面向RISC处理器的控制流认证方案

doi:10.19678/j.issn.1000-3428.0053415

摘要/Abstract

摘要： 为使RISC处理器平台具备检测代码重用攻击的能力，将控制流完整性机制与可信计算中的动态远程证明协议相结合，提出面向RISC处理器的硬件辅助控制流认证方案。以开源RISC处理器为基础，扩展与处理器紧耦合的硬件监控单元，同时给出控制流认证方案的证明协议，设计用于跟踪执行路径的硬件编码方法以实现信息压缩。实验结果表明，与C-FLAT方案相比，该方案传输延时小且资源消耗少，能够保证RISC处理器控制流的可信安全。

关键词: 代码重用攻击, 控制流完整性机制, 远程证明, 硬件, 安全处理器

Abstract: To enable RISC processor platforms to detect code reuse attacks,this paper proposes a hardware-assisted control flow authentication scheme for RISC processors,integrating Control Flow Integrity(CFI) mechanism with dynamic remote attestation protocols in trusted computing.Based on open-source RISC processors,the scheme extends hardware monitoring units that are tightly coupled with processors,and gives an attestation protocol of the control flow authentication scheme.It also designs a hardware encoding method for execution path tracking to compress information.Experimental results show that compared with the C-FLAT scheme,the proposed scheme can reduce transmission delay and resource consumption,and can ensure trusted security of control flows in RISC processors.

Key words: code reuse attack, Control Flow Integrity(CFI) mechanism, remote attestation, hardware, security processor

中图分类号:

TP309

李扬, 戴紫彬, 李军伟. 面向RISC处理器的控制流认证方案[J]. 计算机工程, 2019, 45(12): 134-140,146.

LI Yang, DAI Zibin, LI Junwei. Control Flow Authentication Scheme for RISC Processor[J]. Computer Engineering, 2019, 45(12): 134-140,146.

https://www.ecice06.com/CN/Y2019/V45/I12/134

图/表 14

20191214132420

20191214132448

20191214132451

20191214132454

20191214132456

20191214132459

20191214132502

20191214132505

20191214132507

20191214132510

20191214132512

20191214132515

20191214132517

20191214132521

参考文献

[1] LIU Tong,SHI Gang,MENG Dan.A survey of code reuse attack and defense mechanisms[J].Journal of Cyber Security,2016,1(2):15-27.(in Chinese) 柳童,史岗,孟丹.代码重用攻击与防御机制综述[J].信息安全学报,2016,1(2):15-27.
[2] CHECKOWAY S,DAVI L,DMITRIENKO A,et al.Return-oriented programming without returns[C]//Proceedings of the 17th ACM Conference on Computer and Communications Security.New York,USA:ACM Press,2010:559-572.
[3] WU Chenggang,LI Jianjun.Evolution of control flow integrity[J].China Education Network,2016(4):52-55.(in Chinese) 武成岗,李建军.控制流完整性的发展历程[J].中国教育网络,2016(4):52-55.
[4] CLERCQ R D,VERBAUWHEDE I.A survey of hardware-based control flow integrity(CFI)[EB/OL].(2017-07-31)[2018-12-10].https://arxiv.org/ftp/arxiv/papers/1706/1706.07257.pdf.
[5] WERNER M,UNTERLUGGAUER T,SCHAFFENRATH D,et al.Sponge-based control-flow protection for IoT devices[EB/OL].(2018-02-19)[2018-12-10].https://arxiv.org/pdf/1802.06691.pdf.
[6] CHANG D.Sufficient conditions on padding schemes of sponge construction and sponge-based authenticated-encryption scheme[C]//Proceedings of International Conference on Cryptology in India.Berlin,Germany:Springer,2012:545-563.
[7] ZHANG Jiliang,QI Binhang,QIN Zheng,et al.HCIC:hardware-assisted control-flow integrity checking[J].IEEE Internet of Things Journal,2018,6(1):458-471.
[8] CLERCQ R D,KEULENAER R D,COPPENS B,et al.SOFIA:software and control flow integrity architecture[C]//Proceedings of Design,Automation and Test in Europe Conference and Exhibition.Washington D.C.,USA:IEEE Press,2016:1172-1177.
[9] WILKEN K,SHEN J P.Continuous signature monitoring:low-cost concurrent detection of processor control errors[J].IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems,1990,9(6):629-641.
[10] ZHANG Jun,HOU Rui,FAN Junfeng,et al.RAGuard:a hardware based mechanism for backward-edge control-flow integrity[C]//Proceedings of Computing Frontiers Conference.New York,USA:ACM Press,2017:27-34.
[11] ABERA T,ASOKAN N,DAVI L,et al.C-FLAT:control-flow attestation for embedded systems software[C]//Proceedings of 2016 ACM SIGSAC Conference on Computer and Communications Security.New York,USA:ACM Press,2016:743-754.
[12] ARM Ltd.ARM security technology:building a secure system using TrustZone^® technology[EB/OL].[2018-12-10].http://infocenter.arm.com/help/topic/com.arm.doc.prd29-genc-009492c/PRD29-GENC-009492C_trustzone_security_whitepaper.pdf.
[13] LAN Bingchen,LI Yan,SUN Hao,et al.Loop-oriented programming:a new code reuse attack to bypass modern defenses[C]//Proceedings of IEEE Trustcom/BigDataSE/ISPA.Washington D.C.,USA:IEEE Press,2015:190-197.
[14] CHECKOWAY S,DAVI L,DMITRIENKO A,et al.Return-oriented programming without returns[C]//Proceedings of ACM Conference on Computer and Communications Security.New York,USA:ACM Press,2010:559-572.
[15] XING Xiao.Automated construction of Jump-Oriented Programming attacks[D].Nanjing:Nanjing University,2012.(in Chinese)邢骁.自动化构造Jump-Oriented Programming攻击[D].南京:南京大学,2012.
[16] HU Hong,SHINDE S,ADRIAN S,et al.Data-oriented programming:on the expressiveness of non-control data attacks[C]//Proceedings of 2016 IEEE Symposium on Security and Privacy.Washington D.C.,USA:IEEE Press,2016:969-986.
[17] LIU Jiafen,ZHOU Mingtian.Research and taxonomy of replay attacks on security protocol[J].Application Research of Computers,2007,24(3):135-139.(in Chinese)刘家芬,周明天.对安全协议重放攻击的分类研究[J].计算机应用研究,2007,24(3):135-139.
[18] RISC-V Foundation.The free and open RISC instruction set architecture[EB/OL].[2018-12-10].https://riscv.org/specifications.
[19] GitHub Inc.An open-source microcontroller system based on RISC-V[EB/OL].[2018-12-10].https://github.com/pulp-platform/pulpino.

选择文件类型/文献管理软件名称

选择包含的内容