Program generation method, program generation device, and program generation program that can execute program generation method

Abstract

To provide a program generation method, a program generation device, and an electronic control device that can suppress overhead during program execution while using a CFI technique.SOLUTION: A program generation method comprises: acquiring a program (S101); extracting a control flow, which is a function in a program code included in the program and a call / return relationship of the function (S102); identifying a first function having a process with a high possibility of control flow tampering (S103); identifying a second function that can reach the first function (S104); determining an application range of CFI (Control Flow Integrity) including the first function and the second function according to the type of control flow (S105); and inserting processing instructions for correctly executing the control flow into the program code within the application range (S106).SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates primarily to programs such as user applications that are composed of multiple modules, and relates to, for example, a program generation method that is resistant to buffer overflow attacks, a program generation device, a program generation program that can execute the program generation method, a program generated by the program generation method, and an electronic control device in which a program generated by the program generation method is installed (hereinafter referred to as the program generation method, etc.). [Background technology]

[0002] A buffer overflow attack is executed by sending a program created by an attacker into the memory of a running program, resulting in the seizure of control of the computer. Specifically, the program sent by the attacker changes, for example, the return address placed on the stack, and control is transferred to that program, thereby seizing control of the computer.

[0003] Various solutions have been proposed against buffer overflow attacks. One of them is Control Flow Integrity (hereinafter referred to as CFI), which allows an attacker to modify the return address, but detects this modification before control of the computer is seized. CFI checks the ID of the called or returned function when calling or returning from one function to another in program code, and executes the call / return process if the ID of the called or returned function is permitted. However, CFI has issues such as the time required for the check process when the program is executed and the difficulty of implementing it on low-performance processors.

[0004] To solve this problem, for example, Patent Document 1 describes a method for suppressing the overhead of program execution using CFI technology, independently of domains, by inserting processing instructions into program code to correctly execute control flows based on the importance of functions. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2019-16338 Summary of the Invention [Problem to be solved by the invention]

[0006] The inventors have found that, from the viewpoint of program structure, there are processes that are easily exploited for tampering, and the scope of such processes varies depending on the type of control flow. These processes do not necessarily correspond to the functions that the program realizes or the importance of the program in the environment in which it is executed.

[0007] Therefore, an object of the present invention is to provide a program generation method and the like that can suppress overhead during program execution while using CFI technology. [Means for solving the problem]

[0008] In order to solve the above problems, the program generation method of the present invention comprises: Obtain the program (S101) Extracting functions in program code included in the program and control flows that are call / return relationships of the functions (S102); Among the functions, a first function having a process that is highly likely to cause tampering with the control flow is identified (S103); Identifying a second function that can reach the first function from the number of proposals (S104); determining a scope of application of CFI (Control Flow Integrity) including the first function and the second function according to the type of the control flow (S105); In the applicable range, a processing instruction for correctly executing the control flow is inserted into the program code (S106). [Effects of the Invention]

[0009] The program generation method of the present invention determines the scope of CFI application according to the type of control flow, thereby reducing overhead during program execution while using CFI technology, making it possible to implement the method on low-performance processors. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is an explanatory diagram illustrating an overview of the overall configuration in each embodiment. [Figure 2] 1 is a flowchart of a program generation method common to the embodiments; [Figure 3] FIG. 1 is a diagram showing the configuration of a program generation device according to a first embodiment. [Figure 4] FIG. 10 is an explanatory diagram illustrating a specific example of first information stored in a storage unit of a program generation device. [Figure 5] FIG. 10 is an explanatory diagram illustrating a specific example of second information stored in a storage unit of a program generating device. [Figure 6] An explanatory diagram for explaining an extraction step of a program generation method or an operation of an extraction unit of a program generation device. [Figure 7] FIG. 10 is an explanatory diagram illustrating a first example of a step of specifying a first function in a program generation method or an operation of a first specifying unit in a program generation device. [Figure 8] FIG. 10 is an explanatory diagram illustrating a second example of the step of specifying a first function in the program generation method or the operation of the first specifying unit in the program generation device. [Figure 9] FIG. 10 is an explanatory diagram illustrating a third example of the step of specifying a first function in the program generation method or the operation of the first specifying unit in the program generation device. [Figure 10] FIG. 10 is an explanatory diagram illustrating a first example of a step of specifying a second function in the program generation method or an operation of a second specifying unit in the program generation device. [Figure 11] FIG. 10 is an explanatory diagram illustrating a second example of the step of specifying a second function in the program generation method or the operation of the second specifying unit in the program generation device. [Figure 12] FIG. 10 is an explanatory diagram illustrating a third example of the step of specifying a second function in the program generation method or the operation of the second specifying unit in the program generation device. [Figure 13] FIG. 10 is an explanatory diagram illustrating a first example of a step of determining the CFI application range of the program generation method or an operation of an application range determination unit of the program generation device. [Figure 14] FIG. 10 is an explanatory diagram illustrating a second example of the step of determining the CFI application range of the program generation method or the operation of the application range determination unit of the program generation device. [Figure 15] FIG. 10 is an explanatory diagram illustrating a third example of the step of determining the CFI application range of the program generation method or the operation of the application range determination unit of the program generation device. [Figure 16] FIG. 10 is an explanatory diagram illustrating a first example of a step of inserting a processing instruction in a program generation method or an operation of an inserting unit of a program generation device. [Figure 17] FIG. 10 is an explanatory diagram illustrating a second example of the step of inserting a processing instruction in the program generation method or the operation of the insertion unit of the program generation device. [Figure 18] FIG. 10 is a diagram showing the configuration of a program generation device according to a second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0012] The present invention refers to the inventions described in the claims or in the Summary of the Invention section, and is not limited to the following embodiments. Furthermore, at least the words in quotation marks refer to the words described in the claims or in the Summary of the Invention section, and are not limited to the following embodiments.

[0013] The configurations and methods recited in the dependent claims are optional configurations and methods in the inventions recited in the independent claims. The configurations and methods of the embodiments corresponding to the configurations and methods recited in the dependent claims, as well as the configurations and methods recited only in the embodiments without being recited in the claims, are optional configurations and methods in the present invention. The configurations and methods recited in the embodiments when the recitation of the claims is broader than the recitation of the embodiments are also optional configurations and methods in the present invention, in the sense that they are examples of the configurations and methods of the present invention. In either case, by being recited in the independent claims, they become essential configurations and methods of the present invention.

[0014] The effects described in the embodiments are effects obtained when the configurations of the embodiments are provided as examples of the present invention, and are not necessarily effects that the present invention has.

[0015] When there are multiple embodiments, the configurations disclosed in each embodiment are not limited to each embodiment, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. Also, configurations disclosed in multiple embodiments may be collected and combined.

[0016] The problem described in the section on the problem to be solved by the invention is not a publicly known problem, but was discovered independently by the inventor, and this fact, together with the configuration and method of the present invention, affirms the inventive step of the invention.

[0017] 1. Overview of the overall configuration of each embodiment FIG. 1 shows an outline of the overall configuration in each embodiment. The program generation devices 100 and 200 of each embodiment are devices that analyze a program and output a modified program in which processing instructions are inserted into the program code. The modified program is installed on, for example, an installation target device, as shown in FIG. 1(a). Therefore, the program generation devices 100 and 200 are basically used when building a program. The installation target device may be used in any way, and the program generation devices 100 and 200 may be installed in any place and may or may not be connected to a network.

[0018] An example of the target device is an electronic control unit for a vehicle, and an electronic control system is constructed using the electronic control unit in which the modified program is installed.

[0019] However, the program generation devices 100, 200 of each embodiment can also be used when installing a modified program into an electronic control device 20 of an already constructed electronic control system. FIG. 1(b) shows an electronic control system mounted on a vehicle. N electronic control devices 20, program generation devices 100, 200, a data communication module (DCM) 30, and the like are connected to a network 10 of the electronic control system. Note that the program generation devices 100, 200 may be connected to the network 10 constantly via a wired or wireless connection, as in program generation device A, or may be connected only when necessary using a connector and cable, etc. Furthermore, instead of being directly connected to the network 10, as in program generation device B, the program generation devices 100, 200 may be indirectly connected to the network 10 constantly or only when necessary using wireless communication via the data communication module 30.

[0020] The program generation method of each embodiment is executed by the program generation device 100, 200 shown in Figure 1(a) or Figure 1(b). For example, a program capable of executing the program generation method of each embodiment is executed. Furthermore, the program generated by this program generation method is installed in a pre-designated electronic control device 20 (corresponding to "electronic control device"). Here, the "electronic control device" may be any electronic control device that constitutes an electronic control system. It may also be a physically independent electronic control device or a virtualized electronic control device realized using virtualization technology. The electronic control device may be mounted on a moving or stationary object.

[0021] 1(b), the program generation devices 100 and 200 may be dedicated devices, or may be realized on a specific electronic control device 20. In this case, the generated program may be installed in this specific electronic control device.

[0022] 2. Common operation of each embodiment (program generation method) 2 is a flowchart showing the flow of a program generation method common to all the embodiments. The configurations of program generation devices 100 and 200 that execute this program generation method will be described in the following first and second embodiments, respectively.

[0023] First, an original program to which the program generation method of this embodiment is applied is obtained (S101). This original program is, for example, a program such as a user application that is configured from multiple modules.

[0024] Next, the "functions" in the "program code" included in this program and the control flows that are "function call / return" relationships are extracted (S102). Details of the steps for extracting the functions and control flows will be described later in the first embodiment with reference to FIG. 6. where: The "program code" may be written in a machine language or assembly language, or may be written in a high-level language. The term "function" includes not only functions in the narrow sense but also what is called a method. A "function call" includes, for example, a forward edge, i.e., a control flow transition caused by a branch instruction that specifies the destination by an address, and an indirect call, i.e., a function call via a function pointer expressed in C / C++ source code. "Function return" includes, for example, a backward edge, i.e., an operation of writing the return address recorded on the stack back to the program counter, and a function return, i.e., a function return expressed in C / C++ source code.

[0025] Next, from among the extracted functions, a first function having a "process with a high possibility of tampering" in the control flow is identified (S103). Details of the step of identifying the first function will be described later in the first embodiment with reference to FIGS. Here, "processes with a high probability of being tampered with" refer to processes that, due to the structure of the program, are likely to be used to tamper with the control flow. For example, these include processes that rewrite the destination of the control flow due to the structure of the program, such as processes that rewrite memory or addresses stored in memory, and processes that refer to memory addresses to transfer control and are key processes that govern the control flow due to the structure of the program. In either case, these processes can be evaluated as changing the control flow if they are rewritten. Note that "processing with a high possibility of tampering" can be rephrased as processing with a high risk of being attacked.

[0026] Examples of processes that are likely to be subject to tampering include the following (A) to (C): (A) is an example of a process that rewrites memory or a memory address, (B) is an example of a process that calls a module outside the scope of CFI, (C) is an example of a process that references a memory address and transfers control, and (D) is an example of a process that obtains its own address. (A) Processing that includes writing external input data to memory. More specifically, calling a specific API from a socket, file, or device (e.g., the read() function), or writing to memory (e.g., the ARM str command). (B) A process that is invoked for a module to which CFI does not or cannot be applied. (C) The process that is the starting point of a Forward Edge (for example, a function call). More specifically, a function that has an indirect call via a function pointer. (D) A function whose address is obtained. More specifically, a process that is allocated to an address stored in memory as a transition destination address. Note that one or more of the above (A) to (C) may be specified as functions having processes that are highly susceptible to tampering. Also, processes other than (A) to (C) that are highly susceptible to tampering may be used.

[0027] In this embodiment, as will be described later, CFI is applied to functions having processes that are highly susceptible to tampering. The reason for applying CFI by focusing on (A) to (C) as processes that are highly susceptible to tampering is as follows. (A) In both the Backward and Forward Edge cases, control flow tampering occurs when values ​​recorded in memory are tampered with, i.e., written. (B) In both the backward and forward edge cases, it is unknown how functions implemented in modules not protected by CFI will be operated. There is a risk that memory may be tampered with by functions implemented in unprotected modules. (C) In the case of Forward Edge, function pointers can be rewritten to any process, and they may exist in a global data area. Therefore, there is a risk that an attacker could rewrite the value indicated by a function pointer before executing an indirect call, which could become the starting point for an attack. A Forward Edge attack occurs when a transition is made to the address of a tampered function pointer (memory). (D) In ​​the case of Forward Edge, there is a risk that rewriting the destination address could become the starting point of an attack.

[0028] If the first function cannot be identified from among the extracted functions, that is, if there is no function having a process that is highly likely to be tampered with, application of this program generation method ends.

[0029] Next, from among the extracted functions, a second function that is "reachable" to the first function identified in step 103 is further identified (S104). Details of the step of identifying the second function will be described later in the first embodiment with reference to FIGS. 10 to 12. Here, "reachable" means that the first function can be executed directly or indirectly using a function call / return.

[0030] Next, the CFI application scope is determined "according" to the "type of control flow" of the function identified in step 102 (S105). The CFI application scope is a scope that includes the first function identified in step 103 and the second function identified in step 104. In the embodiments described below, the CFI application scope will be described in two cases: a scope that includes only the first function and the second function, and a scope that includes a module that includes at least one of the first function and the second function. However, other cases may also be set. For example, the scope may include all of the first function and, of the second functions, functions that are directly adjacent to the first function. In other words, it is not necessary to include all of the second function in the application scope. The step of determining the application scope will be described in detail in the first embodiment using FIGS. 13 to 15 later. where: The "type of control flow" may be any control flow that can be distinguished when applying CFI technology. For example, it may be distinguished by the type of control flow transition, focusing on the transition of the control flow. Examples of this include forward edge and backward edge. "Accordingly," it is sufficient if a direct or indirect correspondence is recognized.

[0031] The Forward Edge protects against attacks using branch instructions such as call instructions or jump instructions, while the Backward Edge protects against attacks using return instructions. In this way, the Forward Edge and the Backward Edge differ in the type of control flow protection, i.e., the target of protection.

[0032] Then, within the scope of CFI application determined in step 105, a processing instruction for correctly executing the control flow is inserted into the program code (S106). This processing instruction is, for example, a check processing instruction that checks the ID of the function to be called / returned when the function is called / returned, or a protection processing instruction that stores the return address in a secure area and executes return processing based on the return address stored in the secure area. The former is an example of a processing instruction that focuses on checking or verifying the control flow, and the latter is an example of a processing instruction that focuses on protecting the control flow.

[0033] If the control flow extracted in step 102 is a backward edge, a processing instruction for protecting the return address is inserted, for example, at the entrance and exit of the function. This will be described in detail later with reference to FIG. 16 in the first embodiment. If the control flow extracted in step 102 is a Forward Edge, a processing instruction for verifying whether it is a normal transition destination is inserted, for example, immediately before a branch instruction. This will be described in detail later with reference to FIG. 17 in the first embodiment.

[0034] In addition, as an optional step, the program including the program code into which the processing instructions have been inserted may be written, i.e., installed, into the "electronic control device" (S107). For example, when steps 101 to 106 of the program generation method are executed in the program generation device 100 or the program generation device 200 shown in Fig. 1(a) or 1(b), the program including the program code into which the processing instructions have been inserted is written into the electronic control device 20 into which the program is to be installed.

[0035] As described above, Fig. 2 not only shows the program generation method executed by the program generation devices 100 and 200, but also shows the processing procedure of a program generation program that can be executed by the program generation devices 100 and 200. The order of these processes is not limited to the order shown in Fig. 2. In other words, the order may be changed as long as there are no constraints, such as a relationship in which a step uses the result of a previous step.

[0036] 3. Embodiment 1 (Program Generation Device 100) An example of the configuration of the program generation device 100 of this embodiment will be described with reference to Fig. 3. The program generation device 100 includes an acquisition unit 101, an extraction unit 102, a first identification unit 103, a second identification unit 104, an application range determination unit 105, an insertion unit 106, an output unit 107, and a storage unit 108.

[0037] In this embodiment, first information regarding processes that are highly susceptible to control flow tampering, and second information defining the control flows to which CFI is to be applied and the range of functions to which CFI is to be applied are stored in advance in storage unit 108 within program generation device 100. In other words, program generation device 100 of this embodiment can generate a program including program code into which processing instructions are automatically inserted, using this information stored in advance.

[0038] An example of the first information will be described with reference to FIG. The first information is (A) to (D) already mentioned. (A) Processing that includes writing external input data to memory (B) Processing to be invoked for modules to which CFI does not or cannot be applied (C) The process that is the starting point of the forward edge (for example, a function call) Let's say.

[0039] FIG. 4(a) shows that functions (A), (B), and (C) are identified as the first function in the control flow of the Forward Edge in a program, and functions (A) and (B) are identified as the first function in the control flow of the Backward Edge. FIG. 4(b) shows that the function (A) is specified as the first function in the control flow of the forward edge and backward edge in the program. FIG. 4(c) shows that the function (B) is specified as the first function in the control flow of the forward edge and backward edge in the program. Figure 4(d) shows that function (C) is identified as the first function in the forward edge control flow of the program. In this case, functions related to the backward edge control flow are not identified as first functions.

[0040] Although (A) to (C) are written in Figure 4, specific commands for executing these processes may be listed. Also, only the first functions may be shown without specifying the control flow. In this case, all listed functions are specified as first functions, regardless of the type of control flow.

[0041] An example of the second information is described in Fig. 5. Fig. 5 defines, as the second information, the relationship between the control flow to which the CFI is applied (referred to as the target control flow in Fig. 5) and the range of functions to which the CFI is applied (referred to as the range of target functions in Fig. 5). Figure 5(a) shows that when the target control flow is a forward edge, the range of the target functions is the functions included in the entire module that includes at least one of the first function or the second function, and when the target control flow is a backward edge, the range of the target functions is the first function and the second function. In Fig. 5(b), when the target control flow is a forward edge, the range of target functions is the functions included in the entire module that includes at least one of the first function and the second function. In the case of Fig. 5(b), the range of target functions is not included for backward edge control flows. FIG. 5(c) shows that when the target control flow is a backward edge, the range of target functions is the first function and, of the second functions, the second function adjacent to the first function.

[0042] In addition to the first information and the second information, the storage unit 108 may also store a processing command to be inserted by the insertion unit 106.

[0043] The acquisition unit 101 acquires an original program from an external device. As described above, the original program is, for example, a program such as a user application that is composed of multiple modules. Examples of modules include executable binary files, static libraries, and dynamic libraries.

[0044] The extraction unit 102 extracts functions from the program code included in the program acquired by the acquisition unit 101 and the control flow, which is the call / return relationship of the functions.

[0045] FIG. 6 is an explanatory diagram illustrating the extraction steps of the program generation method or the operation of the extraction unit 102 of the program generation device 100, and an example of the results of extracting functions and control flows will be described using FIG. 6. In FIG. 6, rectangles indicated by solid and dashed lines indicate modules, and correspond to multiple modules in a user application. The example shown in FIG. 6 includes module 1, which is an executable binary file, and modules 2 to 4, which are shared libraries. Module 4, indicated by a dashed rectangle, is a module to which CFI protection is not or cannot be applied, for example, a shared library whose source code is not available. Each module has at least one function, and the solid circles represent functions 1 to 11. The control flow, which is the call / return relationship of the function, is shown by solid arrows in Figure 6.

[0046] Returning to FIG. 3, the first identification unit 103 identifies, as the first function, a function that corresponds to a process that is highly likely to cause tampering in the control flow, from among the functions extracted by the extraction unit 102. In this embodiment, the first identification unit 103 identifies the first function based on the first information stored in the storage unit 108. When multiple functions are extracted by the extraction unit 102, it is determined for each function whether or not it corresponds to a process that is highly likely to cause tampering, and if so, it is identified as the first function. Details of the step of identifying the first function in the first identification unit 103 will be described using FIGS. 7 to 9.

[0047] In the example shown in FIG. 7, function 5 of module 2 has a process that includes an operation of writing external input data to memory. The first information stored in storage unit 108 is assumed to be that shown in FIG. 4(b). Since function 5 corresponds to the process (A) of the first information stored in storage unit 108, first identification unit 103 identifies function 5 as the first function. In FIG. 7, the function identified as the first function is indicated by a double circle with a solid line. In the following figures, the first function will also be indicated by a double circle with a solid line.

[0048] In the example shown in Figure 8, function 2 of module 1 has a call process to function 10 of module 4, and module 4 is a module to which CFI does not apply. Assume that the first information stored in storage unit 108 is as shown in Figure 4(c). Since function 2 corresponds to the process (B) of the first information stored in storage unit 108, first identification unit 103 identifies function 2 as the first function.

[0049] In the example shown in FIG. 9, function 7 of module 3 has a function pointer used for an indirect call. Assume that the first information stored in storage unit 108 is as shown in FIG. 4(d). Since function 7 corresponds to the processing (C) of the first information stored in storage unit 108, first identification unit 103 identifies function 7 as the first function. Furthermore, function 8 of module 3 has a processing for obtaining an address. Since function 8 corresponds to the processing (C) of the first information stored in storage unit 108, first identification unit 103 identifies function 8 as the first function.

[0050] When the first information stored in the storage unit 108 is that shown in FIG. 4(a), the first identification unit 103 identifies the sum of FIGS. 7 to 9, i.e., Function 2, Function 5, Function 7, and Function 8, as the first function.

[0051] 3, second identification unit 104 identifies, as second functions, all functions that can reach the first function identified by first identification unit 103, from among the functions extracted by extraction unit 102. Details of the step of identifying the second function in second identification unit 104 will be described with reference to FIGS.

[0052] 10, the function that can reach function 5, which is the first function shown in FIG. 7, is function 4, the function that can reach function 4 is function 3, and the function that can reach function 3 is function 1. In this example, the second identification unit 104 identifies functions 1, 3, and 4 that can reach function 5, which is the first function, as second functions. In FIG. 10, the functions identified as second functions are indicated by double circles with dashed lines. In the following figures, second functions are similarly indicated by double circles with dashed lines.

[0053] 11, the function that can reach function 2, which is the first function shown in Fig. 8, is function 1. In this example, the second identification unit 104 identifies function 1 that can reach function 2, which is the first function, as the second function.

[0054] 12, the function that can reach function 7, which is the first function shown in FIG. 9, is function 3, and the function that can reach function 3 is function 1. In this example, the second identification unit 104 identifies functions 1 and 3 that can reach function 7, which is the first function, as second functions. Similarly, functions 1, 3, and 7 are functions that can reach function 8, which is the first function shown in FIG. 9. The second identification unit 104 identifies functions 1, 3, and 7 that can reach function 8, which is the first function, as second functions.

[0055] When the first information stored in the storage unit 108 is that shown in FIG. 4(a), the second identification unit 104 identifies the sum of FIGS. 10 to 12, i.e., Function 1, Function 3, Function 4, and Function 7, as the second function.

[0056] 3 , the application range determination unit 105 determines the application range of CFI (Control Flow Integrity) according to the type of control flow, including the first function identified by the first identification unit 103 and the second function identified by the second identification unit 104. In this embodiment, the application range determination unit 105 determines the application range of CFI based on the second information stored in the storage unit 108 according to the type of control flow extracted by the extraction unit 102.

[0057] In this embodiment, the second information stored in the storage unit 108 is assumed to be that shown in Figure 5(a). In this case, when the target control flow is a forward edge, the range of target functions is the functions included in the entire module that includes at least one of the first function and the second function, and when the target control flow is a backward edge, the range of target functions is the first function and the second function. In other words, in this case, the scope of application of CFI when the control flow type is a backward edge is narrower than the scope of application of CFI when the control flow type is a forward edge. Hereinafter, the steps of determining the application range of CFI in application range determination section 105 will be described in detail with reference to FIGS.

[0058] FIG. 13 is a diagram illustrating steps for determining the scope of CFI application in the examples shown in FIGS. 7 and 10. Function 5, identified as the first function by the first identification unit 103, includes a process that includes a write operation to memory, as described above, and its control flow type corresponds to Backward Edge. In a Backward Edge attack, the return address in the stack frame is rewritten before a return is executed. Therefore, if an attacker attacks function 5, the return addresses that function 5 can tamper with are the called functions 1, 3, and 4, indicated by bold arrows in FIG. 13. Therefore, the scope of application determination unit 105 determines that function 5, identified as the first function by the first identification unit 103, and functions 1, 3, and 4, identified as the second functions by the second identification unit 104, are within the scope of CFI application. In FIGS. 13 to 15, the scope of CFI application is indicated by a rectangle with a double-dashed line.

[0059] One way to apply CFI to any function within a module, rather than to the entire module, is to apply it to the entire module, but include all unmarked functions in a list of exemptions (Clang-CFI blacklist).

[0060] In this way, when the control flow type is Backward Edge, by applying CFI to the first function and the second function, it is possible to achieve secure protection against attacks on the Backward Edge with minimal application of CFI.

[0061] 14 is a diagram illustrating the steps for determining the CFI application scope in the examples shown in FIGS. 8 and 11. Function 2 identified as the first function by first identification unit 103 includes a call to a module to which CFI does not apply, as described above, and its control flow type corresponds to Backward Edge. For the same reasons as in FIG. 13, application scope determination unit 105 determines that function 2 identified as the first function by first identification unit 103 and function 1 identified as the second function by second identification unit 104 are within the CFI application scope.

[0062] FIG. 15 illustrates the steps for determining the scope of CFI application in the examples shown in FIGS. 9 and 12. Functions 7 and 8 identified as first functions by the first identification unit 103 include the process that initiates the function call, as described above, and the control flow type corresponds to Forward Edge. In attacks against Forward Edge, the value indicated by the function pointer is rewritten before the indirect call is executed, and the function pointer may be placed in a global area in the address space. Therefore, it is desirable to determine the scope of CFI application not only for the function being called but also for the entire module including the first and second functions. Therefore, in FIG. 15, the scope of application of CFI determines the entire module 1, including functions 1 and 3 identified as second functions by the second identification unit 104, as the scope of application of CFI. Similarly, the scope of application of CFI determines the entire module 3, including functions 7 and 8 identified as first functions by the first identification unit 103, as the scope of application of CFI. In other words, functions 2 and 9 are also included in the scope of application of CFI.

[0063] In this way, when the control flow type is Forward Edge, by setting the scope of application of CFI to a module that includes at least one of the first function and the second function, it is possible to achieve more secure protection against attacks on the Forward Edge.

[0064] When the second information stored in storage unit 108 is that shown in FIG. 5(a), the scope of application of CFI is actually the sum of FIGS. 13 to 15, i.e., module 1 (functions 1, 2, 3), module 3 (functions 7, 8, 9), and functions 4 and 5.

[0065] Returning to FIG. 3, the insertion unit 106 inserts the processing command stored in the storage unit 108 into the program code within the application range determined by the application range determination unit 105. Specifically, a processing instruction is inserted into a function within the determined scope according to the type of control flow (forward edge or backward edge in this embodiment). The step of inserting a processing instruction will be described below with reference to FIGS. 16 and 17.

[0066] First, Fig. 16 shows an example of inserting a processing instruction when the control flow type is Backward Edge. In the application range determined by the application range determination unit 105, for example, functions 1, 3, 4, and 5 shown in Fig. 13, code for protecting the return address is inserted at the entrance and exit of each of functions 1, 3, 4, and 5. In Fig. 16, processing instruction 1 is inserted at the entrance, and processing instruction 2 is inserted at the exit.

[0067] The code to be inserted varies depending on the verification method, so any code can be used depending on the solution. An example of inserted code is Stack Smarting Protector (SSP), which inserts a marker (canary) into the stack frame and detects an anomaly if the marker is tampered with just before the return. SSP is particularly effective against stack buffer overflow attacks. Another example of inserted code is ShadowCallStack (LLVM / Clang), which detects an attacker's attack by storing (PUSH / POP) the return address in a memory area different from the normal stack area. By using these codes, if a process that is inconsistent with the transition destination is performed, it is possible to detect that it is an invalid transition destination and stop the branch instruction from being executed.

[0068] Next, Fig. 17 shows an example of inserting a processing command when the type of control flow is Forward Edge protection. In the application range determined by the application range determination unit 105, for example, in functions 1, 2, and 3 of module 1 and functions 7, 8, and 9 of module 3 shown in Fig. 15, code for verifying whether the transition destination is normal is inserted immediately before the branch command (blr / br) that each of functions 1, 2, 3, 7, 8, and 9 has.

[0069] The code to be inserted differs depending on the verification method, so any code can be used depending on the solution. In the example shown in Figure 17, processing instruction 3 that verifies the transition destination is inserted immediately before the indirect call. Examples of the processing instruction to be inserted include code that predefines the address of a valid transition destination and checks whether it matches the specified transition destination, or code that predefines the type of function allowed as a transition destination (e.g., a combination of return value type and argument type) and checks whether it matches the type of the specified transition destination function. By using such code, if processing that is inconsistent with the transition destination is performed, it is possible to detect that it is an invalid transition destination and stop the branch instruction from being executed.

[0070] 3, the output unit 107 may output to the outside the program including the program code into which the processing instructions have been inserted by the insertion unit 106. An example of the output destination is the electronic control device 20, and when outputting, the program into which the processing instructions have been inserted is written to the memory or the like of the electronic control device 20.

[0071] As described above, the program generation device of this embodiment determines the scope of CFI application depending on the type of control flow, making it possible to reduce overhead during program execution while using CFI technology. This makes it possible to implement the device on a low-performance processor. Furthermore, according to the program generation device of this embodiment, different CFI application ranges are set depending on whether the control flow is a backward edge or a forward edge, making it possible to set an optimal CFI application range according to the type of control flow.

[0072] 4. Second Embodiment (Program Generation Device 200) In the first embodiment, the first identification unit 103 and the application range determination unit 105 automatically generate a program including program code into which processing instructions have been inserted, based on the first information and the second information stored in the storage unit 108. However, the present invention is also applicable to cases where a program creator inserts processing instructions in appropriate ranges while recognizing functions and control flows, taking into account a wide variety of attacker attack patterns. Therefore, in this embodiment, a program generation device 200 will be described in which a program creator can manually input the first information and the second information in some of the program generation processes.

[0073] An example of the configuration of a program generation device 200 according to this embodiment will be described with reference to FIG. Compared to the configuration of the first embodiment shown in Fig. 3, the program generation device 200 includes an input unit 109 instead of the storage unit 108. Hereinafter, blocks that share functions with the blocks of the first embodiment will be assigned the same numbers as the blocks of the first embodiment, and the description of the first embodiment will be quoted.

[0074] For example, a program creator inputs first information relating to a process that is highly likely to cause tampering of a control flow to the input unit 109. The input first information is input to the first identification unit 103. The first identification unit 103 identifies a first function based on the first information input from the input unit 109.

[0075] Similarly, for example, a program creator inputs second information, which defines the range of control flows to which the CFI is to be applied and the range of functions to which the CFI is to be applied, to the input unit 109. The input second information is input to the application range determination unit 105. The application range determination unit 105 determines the application range of the CFI based on the second information input from the input unit 109, depending on the type of control flow extracted by the extraction unit 102.

[0076] In the above example, it is assumed that the input to input unit 109 is made by the program creator, but the input may be made without the intervention of the program creator. For example, the first information and the second information transmitted from a device other than program generation device 200 may be input.

[0077] 5. Summary The features of the program generation method and the like in each embodiment of the present invention have been described above.

[0078] The block diagrams used to explain the embodiments classify and organize the device configuration by function. The blocks representing each function can be realized by any combination of hardware or software. Furthermore, because they represent functions, the block diagrams can also be understood as disclosures of method inventions and program inventions that realize the methods.

[0079] The order of the functional blocks that can be understood as the processes, flows, and methods described in each embodiment may be changed as long as there are no constraints, such as one step utilizing the results of another step that precedes it.

[0080] The terms first, second, through Nth (N is an integer) used in each embodiment and in the claims are used to distinguish between two or more configurations or methods of the same type, and do not limit the order or superiority or inferiority.

[0081] Furthermore, examples of the program generating device and electronic control device of the present invention include the following. Examples of the component include semiconductor elements, electronic circuits, modules, and microcomputers. An example of a semi-finished product is a system board. Finished product forms include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers. Other examples include devices with communication functions, such as video cameras, still cameras, and car navigation systems.

[0082] Furthermore, necessary functions such as an antenna and a communication interface may be added to the program generating device and the electronic control device.

[0083] In addition, the present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also by a combination of a program for realizing the present invention recorded on a recording medium such as a memory or hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory that can execute the program.

[0084] Programs stored on non-transitory physical recording media (for example, external storage devices (hard disks, USB memory, CDs / BDs, etc.) or internal storage devices (RAM, ROM, etc.)) of dedicated or general-purpose hardware can be provided to the dedicated or general-purpose hardware via a recording medium, or via a communication line from a server without using a recording medium. This allows the latest functions to be provided at all times through program upgrades. [Industrial Applicability]

[0085] The program generating device and the electronic control device of the present invention are not limited to in-vehicle applications. That is, both devices may be in-vehicle, or one of the devices may be in-vehicle, or neither device may be in-vehicle. [Explanation of symbols]

[0086] 10 Network, 20 Electronic control device, 30 Data communication module (DCM), 100, 200 Program generation device, 101 Acquisition unit, 102 Extraction unit, 103 First identification unit, 104 Second identification unit, 105 Application range determination unit, 106 Insertion unit, 107 Output unit, 108 Storage unit, 109 Input unit

Claims

1. Acquire the program (S101), Extracting functions in the program code included in the program and control flows that are call / return relationships of the functions (S102); Among the functions, a first function having a process that is highly likely to cause tampering with the control flow is identified (S103); Identifying a second function that is reachable from the first function among the functions (S104); determining an application range of CFI (Control Flow Integrity) including the first function and the second function according to the type of the control flow (S105); Inserting a processing instruction into the program code for correctly executing the control flow within the applicable range (S106); How to generate a program.

2. If the type is Backward Edge, the first function and the second function are determined as the application range. The program generation method according to claim 1 .

3. If the type is Forward Edge, a module including at least one of the first function and the second function is determined to be the application range.

3. The program generation method according to claim 1.

4. The process that is likely to be tampered with is at least one of i) a process that rewrites a memory or an address on the memory, or ii) a process that calls a module that is outside the scope of application of CFI. The program generation method according to claim 1 .

5. The process with a high possibility of tampering is at least one of i) a process that transfers control by referring to an address in memory, and ii) a process that is allocated to an address stored in memory as a transfer destination. The program generation method according to claim 1 .

6. The processing instruction is a check processing instruction that checks whether the control flow is executed correctly or a protection processing instruction that protects the control flow. The program generation method according to claim 1 .

7. A program including the program code into which the processing instructions have been inserted is installed in the electronic control device (S107). The program generation method according to claim 1 .

8. an acquisition unit (101) that acquires a program; an extraction unit (102) that extracts functions in program code included in the program and control flows that are call / return relationships of the functions; a first identification unit (103) that identifies a first function among the functions, the first function having a process that is highly likely to cause tampering with the control flow; a second identification unit (104) that identifies a second function among the functions that is reachable from the first function; an application range determination unit (105) that determines an application range of a CFI (Control Flow Integrity) including the first function and the second function according to the type of the control flow; an insertion unit (106) that inserts a processing instruction into the program code for correctly executing the control flow within the application range; A program generating device (100, 200).

9. a storage unit (108) for storing first information relating to the process with a high probability of tampering; the first identification unit identifies the first function based on the first information. A program generating device (100) according to claim 8.

10. an input unit (109) for inputting first information relating to the process with a high probability of tampering; the first identification unit identifies the first function based on the first information. A program generating device (200) according to claim 8.

11. a storage unit (108) for storing second information defining a range of a control flow to which the CFI is to be applied and a function to which the CFI is to be applied; the application range determination unit determines the application range based on the second information in accordance with the type of the control flow extracted by the extraction unit. A program generating device (100) according to claim 8.

12. an input unit (109) for inputting second information that defines a control flow to which the CFI is to be applied and a range of functions to which the CFI is to be applied; the application range determination unit determines the application range based on the second information in accordance with the type of the control flow extracted by the extraction unit. A program generating device (200) according to claim 8.

13. A program generating device capable of executing the program generating method according to claim 1, Program generator.

14. A program generated by the program generation method according to claim 1, program.

15. A program generated by the program generation method according to claim 1 is installed. An electronic control unit (20).

Images