上下文敏感的控制流完整性保护的改进方法  

Improved Method of Context-sensitive Control Flow Integrity Protection

作　　者：沈钦涛 张丽[1] 罗磊[1] 马俊[1] 余杰[1] 吴庆波[1] 

机构地区：[1]国防科学技术大学计算机学院,长沙410000

出　　处：《计算机科学》2017年第11期87-90,共4页Computer Science

基　　金：自然科学基金项目(61303191;6130319;61402503)资助

摘　　要：面对控制流劫持攻击的威胁,业界使用控制流完整性保护技术来保障进程的执行安全。传统的控制流完整性验证保护机制依赖于动态二进制改写技术,在分析、实施等过程中难度较大,且有可能带来二进制兼容的问题。通过研究近几年提出的上下文敏感的控制流保护技术PathArmor,分析了其检测进程控制流的时机。然后针对PathArmor只在进程做系统调用时才进行检测的机制,提出了改进的方法。该方法依据内核页错误中断处理机制,通过修改用户页面的保护属性主动触发可执行页面的执行错误;接着,修改页错误中断处理过程,钩挂do_page_fault以处理主动触发的执行错误。用户进程代码和数据的完整性得以保证的同时,得到了更多陷入内核接受检查的机会。在Nginx,bzip2,SQLite等典型应用环境下的实验结果表明,改进的方法能够明显增加系统安全分析的粒度,更好地保护程序的控制流。Facing the threat of control flow hijacking,the industry uses control flow integrity protection technology.It is difficult to achieve the goal for those traditional control-flow integrity protection mechanisms which depend on dynamic binary rewriting technology,and it＇s not easy for analysis and implementation.It may also bring out the problem of binary compatibility.The recently proposed context-sensitive control-flow integrity,PathArmor,only verifies the control flow when tasks are calling system functions.To achieve enhanced protection,an improved method was proposed in this paper.The improved method means to trigger more page fault intentionally by modifying the pages＇ protection flag of the target task,with the kernel＇s mechanism of page fault.Then it hooks the origin system IDT（Interrupt Description Table）and creates new do_page_fault function to handle the generated page fault.With doing some experiments on typical application like nginx,bzip2,SQLite and so on,the result shows that the counts for tasks to be verified increase significantly,and it can get better protection with the improved method.

关 键 词：控制流完整性 执行路径 硬件特性 控制流保护 内核陷入 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]