31 results about "Control-flow integrity" patented technology

The application relates to a control flow integrity acceleration method, device, equipment and readable storage medium. The method comprises the following steps: identifying all indirect jump instructions needing control flow integrity protection in a program, determining a jump target cache table of each indirect jump instruction; the jump target cache table comprises verified legal jump target addresses; checking a control flow transition in program execution, for a current control flow, when indirect jump of a target indirect jump instruction corresponding to the current control flow occurs, acquiring a current target address corresponding to the target indirect jump instruction; according to a first checking path, checking whether there is an address matched with the current target address in the jump target cache table, and if there is a matched address, executing the current control flow transition. The method can improve the CFI checking efficiency.

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include receiving a report of a first anomaly based on real-time control flow graph diagram monitoring of an application at a first system and receiving a second report of a second anomaly from a second system. An exploit report may be generated by providing the first report and the second report to a machine learning model trained to output information related to an exploit based on input reports, and subsequently to provide the output information to a cloud-based reporting tool.

A CFI system comprising: at least one protection module, each protection module comprising a respective allowed flow model associated with at least one of a plurality of parts of a process; and at least one process protection manager arranged, in response to a control flow instruction in one of the plurality of parts of the process, to: compare one or more parameters of the control flow instruction with the allowed flow model of the associated protection module; and generate a predetermined signal in response to a result of the comparison indicating that the compared parameters do not satisfy respective parameters of the allowed flow model, wherein each protection module is implemented as a shared object, wherein each process protection manager is implemented as a shared object, and wherein the at least one protection module and process protection manager are loaded into the process.

Disclosed herein are an apparatus and method for injecting control flow integrity security code based on a location. The apparatus identifies an indirect function call in input program code, generates indirect function call location information by analyzing the identified indirect function call, and injects control flow integrity security code into the program code using the generated indirect function call location information.

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining an observation phase for a process or application on a computing device. During the observation phase, CPU telemetry is determined and used to generate a control flow directed graph. After the control flow directed graph is generated, a monitoring phase may be entered where transfers of instruction pointers are monitored based on the control flow directed graph to identify invalid transfers.

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include receiving a report of a first anomaly based on real-time control flow graph diagram monitoring of an application at a first system and receiving a second report of a second anomaly from a second system. An exploit report may be generated by providing the first report and the second report to a machine learning model trained to output information related to an exploit based on input reports, and subsequently to provide the output information to a cloud-based reporting tool.

The invention relates to the technical field of embedded system security, and discloses a CPU card data writing method and device based on deep learning, and the CPU card data writing method based on deep learning comprises the steps: deploying a lightweight neural network model to carry out writing request prediction; establishing a two-stage write-in protection system to identify an abnormal write-in behavior; realizing a control flow integrity protection algorithm to prevent code injection attacks; constructing a data flow monitoring system to guarantee the security of sensitive data; and detecting an abnormal write-in mode by using a behavior portrait algorithm. By integrating various security technologies, the method realizes the balance between the write-in performance and the security protection in a resource-limited CPU card environment. The CPU card supports small program intelligent awakening and write-in demand prediction, prevents multi-dimensional security threats, solves the problems that a traditional CPU card is insufficient in data write-in dynamic adaptive capacity and prone to being attacked, and improves the data processing capacity of the CPU card in high-security scenes of financial payment and identity authentication.

A processor arrangement, comprising a processor under observation, hereinafter PUO, having a processing unit, which is configured to execute an application program code stored in a memory and to provide application output data via an output interface; an observation unit that is connected to the processing unit and configured to monitor execution of the application program code by the processing unit and to provide execution information indicative of an execution pattern associated with the execution of the application program code by the PUO; a cybersecurity-monitoring engine for observing the PUO, which is inaccessible by the PUO and comprises an observation input interface for receiving the execution information and an execution-monitoring unit, which is configured to perform a comparison between the received execution information and pre-generated execution pattern information and to detect an execution anomaly in the retrieved execution information, and to provide a monitoring output signal indicative of the detected execution anomaly; a controllable latency-output-buffer unit, which is also inaccessible by the PUO and comprises a buffer memory and which receives at least a part of the output data of the PUO and the monitoring output signal, and which is configured to temporarily store the received output data in the buffer memory for a pre-determined latency time span, output the temporarily stored output data from the buffer memory at the end of the latency-time span, if no monitoring output signal indicative of the detected execution anomaly has been received, and to block at least a part of the output from the buffer memory as soon as the monitoring output signal indicative of the detected execution anomaly has been received.

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining an observation phase for a process or application on a computing device. During the observation phase, CPU telemetry is determined and used to generate a control flow directed graph. After the control flow directed graph is generated, a monitoring phase may be entered where transfers of instruction pointers are monitored based on the control flow directed graph to identify invalid transfers.

Embodiments of the present application provide a pointer integrity protection method and device, equipment and a storage medium. The method can protect the memory region where the target code pointer is located when the target code pointer is created. When the target code pointer is used to access memory, the memory region where the target code pointer is located is checked for pointer integrity by a hardware checking unit. If tampering with the target code pointer occurs, a PMP exception handling process is triggered. Thus, a solution for architecture-related pointer integrity or control flow integrity is provided, the original hardware design is maximally reused, the hardware automatically checks the runtime pointer integrity, is more secure and effective than a software solution, has lower overhead, and can overcome the problem that hardware solutions in related technologies only support 64-bit systems or have high processing overhead, that is, the number of bits of the computer system is not limited, and both 32-bit and 64-bit systems can be supported.

The invention discloses a control flow integrity protection method, device and equipment based on program control flow characteristics and a storage medium, and relates to the technical field of software security protection. Capturing an execution path of the security sensitive basic block and a target address of indirect control flow transfer; performing a coverage rate-oriented fuzzy test to generate a tuple set containing the information; and during running, acquiring a current control flow state and a transfer target address by utilizing the tracking function, comparing the current control flow state and the transfer target address with the tuple set, and if an exception is found, triggering the processing function to terminate a program so as to realize control flow integrity protection. According to the method, the precision and the security of a CFI mechanism can be improved through the program control flow features, the redundancy of a legal target address set is reduced, and control flow hijacking attacks are effectively defended.

The invention provides a program control flow integrity protection method and system based on an endogenous safety power terminal, and relates to the technical field of network communication and information safety. The method comprises the following steps: monitoring each control transfer instruction in real time by utilizing a binary instrumentation technology in a process of executing a target binary program by the power terminal to obtain a dynamic execution sequence; calculating an instantaneous deviation of each control transfer based on a pre-constructed control flow graph model and a dynamic execution sequence; an accumulated deviation state variable is obtained by accumulating the instantaneous deviation, and an endogenous protection mechanism of the target binary program is triggered based on the accumulated deviation state variable so as to perform control flow integrity protection; the control flow graph model is a graph model with context information constructed based on static analysis of the target binary program. According to the method, the problem that the power terminal CFI cannot realize accurate detection and self-adaptive protection on attacks while keeping relatively low overhead is solved.

A program generation method includes acquiring a program, extracting functions within program code included in the program and a control flow, which is a call / return relationship of the functions, identifying a first function among the functions that has a high tampering likelihood in the control flow, identifying a second function among the functions that is reachable to the first function, determining a scope of application of control flow integrity (CFI) including the first function and the second function according to a type of the control flow, and inserting a processing instruction into the program code to execute the control flow correctly within the scope of application.

Herein is innovative control flow integrity (CFI) based on code generation techniques that instrument data protection for access control of subroutines invoked across module boundaries. This approach is counterintuitive because, even though code is stored separately from data, access control to the data is used to provide access control to the code. In an embodiment, an instrumentation computer generates, at the beginning of a subroutine that is implemented in machine instructions, a prologue that contains: a first instruction of the subroutine that indicates that the first instruction is a target of a control flow branch and a second instruction of the subroutine that verifies that a memory address is accessible. Generated in the machine instructions are instruction(s) that, when executed by a processor, cause the memory address to have limited accessibility. Some code generation may be performed at the start of runtime by a loader or a dynamic linker.

The application discloses a power distribution network terminal integrity verification method and device based on memory access control, and the method steps comprise the following: modifying the HVC exception entry corresponding to the exception vector table in the power distribution network terminal processor to execute the corresponding HVC exception processing program; controlling to start kernel integrity verification or control flow integrity verification by the HVC exception processing program; when starting the kernel integrity verification on the power distribution network terminal system, comparing the hash value calculated when starting the power distribution network terminal system with the hash value calculated when the number of events generated by the kernel layer and the application layer exceeds the preset threshold value to verify the kernel integrity; starting the control flow integrity verification on the power distribution network terminal system, acquiring the legal jump white list of the target function, and matching the source address value of the current jump to verify the control flow integrity. The application has the advantages of simple implementation method, low cost, high safety, stability and reliability and the like.

The present disclosure enables fine-grained forward CFI, for indirect branches, via shadow stack technology in an efficient and secure manner. Methods, data processing devices and computer programs directed to implementing fine-grained forward CFI via shadow stack technology are provided. The present disclosure provides in a first aspect of a computer-implemented method of implementing forward control flow integrity for indirectly called functions, comprising: assigning, at a compile time, a shadow stack target identification, shadow stack target ID, to each of indirectly called functions; placing, at a call site, each shadow stack target ID of the indirectly called functions on a shadow stack; and adding instructions to each of the indirectly called functions at the compile time, wherein the instructions comprise: loading the shadow stack target ID of a respective indirectly called function from the shadow stack; setting an own target identification, target ID, of the respective indirectly called function; comparing the shadow stack target ID and the own target ID and aborting program execution in case of a mismatch.

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining a learned control flow directed graph for a program and subsequently determining valid target destinations for transitions within the program. The instructions of the program may be executed by determining a destination for a transition, performing the transition when the destination is included in the list of valid target destinations, and performing a secondary action when the destination is not included in the list of valid target destinations.

The invention discloses a long method-oriented unit test case generation method, which comprises the following steps of: firstly, identifying a to-be-tested target conforming to the characteristics of a long method in codes, and generating a decomposition and reconstruction suggestion of the long method by utilizing a large language model; secondly, a static analysis rule is designed, triple verification of variable action range, return value consistency and control flow integrity is carried out on the reconstruction scheme, and potential invalid suggestions are eliminated; and finally, constructing a context sensing prompt template for a reconstruction method generated according to the final suggestion so as to generate an initial test case, and after compilation detection and execution verification, implementing multiple rounds of iterative repair on a failed case so as to improve the performability. According to the method, the technical problems of low coverage rate and insufficient passing rate in long-method unit test generation are effectively solved, and the test sufficiency and reliability of a complex code structure are remarkably improved.

The application discloses a control flow integrity protection method and device based on program control flow characteristics, equipment and a storage medium, relates to the technical field of software security protection, and the method comprises the steps of inserting a tracking function into a target program through a compiler to capture the execution path of a security-sensitive basic block and the target address of an indirect control flow transfer; performing coverage-oriented fuzz testing to generate a tuple set containing the information; in runtime, the tracking function is used to acquire the current control flow state and the transfer target address, and the tuple set is compared, and if an exception is found, a processing function is triggered to terminate the program, so that the control flow integrity protection is realized. The application can improve the precision and safety of the CFI mechanism through the program control flow characteristics, reduce the redundancy of the legal target address set, and effectively prevent control flow hijacking attacks.

The invention discloses a control flow integrity protection method and a program product, and the method comprises the steps: in a process that an embedded system executes a target program, identifying a jump type of a current execution instruction in an instruction flow of the target program, and verifying the current execution instruction according to the jump type; under the condition that the current execution instruction successfully passes the check, backing up the current execution instruction and execution data thereof at a hardware backup point in a register in the embedded system chip; under the condition that the current execution instruction does not pass the inspection, obtaining target backup data from a hardware backup point in a register in the embedded system chip, adopting the target backup data to cover a current register value, and re-executing the target program from an instruction position corresponding to the target backup data; therefore, the integrity of the program control flow is guaranteed.

A method includes fetching, at a program counter value, an instruction of a basic block of code; decoding the instruction; updating a checksum value with a checksum of the instruction; and determining whether a tuple of the program counter value and the checksum value is in an approximate membership query filter (AMQ-filter).

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining telemetry representing execution of a process on a computing system and accessing a learned control flow diagram graph for the process. A transfer of an instruction pointer is determined based on the telemetry and a validity of the transfer is determined based on the learned control flow directed graph. If invalid, then an action to terminate the process is determined, otherwise the action may be allowed to execute when valid.

Apparatus and methods related to control flow integrity enforcement. A computer device (110) includes a memory (116). The computer device also includes at least one processor (114) configured to execute a process and manage memory for the process. The processor is further configured to: execute one or more program instructions associated with an application; arrive at a control flow transfer for the one or more program instructions; in response to failure to satisfy a target control flow, expand a call stack associated with the one or more program instructions; identify an offending function call; and rewrite the offending function call. The rewritten function call includes a memory operation bounds check.

The invention relates to a control flow integrity acceleration method and device, equipment and a readable storage medium. The method comprises the steps that all indirect jump instructions needing control flow integrity protection in a program are recognized, and a jump target cache table of each indirect jump instruction is determined; the skipping target cache table comprises a skipping target address which is verified to be legal; checking control flow transfer in program execution, and for the current control flow, when indirect jump occurs when a target indirect jump instruction corresponding to execution of the current control flow is executed, obtaining a current target address corresponding to the target indirect jump instruction; and according to the first check path, checking whether an address matched with the current target address exists in the jump target cache table, and if the matched address exists, executing the current control flow transfer. By adopting the method, the CFI inspection efficiency can be improved.

The invention provides a multi-level return address stack management method and system oriented to control flow integrity, and relates to the technical field of computer technology and data processing. The method comprises the following steps: in response to a received calling instruction, querying a mapping table according to a target security context identifier (SCID) of a current execution thread so as to determine a target GRAS partition from a plurality of graded return address stack (GRAS) partitions; obtaining a return address and a hardware key, and generating a control flow integrity tag CFI Tag according to the return address, the hardware key and the target SCID; and pushing the return address, the CFI Tag and the target SCID into the target GRAS partition by taking the return address, the CFI Tag and the target SCID as atomic entries so as to isolate and manage the return address. According to the method and the device, multi-level isolation of the return address can be realized, the error matching rate of a shadow stack and the RAS under a complex control flow is reduced, advanced control flow attacks such as abnormal path hijacking and cross-privilege level attacks are effectively resisted, and enhanced security isolation is realized.

A processor and methods of detecting a corrupted instruction stream within a processor include executing, by the processor, a program including a plurality of basic blocks, each of which includes a sequence of instructions to be executed by the processor without branching. The method includes implicitly initializing a first cyclic-redundancy-check (CRC) generator based on a first portion of an address of a first instruction in a first basic block and a second CRC generator based on a second portion of the address of the first instruction, generating, by the first CRC generator, a first CRC output according to a first polynomial and, by the second CRC generator, a second CRC output according to a second polynomial, and when an end of the first basic block is reached without encountering an instruction to transfer control from a first function to a second function, selectively deferring a CRC check operation.

Various technologies described herein pertain to enforcing control flow integrity by adding instrumentation when source code is compiled or binary code is rewritten. An indirect call to a control transfer target (e.g., in the source code, in the binary code, etc.) can be identified. Moreover, the instrumentation can be inserted prior to the indirect call. The instrumentation can use a bit from a bitmap maintained by a runtime to verify whether the control transfer target is valid. When an executable image that includes the inserted instrumentation runs, execution can be terminated and / or other appropriate actions can be taken when the control transfer target is determined to be invalid; alternatively, execution can continue when the control transfer target is determined to be valid.

To provide a program generation method, a program generation device, and an electronic control device that can suppress overhead during program execution while using a CFI technique.SOLUTION: A program generation method comprises: acquiring a program (S101); extracting a control flow, which is a function in a program code included in the program and a call / return relationship of the function (S102); identifying a first function having a process with a high possibility of control flow tampering (S103); identifying a second function that can reach the first function (S104); determining an application range of CFI (Control Flow Integrity) including the first function and the second function according to the type of control flow (S105); and inserting processing instructions for correctly executing the control flow into the program code within the application range (S106).SELECTED DRAWING: Figure 2

The application discloses a control flow integrity protection method and related device. The method can determine whether a function is executed from the start position of the function before executing an indirect jump instruction to the function. If yes, it indicates that the function has a small possibility of JOP attack in the execution process, and the function can be continued to execute. If no, it indicates that the function may have JOP attack in the execution process, and the execution of the function is stopped. It can be seen that the method can monitor whether the control flow of the function in the execution process is abnormal, and then reflect whether the JOP attack occurs in the execution process of the function. Moreover, the method does not need to analyze the global call relationship of the function, shortens the compiling time, and does not need to generate a CFI check table, reduces the occupation of the memory space, the method saves the step of table checking and verification, and only needs to determine whether the current program control flow is tampered by judging a mark, so that the verification speed is improved.