基于进程级虚拟机的软件防篡改方法  

Software tamper proofing based on process-level virtual machine

作　　者：汤战勇[1] 郝朝辉[1] 房鼎益[1] 陈晓江[1] 

机构地区：[1]西北大学信息科学与技术学院,陕西西安710127

出　　处：《华中科技大学学报（自然科学版）》2016年第3期65-70,共6页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家科技支撑计划资助项目(2013BAK01B02);国家自然科学基金资助项目(61170218;61272461;61202393);陕西省教育厅产业化培育项目(2013JC07);陕西省自然科学基础研究计划资助项目(2012JQ8049)

摘　　要：分析整理了进程级虚拟机(PVM)保护机制,并提出一种基于进程级虚拟机的软件防篡改方法.该方法将校验和哨兵技术及反调试技术以虚拟指令(VI)的方式融合进来,设计并实现了多种防篡改安全指令(TPI)和反调试安全指令(ADI),并基于哨兵环和随机化的思想植入源程序中.保证被保护程序的内部代码不遭到恶意篡改攻击,且程序在无损环境中执行.最后,通过原型系统VMGuards进行验证,实验结果表明VMGuards的保护粒度与保护后程序的执行性能开销之间能达到很好的平衡.The mechanism of the PVM（process-level virtual machine）protection was discussed,and a novel method of software tamper proofing was suggested,which combined the idea of checksumming guards and anti-debug technique.Several kinds of tamper proofing instructions（TPI）and anti-debug instructions（ADI）were designed,moreover,they were inserted to the program based on the idea of guards-ring and randomization.By this very design,this method detects and responds to the tamper behavior occurred inside of the program during program execution,and it guarantees that the execution outside environment is unharmed.Finally,aproof-of-concept prototype,VMGuards,was implemented to demonstrate our idea.And the experiments show that the protection granularity and performance overhead can achieve a good balance.

关 键 词：进程级虚拟机 防篡改 哨兵 哨兵环 反调试 随机化 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]