基于硬件的代码复用攻击防御机制综述  

A survey of hardware mechanisms against code-reuse attacks

作　　者：张军 侯锐 詹志远 张立新[1] 陈明宇[1] 孟丹[2] Zhang Jun;Hou Rui;Zhan Zhiyuan;Zhang Lixin;Chen Mingyu(Institue of Computing Technology,Chinese Academy of Sciences,Beijing 100190;Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093;University of Chinese Academy of Sciences,Beijing 100049)

机构地区：[1]中国科学院计算技术研究所,北京100190 [2]中国科学院信息工程研究所,北京100093 [3]中国科学院大学,北京100049

出　　处：《高技术通讯》2018年第4期299-312,共14页Chinese High Technology Letters

基　　金：863计划(2015AA0153032);国家重点研发计划(2016YFB1000400);中国科学院前沿科学重点研究项目(QYZDB-SSW-JSC010);国家自然科学基金优秀青年科学基金(61522212)资助项目

摘　　要：给出了代码复用攻击挟持控制流的过程,介绍了代码复用攻击防御机制研究现状。重点论述了基于硬件的防御机制,包括基于硬件的存储安全、代码指针完整性、攻击特征检查、控制流完整性、数据执行保护与隔离技术。讨论了基于硬件的防御机制存在的问题、优势及硬件与软件的关系。展望了基于硬件的代码复用攻击防御机制的发展方向:基于硬件的代码指针完整性有望成为防止控制流挟持攻击的有效手段,针对非控制数据的攻击与防御有可能成为新的研究热点,支持可配置的硬件防御架构是硬件防御的重要趋势之一。The process of control-flow hijacking in code-reuse attacks is described,and the current research status of the code reuse attack defense mechanism is introduced. The main problems of the hardware based defense mechanisms are discussed,including memory safety,code pointer integrity,malware detection based on attacks＇ features,control flow integrity,data execution prevention,and isolation technology. The disadvantages and advantages of hardware defense mechanisms,and the relationship between hardware and software are also analyzed. The future research directions of hardware based security mechanisms are predicted： hardware based code pointer integrity is the most promising technology to prevent all control-flow hijacks; non-control data attacks and their defense will replace code-reuse attacks as a new research topic. The research also points out the necessity of researching configurable hardware based defense architectures.

关 键 词：控制流挟持 存储错误 代码复用攻击 存储安全 代码指针完整性 控制流完整性(CFI) 数据执行保护(DEP) 隔离技术 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]