CN114547685A - A fine-grained randomization protection method for sensitive data at runtime - Google Patents

Abstract

The invention discloses a method for randomizing and protecting sensitive data during fine-grained operation, which adds a sensitive data confidentiality and integrity cryptology protection expansion instruction on an instruction layer by expanding an instruction set to provide a fine-grained cryptology operation primitive for protecting the confidentiality and the integrity of the sensitive data. The program protected by the extended instruction set provided by the invention can resist software attacks related to various memories; the method can flexibly provide integrity and confidentiality protection according to different input place selection ranges, and flexibly provide time or space memory security protection.

Description

A fine-grained randomization protection method for sensitive data at runtime

technical field

The invention relates to the field of computer application runtime security, in particular to a fine-grained randomization protection method for runtime sensitive data.

Background technique

Memory is an important part of computer architecture. The running code and processing data of any program will be stored in memory. Google engineers have counted the high-risk vulnerabilities in its browsers since 2015, and the results show that about 70% of them are memory-related vulnerabilities.

When the program is running, different types of data will be generated in memory, including sensitive information such as return addresses, state variables, and cryptographic algorithm keys. Direct use of software for protection often brings a large performance overhead. . Although mainstream processor manufacturers provide common cryptographic algorithm encryption engines such as Intel AES-NI, they are not suitable for frequent encryption and decryption operations. The current computer architecture still lacks fine-grained runtime sensitive data protection. primitives.

SUMMARY OF THE INVENTION

In view of the deficiencies of the prior art, the present invention provides a fine-grained randomization protection method for sensitive data at runtime, and the specific technical solutions are as follows:

The invention discloses a fine-grained randomization protection method for sensitive data at runtime, which provides the protection of confidentiality and integrity of sensitive data by adding extended instructions for confidentiality and integrity cryptography protection of sensitive data at the instruction level by extending the instruction set. The fine-grained cryptographic operation primitives, when the operating system kernel or user-mode application process needs to operate on sensitive data, the extended cryptographic operation primitives need to be used to encrypt or decrypt sensitive data. Additional key and handle information, as well as data protection scope selection information, need to be provided.

As a further improvement, when the operating system kernel or user-mode application process needs to store sensitive data in memory, the extended cryptographic operation instructions are used to encrypt the sensitive data to achieve randomization; when the operating system kernel or application process needs to store sensitive data in memory When the process needs to use the sensitive data, the sensitive data is decrypted using the extended cryptographic operation instruction to achieve the de-randomization effect.

As a further improvement, the sensitive data confidentiality and integrity cryptographic protection extension instructions of the present invention include: an encryption instruction for encrypting the entire content, an encryption instruction for encrypting part of the content and filling the integrity check information, The decryption instruction for decrypting the entire content, the decryption instruction for decrypting the entire content and verifying the integrity of part of the content, the decryption instruction for sign-extending after decrypting the entire content and verifying the integrity of the partial content, and the introduction of all instruction types , in addition to the simple encryption and decryption instructions (used to protect the confidentiality of the data), the integrity check information is added on the basis of encryption and decryption to protect the integrity and confidentiality of the data.

As a further improvement, the sensitive data confidentiality and integrity cryptographic protection extension instruction of the present invention receives five inputs of operation content, key, adjustment handle, and the start and end bytes of the selection range, and generates an encrypted and decrypted The result is this one output.

As a further improvement, the keys described in the present invention should be stored in isolated special registers accessible to higher privilege levels including kernel mode, and additional extras should be added when simultaneously protecting the operating system kernel and user mode applications. The random number offset ensures that there is no information leakage in the cross-privileged state; the key is required in the process of encryption and decryption, and it is required that the key should not be leaked.

As a further improvement, the sensitive data confidentiality and integrity cryptography protection extension instruction of the present invention selects a lightweight symmetric cipher algorithm when encrypting or decrypting sensitive content, including: XOR operation, lightweight block cipher, Lightweight adjustable block cipher, the lightweight cipher algorithm is selected to ensure that the performance is not affected.

As a further improvement, the sensitive data described in the present invention includes control flow data such as return addresses and function pointers of operating system kernels and user-mode programs, intermediate results of sensitive operations, related keys, and state variables that affect program branching decisions. Control flow data.

As a further improvement, the adjustment handle of the present invention uses fixed constants or random numbers, timestamps, and variable address information according to different usage scenarios to provide general randomization protection, randomization protection combined with time state, combined with space state. The randomization protection of , through the use of the handle, can defend against substitution attacks.

As a further improvement, the selection information of the data protection range described in the present invention achieves protection with different effects according to the length of the range. When the selection range is smaller than the machine word length, it can provide integrity and confidentiality protection, and when it is equal to the machine word length, at least Confidentiality protection can be provided, which is the turn-on condition of confidentiality protection and integrity protection.

The beneficial effects of the present invention are as follows:

The invention discloses a fine-grained randomization protection method for sensitive data at run time, which can provide fine-grained randomization protection of run-time data for operating system kernels and user-mode application programs. The present invention can efficiently perform cryptographic operations on sensitive data of arbitrary length by introducing basic primitives of cryptographic operations at the instruction level and combining with the flexible protection range selection function in the extended instruction. Since the attacker cannot directly tamper with the randomized data, the program protected by the extended instruction set proposed by the present invention can resist various memory-related software attacks; It provides integrity and confidentiality protection, and flexibly provides memory security protection in time or space according to different adjustment handles, filling the design gap of fine-grained runtime-sensitive data protection primitives in current computer architectures.

Detailed ways

The invention discloses a fine-grained runtime sensitive data randomization protection method, which provides fine-grained cryptographic operation primitives for protecting the confidentiality and integrity of sensitive data at the instruction level by extending the instruction set. When the user-mode application process needs to operate on sensitive data, it needs to use the extended cryptographic operation primitives to encrypt or decrypt the sensitive data. When encrypting or decrypting, it needs to provide additional handle information and the selection of data protection scope. information.

When the operating system kernel or user-mode application process needs to store sensitive data in memory, use the extended cryptographic operation instructions to encrypt the sensitive data to achieve randomization effect; when the operating system kernel or application process needs to use the sensitive data , use the extended cryptographic operation instructions to decrypt the sensitive data to achieve the de-randomization effect.

Sensitive data confidentiality and integrity cryptography operation instruction extensions include: encryption instructions for encrypting the entire content, encryption instructions for encrypting part of the content and filling in the integrity check information, decryption instructions for decrypting the entire content, and encryption instructions for all content. Decryption instruction for decrypting the content and verifying the integrity of part of the content, decryption instruction for sign extension after decrypting the entire content and verifying the integrity of part of the content; Sensitive data confidentiality and integrity cryptography operation instruction extension to receive operation content, encryption The key, the handle, and the start and end bytes of the selection range are five inputs; the key should be stored in an isolated special register accessible by higher privilege levels, including kernel mode, when protecting both the operating system kernel and the user Additional random number offsets should be added when running state applications to ensure that no information is leaked across privileged states.

Confidentiality and Integrity of Sensitive Data Cryptography Operation Instruction Extension Use lightweight symmetric cryptographic algorithms when encrypting or decrypting sensitive content, including but not limited to: XOR operation, lightweight block cipher (PRESENT, LBlock), lightweight Level tunable block ciphers (QARMA, CRAFT, SKINNY, Lilliput). Under the premise of meeting the security requirements, the algorithm with small delay and easy hardware implementation should be preferred.

Sensitive data includes the return address of the operating system kernel and user-mode programs, function pointers and other control flow data, sensitive intermediate results (intermediate variables generated during the operation of the cryptographic library), related keys, and state variables (non-deterministic variables that affect branch decisions. control flow data).

According to different usage scenarios, the handle can use fixed constants or random numbers, timestamps, and variable address information to provide general randomization protection, randomization protection combined with time state, and randomization protection combined with space state; in addition, the protection selection The range can achieve different protection effects according to the range length. When the selected range is smaller than the machine word length, it can provide integrity and confidentiality protection, and when it is equal to the machine word length, it can at least provide confidentiality protection.

The present invention will be described in detail below through specific embodiments, and the purpose and effects of the present invention will become more apparent. It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not intended to limit the present invention.

The above table is a description of the fine-grained runtime sensitive data randomization instruction extension format under the RISC-V architecture. The RISC-V instruction set is used as an example to illustrate how to extend the instruction set to provide fine-grained data randomization protection. Randomization is achieved by encryption, and no distinction is made between randomization (de-randomization) and encryption (decryption) below. The cipher algorithm used for encryption and decryption should be a lightweight symmetric cipher algorithm. Lightweight cryptographic algorithms include but are not limited to: XOR operation, lightweight block ciphers (PRESENT, LBlock), and lightweight adjustable block ciphers (QARMA, CRAFT, SKINNY, Lilliput). Under the premise of meeting the security requirements, the algorithm with small delay and easy hardware implementation should be preferred.

The overall instruction adopts the R type format, which has two source input registers and one destination register. In the extension scheme, the source register No. 1 is used to store the data to be randomized (or de-randomized), the source register No. 2 is used to store the handle used for randomization (or de-randomization), and the destination register is used to store the randomization (or de-randomization). results after randomization). Use the funct3 region to encode the key used in the randomization process. funct7 is used to encode the operation range and mode, where the lowest bit is used to indicate whether the instruction is an encryption operation or a decryption operation, the 1st to 3rd bits are used to select the start byte start byte, and the 4th to 6th bits Used to select the end byte end byte.

For the convenience of description, the assembly format of the specified encryption instruction is: cre[x]k rd,rs[e:s],rt, and the assembly format of the decryption instruction is: crd[x]k(s)rd,rs,rt,[ end:start]. For the encryption operation cre[x]k, the plaintext data in the rs register is intercepted from the start byte to the end byte and padded with 0 on both sides to 64 bits, and then encrypted with the key x and the handle in the rt register, And save the result to the rd register; for the decryption operation crd[x]k(s), use the key x and the handle in the rt register to decrypt the contents of the rs register, and detect the result from startbyte to endbyte after decryption. Whether the content is all 0, the test result is saved in the rd register after passing the test (if the s bit is set, the result is sign-extended). If the test fails, the processor will throw an exception state.

The extended instruction is the basic unit to protect sensitive data in the design. It is responsible for performing cryptographic algorithm operations on the input content. The management logic of key storage and update is handed over to the operating system kernel and trusted firmware. Keys should be stored in isolated special registers accessible to higher privilege levels including kernel mode, and additional random number offsets should be added when protecting both the operating system kernel and user mode applications to ensure that No information leaks.

Depending on the usage scenario, the handle register can use fixed constants or random numbers, timestamps, and variable address information, and can provide general randomization protection, randomization protection combined with time state, and randomization protection combined with space state.

Depending on the protection range, integrity and confidentiality protection can be provided when the selection range is less than 8 bytes, and confidentiality protection can be provided when it is equal to 8 bytes.

Sensitive data includes the return address of the operating system kernel and user-mode applications, function pointers and other control flow data, sensitive intermediate results (intermediate variables generated during the operation of the cryptographic library), related keys, and state variables (which affect branch decisions. non-control flow data).

The above is an example of assembly code that uses sensitive data randomization extension instructions to protect different types of data under the RISC-V architecture under different protection scopes. In the example, it is assumed that a 39-bit virtual address space is used, and the data to be operated is in the a0 register. , and use the address of the variable to be protected in the memory as the handle, the low 32-bit address is in the t1 register, and the high 32-bit address is in the t2 register, and all examples use the key a to operate.

Those of ordinary skill in the art can understand that the above is only a single example of the invention, and is not intended to limit the invention. Although the invention has been described in detail with reference to the foregoing examples, those skilled in the art can still Modifications are made to the technical solutions described in the foregoing examples, or equivalent replacements are made to some of the technical features. All modifications and equivalent replacements made within the spirit and principle of the invention shall be included within the protection scope of the invention.

Claims (9)

1. A method for randomizing and protecting sensitive data in fine-grained runtime is characterized in that a sensitive data confidentiality and integrity cryptology protection extended instruction is added on an instruction level in an instruction set extension mode to provide a fine-grained cryptology operation primitive for protecting the confidentiality and the integrity of the sensitive data, when an operating system kernel or a user mode application program process needs to operate the sensitive data, the extended cryptology operation primitive needs to be used for encrypting or decrypting the sensitive data, extra secret keys and scheduling handle information need to be provided during encryption or decryption, and selection information of a data protection range needs to be provided.

2. The fine-grained runtime sensitive data randomization protection method of claim 1, characterized in that, when an operating system kernel or a user-mode application program process needs to store sensitive data in a memory, the sensitive data is encrypted using an expanded cryptographic operation instruction to achieve a randomization effect; and when the kernel of the operating system or the application program process needs to use the sensitive data, decrypting the sensitive data by using the expanded cryptology operation instruction to realize the de-randomization effect.

3. The fine-grained runtime sensitive data randomization protection method of claim 1, wherein the sensitive data confidentiality and integrity cryptographic protection extension instruction comprises: the system comprises an encryption instruction for encrypting all contents, an encryption instruction for encrypting part of contents and filling integrity check information, a decryption instruction for decrypting all contents and checking the integrity of part of contents, and a decryption instruction for performing symbol expansion after decrypting all contents and checking the integrity of part of contents.

4. The fine-grained run-time sensitive data randomization protection method of claim 1, 2 or 3, wherein the sensitive data confidentiality and integrity cryptographic protection extension instruction receives five inputs of operation content, a key handle, and a start byte and an end byte of a selection range, and generates an output of an encrypted and decrypted result.

5. The fine-grained runtime sensitive data randomization protection method of claim 1, wherein the key should be stored in an isolated special register accessible at a higher privilege level, including kernel-mode, and an additional random number offset should be added when protecting both the operating system kernel and the user-mode application, ensuring that no information is leaked across privilege modes.

6. The fine-grained runtime sensitive data randomization protection method of claim 4, wherein the sensitive data confidentiality and integrity cryptography protection extension instruction selects a lightweight symmetric cryptographic algorithm when encrypting or decrypting sensitive content, and comprises: exclusive or operation, lightweight block cipher, lightweight adjustable block cipher.

7. The fine-grained runtime sensitive data randomization protection method according to claim 1, 2, 3, 5, or 6, wherein the sensitive data includes control flow data such as return addresses, function pointers, etc. of operating system kernels and user mode programs, non-control flow data such as intermediate results of sensitive operations, related keys, state variables affecting program branch decisions, etc.

8. The fine-grained run-time sensitive data randomization protection method of claim 1, wherein the handle uses a fixed constant or random number, a timestamp, variable address information to provide normal randomization protection, randomization protection in combination with temporal state, randomization protection in combination with spatial state, depending on usage scenarios.

9. The fine-grained runtime sensitive data randomization protection method of claim 1, wherein the selection information of the data protection range implements protection with different effects according to different range lengths, and can provide integrity and confidentiality protection when the selection range is smaller than the machine word length, and at least can provide confidentiality protection when the selection range is equal to the machine word length.