CDSO CFI optimization acceleration in one embodiment;

[0051] Figure 5 This is a structural block diagram of a control flow integrity acceleration device in one embodiment;

[0052] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] In distributed embedded systems such as intelligent vehicles, the system typically consists of multiple functional domain nodes, with frequent cross-domain control flow transfers. Traditional Control Flow Integrity (CFI) mechanisms suffer from long check paths, redundant checks, and high time overhead, making it difficult to meet the stringent real-time and low-overhead requirements of automotive systems. To address the inefficiency of CFI checks, related solutions employ compiler-instrumented CFI and hardware-based control flow protection technologies. LLVM CFI (Low Level Virtual Machine Control Flow Integrity) divides control flow checks into local CFI and Cross Dynamic Shared Object (CDSO) CFI. Local CFI checks and redirects indirect jumps within modules through protected jump tables; CDSO CFI verifies type matching for cross-module indirect calls through global shadow memory and verification functions. Although LLVM CFI performs well on general-purpose computing platforms, its long cross-module check paths and redundant checks on similar calls result in significant performance overhead in resource-constrained, real-time-critical embedded systems, limiting its application in scenarios such as intelligent vehicles. Therefore, a method to accelerate control flow integrity is proposed to address the problem of low efficiency in CFI checks.

[0055] In one embodiment, such as Figure 1 As shown, a method for accelerating control flow integrity is provided. This embodiment illustrates the method applied to a terminal, but it is understood that the method can also be applied to a server, and to a system including both a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0056] Step 102: Identify all indirect jump instructions in the program that require control flow integrity protection, and determine the jump target cache table for each indirect jump instruction; the jump target cache table includes verified and valid jump target addresses.

[0057] In this context, a program, which may be related to intelligent vehicle applications, is an ordered set of instructions. Control flow describes the execution order and direction of these instructions during program execution. Indirect jump instructions, also known as call points, are a special type of instruction in the computer instruction set used to control program execution flow. Indirect jump instructions do not directly specify the target address; instead, they determine the target indirectly through registers, memory addresses, etc. For each indirect jump instruction, a jump target cache table stores recently verified and valid jump target addresses determined by utilizing the locality of reference in the time dimension of program control flow. The capacity of the jump target address table is relatively small.

[0058] It is understandable that caching these verified and valid jump target addresses allows the system to retrieve the verification result directly from the cache when encountering the same indirect jump again, bypassing the time-consuming conventional check process without re-verification. The determination of all indirect jump instructions requiring control flow integrity protection can be achieved using existing methods, which will not be elaborated upon here.

[0059] Step 104: Check the control flow transfer during program execution. For the current control flow, when an indirect jump occurs in the execution of the target indirect jump instruction corresponding to the current control flow, obtain the current target address corresponding to the target indirect jump instruction.

[0060] Among them, obtaining the current target address corresponding to the target indirect jump instruction can be done by reading the actual jump address calculated by the indirect jump instruction from a register or memory.

[0061] Step 106: According to the first check path, check whether there is an address in the jump target cache table that matches the current target address. If a matching address exists, then execute the current control flow transfer.

[0062] The first check path can be a lightweight address matching and verification logic path, which can be used to determine whether the current target address exists in the corresponding jump target cache table.

[0063] For example, when an indirect jump occurs during the execution of the target indirect jump instruction corresponding to the current control flow, the current target address corresponding to the target indirect jump instruction is obtained. The current target address is compared with the address in the jump target cache table. If the current target address exists in the jump target cache table, it indicates that the current target address has been verified as legitimate recently. The system immediately allows this control flow transfer, thereby bypassing all subsequent regular CFI checks and performing subsequent control flow transfer checks.

[0064] The aforementioned control flow integrity acceleration method, before checking the control flow transfer during program execution, pre-identifies all indirect jump instructions in the program that require control flow integrity protection, and determines that each indirect jump instruction includes a jump target cache table containing verified and valid jump target addresses. During the control flow transfer check, when an indirect jump occurs, following the first check path, the current target address corresponding to the acquired target indirect jump instruction is compared with the verified and valid jump target addresses cached in the jump target cache table. It is determined whether the current target address exists in the jump target cache table. If the current target address exists, the check path can be significantly shortened, effectively reducing CFI check latency, decreasing memory access and function call counts, and avoiding repeated checks on similar calls within a recent period. This bypasses the time-consuming conventional check process, achieving a significant performance improvement without sacrificing security, thus meeting the stringent requirements of vehicle systems for real-time performance and low overhead.

[0065] Furthermore, if there is an address matching the current target address in the aforementioned jump target cache table, the time-consuming regular check process can be skipped directly, allowing the current control flow to transfer. However, if there is no matching address, a control flow integrity check needs to be performed according to the second check path.

[0066] In an exemplary embodiment, if no matching address is found, the current control flow is checked for integrity according to the second check path. If the control flow integrity check passes, the current control flow is transferred, and the current target address is updated to the jump target cache table. The path length of the second check path is greater than the path length of the first check path. If the control flow integrity check fails, it is determined to be a current control flow hijacking attack, and the security protection mechanism is triggered.

[0067] The second check path takes longer than the first check path. The second check path can be a routine CFI check performed on the current control flow. Routine CFI checks may include target address validity checks and call context checks. The security protection mechanism can be a system-level response measure initiated when an anomaly in the control flow is detected. It can be used to isolate abnormal execution, log processes, or terminate processes to prevent the spread of attacks.

[0068] For example, if no matching address exists in the jump target cache table according to the first check path, a regular CFI check is performed on the current control flow according to the second check path. If the control flow integrity check passes, the current control flow transfer is executed, and the current target address is updated to the jump target cache table. If the control flow integrity check fails, it is determined to be a current control flow hijacking attack, and a security protection mechanism is triggered.

[0069] For example, in scenarios involving dynamic plugin loading in autonomous driving domain controllers, after an OTA upgrade, when the autonomous driving software loads a new perception algorithm plugin, the system uses a second check path when its callback function is called for the first time. This check path verifies the validity of the callback address based on the plugin signature and loading context. If the verification is successful, the address is dynamically added to the cache table of the corresponding function pointer. Subsequent calls to the plugin can then follow this fast path, avoiding the need for a complete verification on each call. This approach ensures safety while adapting to the dynamic update requirements of the vehicle system.

[0070] In the above embodiments, by combining the first and second inspection paths, it is ensured that while maintaining the strong security guarantee of CFI, the average inspection path can be greatly shortened and the performance overhead can be significantly reduced for common and continuous identical jump scenarios.

[0071] In one exemplary embodiment, such as Figure 2 The diagram shown illustrates the architecture flowchart for accelerating control flow integrity, including the following:

[0072] Identify all indirect jump instructions in the program that require control flow integrity protection, i.e., all call points. Allocate and initialize a jump target cache table for each call point. Check the control flow transfer during program execution. For the current control flow, when an indirect jump occurs when the target indirect jump instruction corresponding to the current control flow is executed, enter the CFI fast check process, i.e., check whether there is an address matching the current target address in the jump target cache table according to the first check path. If a matching address exists, execute the current control flow transfer.

[0073] If no matching address is found, the process enters a slow check and proceeds to the regular CFI check chain. This involves performing a control flow integrity check on the current control flow according to the second check path. If the control flow integrity check passes, the current control flow is transferred, and the current target address is updated in the jump target cache table. If the control flow integrity check fails, the attack is identified as a control flow hijacking attack, triggering the security protection mechanism.

[0074] In the above embodiments, before checking the control flow transfer during program execution, all indirect jump instructions in the program that require control flow integrity protection are pre-identified, and each indirect jump instruction includes a jump target cache table containing verified and valid jump target addresses. When checking the control flow transfer during program execution, when an indirect jump occurs, the current target address corresponding to the obtained target indirect jump instruction is verified against the verified and valid jump target addresses cached in the jump target cache table according to the first check path. It is determined whether the current target address exists in the jump target cache table. If the current target address exists in the jump target cache table, the check path can be significantly shortened, effectively reducing CFI check latency, reducing memory access and function call counts, and avoiding repeated verification of the same type of call in a recent period. This bypasses the time-consuming conventional check process, achieving a significant performance improvement without sacrificing security. If the current target address does not exist in the jump target cache table, it is handed over to the subsequent conventional CFI mechanism for processing. This effectively improves the efficiency of control flow verification while ensuring security. This method meets the strict requirements of vehicle systems for real-time performance and low overhead. Compared to traditional technologies, this approach shortens the cross-module inspection path, avoids repeated verification of the same type of calls, and reduces the number of memory accesses and function calls, thereby achieving forward edge CFI acceleration while ensuring the integrity and security of code execution.

[0075] For different types of control flow checks, the cache structure of the jump target cache table for each indirect jump instruction is different. In an exemplary embodiment, determining the jump target cache table for each indirect jump instruction includes:

[0076] Determine the check type for control flow transfer; if the check type is local control flow integrity check, then the cache structure of the jump target cache table for each indirect jump instruction is a single-entry CFI target function cache, and the single-entry CFI target function cache only includes the address of the legal target function most recently determined by the local control flow integrity check;

[0077] If the check type is a control flow integrity check across dynamic shared objects, then the cache structure of the jump target cache table for each indirect jump instruction is a multi-entry CFI target function cache; wherein, each entry in the multi-entry CFI target function cache includes a first field for characterizing a legitimate target address and a second field for characterizing the identifier of the dynamic shared library to which the legitimate target address belongs.

[0078] The single-entry CFI target function cache stores only one entry, recording the address of the most recently valid target function that passed the regular local CFI check. The reason for using a single entry is that indirect jumps within a module typically exhibit strong temporal locality; that is, the same call point often repeatedly jumps to the same target within a short period. A single entry can cover most cases, and the hardware and storage overhead is minimal. Therefore, the cache update strategy for this single-entry CFI target function cache can be a direct overwrite strategy, whereby when a new valid target address needs to be written, the existing entry in the cache is directly overwritten.

[0079] The number of entries in a multi-entry CFI objective function cache can be, but is not limited to, four. The second field is introduced to handle address space changes caused by dynamic library loading / unloading, ensuring cache consistency. The cache update strategy for a multi-entry CFI objective function cache can be an LRU strategy for entry replacement. To this end, each cache entry is associated with an access bit or timestamp to record its most recent access time. It should be noted that whenever a dynamic library is unloaded, the system clears all cache entries associated with that dynamic library's identifier, automatically invalidating expired address entries and preventing subsequent incorrect checks.

[0080] In the above embodiments, by determining whether the check type is a local control flow integrity check or a cross-dynamic shared object control flow integrity check (CDSO CFI), a single-entry CFI objective function cache or a multi-entry CFI objective function cache is configured respectively. This can reduce unnecessary data maintenance and queries while ensuring CFI security coverage, thereby achieving an overall improvement in CFI check efficiency.

[0081] Based on the above-mentioned control flow integrity acceleration method, two different types of control flow inspection methods are provided, including the following:

[0082] To optimize and accelerate local CFI, all indirect jump instructions requiring control flow integrity protection in the program are identified, and the single-entry CFI target function cache for each indirect jump instruction is determined. Control flow transfers during program execution are checked. For the current control flow, when an indirect jump occurs corresponding to the target indirect jump instruction, the current target address corresponding to the target indirect jump instruction is obtained. Following the first check path, it is checked whether an address matching the current target address exists in the single-entry CFI target function cache. If a matching address exists, the current control flow transfer is executed.

[0083] If no matching address is found, the type identifier of the target indirect jump instruction is obtained according to the second check path corresponding to the local control flow integrity check. If the type identifier is a preset type identifier, the protected target jump table is queried based on the type identifier to determine the list of legal target addresses allowed by the target indirect jump instruction. If the current target address exists in the list of legal target addresses, the current control flow transfer is executed, and the current target address is updated to the single-entry CFI target function cache. If the current target address does not exist in the list of legal target addresses, it is determined to be a current control flow hijacking attack, and the security protection mechanism is triggered.

[0084] The target jump table can include multiple entries, and its structure includes a target function address column (targetfunction) and a branch instruction address column (branch instruction). All entries in the target jump table use hexadecimal address tables. The single-entry CFI target function cache includes only one entry, and its structure also includes a target function address column (target function) and a branch instruction address column (branch instruction). Figure 3 The diagram shown illustrates the local CFI optimization and acceleration. Solid arrows represent control flow transfers, while dashed arrows represent data access.

[0085] For example, local Call Fixing (CFI) typically uses a protected jump table to check and redirect indirect function calls within a module. This is achieved by setting a single-entry CFI target function cache for each call point. This cache stores only one entry, recording the address of the most recently valid target function checked by the regular local CFI. The reason for using a single entry is that indirect jumps within a module often exhibit strong temporal locality, meaning that the same call point often repeatedly jumps to the same target within a short period. A single entry can cover most cases, and the hardware and storage overhead is minimal. A direct overwrite strategy is employed: when a new valid target address needs to be written, the existing entry in the cache is directly overwritten.

[0086] When an indirect jump occurs, the system first compares the current target function address with the address recorded in the cache. If they match (i.e., a cache hit), the system skips all subsequent routine local CFI checks (e.g., type identifier verification, jump table lookup, etc.) and jumps directly to the target address in the cache. If a miss occurs, the system proceeds with the routine local CFI check process: strictly verifying the type identifier of the call point and obtaining a valid target address by querying the protected jump table. If the routine check passes, the system updates the cache entry of the current call point with the new address while executing the jump. If the verification fails, the protection mechanism is triggered.

[0087] In the above embodiments, for the local CFI optimization and acceleration, when an indirect jump occurs, the current target address is compared with the entry in the cache table of the corresponding call point. If the cache is hit, the check path can be significantly shortened, the number of memory accesses and function calls can be reduced, and repeated verification of the same type of call in a recent period can be avoided, thereby effectively reducing the CFI check latency. If the cache is not hit, it is handed over to the subsequent conventional CFI mechanism for processing, thereby effectively improving the efficiency of control flow verification while ensuring security.

[0088] To optimize and accelerate CDSO CFI, all indirect jump instructions requiring control flow integrity protection in the program are identified, and the multi-entry CFI target function cache for each indirect jump instruction is determined. Control flow transfers during program execution are checked. For the current control flow, when an indirect jump occurs corresponding to the target indirect jump instruction, the current target address corresponding to the target indirect jump instruction is obtained. Following the first check path, it is checked whether an address matching the current target address exists in the multi-entry CFI target function cache, and whether the first identifier of the dynamic shared library corresponding to the address matches the second identifier of the dynamic shared library to which the current target address belongs. If a matching address exists and the first and second identifiers match, the current control flow transfer of the program is executed.

[0089] If no matching address exists, and / or the first identifier and the second identifier do not match, then according to the second check path corresponding to the control flow integrity check across dynamic shared objects, the verification function corresponding to the target indirect jump instruction is searched from the global shadow mapping relationship; the type of the target function in the current control flow is verified based on the verification function; if the type of the target function is a preset function type, then the current control flow transfer is executed, and the current target address and the second identifier are determined as a new entry and updated to the multi-entry CFI target function cache; if the type of the target function is not a preset function type, then it is determined to be a current control flow hijacking attack, and the security protection mechanism is triggered.

[0090] The CDSO CFI optimization accelerates cross-module indirect call control flow checks through global shadow memory and module verification functions (e.g., `_cfi_check`). A multi-entry CFI target function can include four entries, each containing a first field representing the cached target address `cached_target_addr` and a second field representing the identifier `dso_id` of the dynamic shared library to which the target address belongs. The global shadow mapping includes the target address to be verified `target addr` and the corresponding verification function address `_cfi_check function addr`. Figure 4The diagram shown illustrates the CDSO CFI optimization and acceleration, where solid arrows represent control flow transfers and dashed arrows represent data access.

[0091] For example, CDSO CFI implements control flow checks for cross-module indirect calls through global shadow memory and module verification functions (such as _cfi_check). A multi-entry CFI target address cache is set up for each call point. This cache contains four entries, each with two key fields: cached_target_addr: the cached valid target address; dso_id: the identifier of the dynamic shared library to which the target address belongs. This field is introduced to handle address space changes caused by dynamic library loading / unloading, ensuring cache consistency. An LRU strategy is used for entry replacement. To this end, each cache entry is associated with an access bit or timestamp to record its most recent access time. Specifically, whenever a dynamic library is unloaded, the system clears all cache entries associated with that dynamic library's dso_id, automatically invalidating expired address entries and avoiding subsequent incorrect judgments.

[0092] When a cross-module indirect jump occurs, the system first checks if the current target address matches the cached_target_addr of any record in the cache, and simultaneously verifies if its corresponding dso_id matches the DSO to which the current target address belongs. If the address matches and the dso_id matches (i.e., a cache hit), the system skips subsequent CDSO CFI slow path checks (including shadow memory lookups, verification function calls, etc.) and directly allows the jump. If a miss occurs (address mismatch or invalid dso_id), the system enters the regular CDSO CFI slow path check process: it searches for the verification function through global shadow mapping and performs type matching verification. If the regular check verification passes, the system updates the target address and its dso_id as a new entry in the cache of the current call point according to the LRU policy while executing the jump. If the verification fails, the protection mechanism is triggered.

[0093] In the above embodiments, for CDSO CFI optimization and acceleration, when an indirect jump occurs, the current target address is compared with the entry in the cache table of the corresponding call point. If the cache hits, the check path is significantly shortened, reducing memory accesses and function calls, avoiding repeated checks of the same type of call in a recent period, thus effectively reducing CFI check latency. If the cache misses, the process is transferred to the subsequent conventional CFI mechanism, thereby effectively improving control flow verification efficiency while ensuring security. In other words, this solves the problems of long cross-module check paths leading to high time overhead, repeated checks of the same type of call leading to high performance overhead, making it difficult to meet the low latency and high real-time requirements of automotive systems; and the high performance overhead caused by multiple memory accesses and function calls involved in the cross-module check process, especially in high-frequency, cross-domain indirect call scenarios, making it difficult to meet the low latency and high real-time requirements of embedded systems such as intelligent vehicles. Compared to traditional technologies, this method shortens the cross-module check path, avoids repeated checks of the same type of call, and reduces memory accesses and function calls, thereby accelerating forward edge CFI while ensuring the integrity and security of code execution.

[0094] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0095] Based on the same inventive concept, this application also provides a control flow integrity acceleration device for implementing the control flow integrity acceleration method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more control flow integrity acceleration device embodiments provided below can be found in the limitations of the control flow integrity acceleration method described above, and will not be repeated here.

[0096] In one exemplary embodiment, such as Figure 5 As shown, a control flow integrity acceleration device is provided, including: a cache module 502 and a control flow inspection module 504, wherein:

[0097] The cache module 502 is used to identify all indirect jump instructions in the program that require control flow integrity protection, and to determine the jump target cache table for each indirect jump instruction; the jump target cache table includes verified and valid jump target addresses;

[0098] The control flow inspection module 504 is used to inspect the control flow transfer during program execution. For the current control flow, when an indirect jump occurs when the target indirect jump instruction corresponding to the current control flow is executed, the current target address corresponding to the target indirect jump instruction is obtained.

[0099] According to the first check path, check if there is an address in the jump target cache table that matches the current target address. If a matching address exists, then execute the current control flow transfer.

[0100] The aforementioned control flow integrity acceleration device, before checking the control flow transfer during program execution, pre-identifies all indirect jump instructions in the program that require control flow integrity protection, and determines that each indirect jump instruction includes a jump target cache table containing verified and valid jump target addresses. When checking the control flow transfer during program execution, if an indirect jump occurs, it verifies the current target address corresponding to the acquired target indirect jump instruction against the verified and valid jump target addresses cached in the jump target cache table according to the first check path. It determines whether the current target address exists in the jump target cache table. If the current target address exists in the jump target cache table, the check path can be significantly shortened, effectively reducing CFI check latency, reducing memory access and function call counts, and avoiding repeated verification of the same type of call in a recent period. This bypasses the time-consuming conventional check process, achieving a significant performance improvement without sacrificing security, thereby meeting the stringent requirements of vehicle systems for real-time performance and low overhead.

[0101] In one embodiment, the control flow inspection module 504 is used to perform a control flow integrity check on the current control flow according to the second inspection path if no matching address is found. If the control flow integrity check passes, the current control flow is transferred, and the current target address is updated to the jump target cache table. The inspection time of the second inspection path is greater than that of the first inspection path. If the control flow integrity check fails, it is determined to be a current control flow hijacking attack, and a security protection mechanism is triggered.

[0102] In an exemplary embodiment, the caching module 502 is used to determine the check type of control flow transfer; if the check type is local control flow integrity check, then the cache structure of the jump target cache table of each indirect jump instruction is a single-entry CFI target function cache, and the single-entry CFI target function cache only includes the address of the legal target function determined most recently through the local control flow integrity check;

[0103] If the check type is a control flow integrity check across dynamic shared objects, then the cache structure of the jump target cache table for each indirect jump instruction is a multi-entry CFI target function cache.

[0104] Each entry in the multi-entry CFI target function cache includes a first field for characterizing a legitimate target address and a second field for characterizing the identifier of the dynamic shared library to which the legitimate target address belongs.

[0105] In one embodiment, the control flow inspection module 504 is used to obtain the type identifier of the target indirect jump instruction according to the second inspection path corresponding to the local control flow integrity inspection;

[0106] If the type identifier is a preset type identifier, then the protected target jump table is queried according to the type identifier to determine the list of legal target addresses allowed by the target indirect jump instruction;

[0107] If the current target address exists in the list of valid target addresses, then execute the current control flow transfer and update the current target address to the jump target cache table;

[0108] If the current target address does not exist in the list of legitimate target addresses, it is determined to be a control flow hijacking attack, triggering the security protection mechanism.

[0109] In one embodiment, the control flow checking module 504 is used to check whether there is an address matching the current target address in the jump target cache table according to the first checking path, and whether the first identifier of the dynamic shared library corresponding to the address matches the second identifier of the dynamic shared library to which the current target address belongs;

[0110] If a matching address exists and the first identifier and the second identifier match, the current control flow of the executor is transferred.

[0111] In one embodiment, the control flow inspection module 504 is used to search for the verification function corresponding to the target indirect jump instruction from the global shadow map according to the second inspection path corresponding to the control flow integrity check across dynamic shared objects if no matching address exists and / or the first identifier and the second identifier do not match.

[0112] The type of the target function of the current control flow is verified according to the verification function. If the type of the target function is the preset function type, the current control flow is transferred, and the current target address and the second identifier are determined as a new entry and updated to the jump target cache table.

[0113] If the type of the target function is not the preset function type, it is determined to be a current control flow hijacking attack, triggering the security protection mechanism.

[0114] Each module in the aforementioned control flow integrity acceleration device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0115] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a control flow integrity acceleration method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0116] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0117] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0118] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0119] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0120] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0121] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0122] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0123] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for accelerating control flow integrity, characterized in that, The method includes: Identify all indirect jump instructions in the program that require control flow integrity protection, and determine the jump target cache table for each indirect jump instruction; the jump target cache table includes verified and valid jump target addresses; The control flow transfer during program execution is checked. For the current control flow, when an indirect jump occurs when the execution of the target indirect jump instruction corresponding to the current control flow is performed, the current target address corresponding to the target indirect jump instruction is obtained. According to the first check path, check whether there is an address matching the current target address in the jump target cache table. If a matching address exists, then execute the current control flow transfer. If no matching address exists, a control flow integrity check is performed on the current control flow according to the second check path. If the control flow integrity check passes, the current control flow transfer is executed, and the current target address is updated to the jump target cache table. The check time of the second check path is greater than the check time of the first check path. If the control flow integrity check fails, it is determined to be a current control flow hijacking attack, triggering the security protection mechanism.

2. The method according to claim 1, characterized in that, The step of determining the jump target cache table for each of the indirect jump instructions includes: Determine the inspection type for the control flow transfer; If the check type is a local control flow integrity check, then the cache structure of the jump target cache table of each indirect jump instruction is a single-entry CFI target function cache, which includes only the legal target function address determined most recently through the local control flow integrity check; If the check type is a control flow integrity check across dynamic shared objects, then the cache structure of the jump target cache table for each of the indirect jump instructions is a multi-entry CFI target function cache; Each entry in the multi-entry CFI target function cache includes a first field for characterizing a legitimate target address and a second field for characterizing an identifier of the dynamic shared library to which the legitimate target address belongs.

3. The method according to claim 2, characterized in that, The inspection type is a local control flow integrity check, and the control flow integrity check performed on the current control flow according to the second inspection path includes: According to the second check path corresponding to the local control flow integrity check, obtain the type identifier of the target indirect jump instruction; If the type identifier is a preset type identifier, then the protected target jump table is queried according to the type identifier to determine the list of legal target addresses allowed by the target indirect jump instruction; If the current target address exists in the list of valid target addresses, then the current control flow transfer is executed, and the current target address is updated to the jump target cache table; If the current target address does not exist in the list of legitimate target addresses, it is determined to be a current control flow hijacking attack, triggering a security protection mechanism.

4. The method according to claim 2, characterized in that, The indirect jump is a cross-module indirect jump. The step of checking the jump target cache table for an address matching the current target address according to the first check path includes: According to the first inspection path, check whether there is an address matching the current target address in the jump target cache table, and whether the first identifier of the dynamic shared library corresponding to the address matches the second identifier of the dynamic shared library to which the current target address belongs; If a matching address exists and the first identifier and the second identifier match, then the current control flow transfer of the program is executed.

5. The method according to claim 4, characterized in that, The inspection type is a control flow integrity check across dynamic shared objects. The step of performing a control flow integrity check on the current control flow according to the second inspection path includes: If no matching address exists, and / or the first identifier and the second identifier do not match, then the verification function corresponding to the target indirect jump instruction is searched from the global shadow map according to the second check path corresponding to the control flow integrity check across the dynamic shared object. The type of the target function of the current control flow is verified according to the verification function. If the type of the target function is a preset function type, the current control flow transfer is executed, and the current target address and the second identifier are determined as a new entry and updated to the jump target cache table. If the type of the target function is not a preset function type, it is determined to be the current control flow hijacking attack, triggering the security protection mechanism.

6. A control flow integrity acceleration device, characterized in that, The device includes: The caching module is used to identify all indirect jump instructions in the program that require control flow integrity protection, and to determine the jump target cache table for each indirect jump instruction; the jump target cache table includes verified and valid jump target addresses; The control flow inspection module is used to inspect the control flow transfer during the execution of the program. For the current control flow, when an indirect jump occurs when the execution of the target indirect jump instruction corresponding to the current control flow is performed, the current target address corresponding to the target indirect jump instruction is obtained. According to the first check path, check whether there is an address matching the current target address in the jump target cache table. If a matching address exists, then execute the current control flow transfer. If no matching address exists, a control flow integrity check is performed on the current control flow according to the second check path. If the control flow integrity check passes, the current control flow transfer is executed, and the current target address is updated to the jump target cache table. The check time of the second check path is greater than the check time of the first check path. If the control flow integrity check fails, it is determined to be a current control flow hijacking attack, triggering the security protection mechanism.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images