WO2020057603A1 - Method and apparatus for detecting that return address in stack has been tampered with - Google Patents

Abstract

A method and apparatus for detecting that a return address in a stack has been tampered with. A return address and a hash value are both stored and verified by means of a chain structure. The method and the apparatus have the beneficial effects of high security, low performance loss, low design complexity, etc.

Description

Method and device for detecting tampered return address in stack

Cross-reference to related applications

This application claims the priority of a Chinese patent application filed on September 21, 2018 with the application number 2018111095662 and the invention name "Method and Device for Detecting Tampered Return Address in the Stack", which is incorporated by reference in its entirety. .

Technical field

The present disclosure relates to the field of computer technology, and more particularly, to a method and device for detecting that a return address in a stack has been tampered with.

Background technique

The construction and development of computer technology and the Internet have brought tremendous impetus and impact to the economy, culture, technology and other aspects of the entire society. A large number of information systems such as telecommunications, e-commerce, and financial networks have become the key foundations of the country and government. Facilities, so how to ensure the security of computer systems has become an urgent problem that needs to be solved before us.

The stack overflow vulnerability is an extremely serious system security vulnerability. It writes excessively long data into a limited memory space, destroying the system's memory space, causing the system to run abnormally, freeze, or restart. Through a stack overflow attack, using the address of the attack code to overwrite the function pointer can allow an attacker to gain control of some or all of the system, which is a very threatening security risk.

In the prior art, the main prevention and defense method for stack overflow attacks is to ensure that the return address cannot be maliciously tampered with through the shadow stack and stack protection technology. However, the security of the shadow stack and stack protection is not enough, and the attacker can still find some ways to bypass the above two defense technologies to attack.

Therefore, it is urgent to propose a method and device capable of effectively monitoring that the return address is not tampered with maliciously.

Summary of the Invention

In order to solve the above problems, embodiments of the present disclosure provide a method and device for detecting that a return address in a stack is tampered with, or at least partially solving the above problems.

According to a first aspect of the embodiments of the present disclosure, a method for detecting tampering of a return address in a stack is provided, including:

S1. Obtain a hash value to be verified based on any hash value generation algorithm according to the hash value corresponding to the return address to be verified and the hash value corresponding to the return address to be verified stored in the top frame of the stack;

Wherein, the i-th return address and a random number are stored in the i-th frame in the stack, and any one of the frames from the i + 1th frame to the top frame of the stack is stored in any one of the frames. The corresponding return address and the hash value corresponding to the return address; wherein the hash value corresponding to the return address is based on the return address and the hash value corresponding to the return address stored in the previous frame of any frame in the stack, based on the Said any hash value generation algorithm, the hash value obtained; j> i≥1, where j is the sequence number of the top frame of the stack;

S2. If the hash value to be verified is different from the correct hash value generated in advance, it is confirmed that the return address to be verified is tampered; wherein the correct hash value is based on the untampered return address and the untampered frame top frame of the stack The hash value corresponding to the return address of is obtained based on any one of the hash value generation algorithms.

Further, the processor for executing the method for detecting that the return address in the stack is tampered with further includes a Top register, and the correct hash value stored in the Top register can only be modified by a preset instruction.

Further, the processor for executing the method for detecting that the return address in the stack is tampered with, further includes a hash calculation module for executing any one of the hash value generation algorithms.

Further, any return address in the stack and the hash value corresponding to any of the return addresses are separately stored in different positions in the same stack frame in the stack.

Further, S2 also includes:

If the hash value to be verified is the same as the correct hash value generated in advance, it is confirmed that the return address to be verified has not been tampered with.

According to another aspect of the embodiments of the present disclosure, there is provided a device for detecting that a return address in a stack is tampered, including:

The hash value calculation module is configured to obtain an hash value to be verified based on any hash value generation algorithm according to the hash value corresponding to the return address to be verified and the hash value corresponding to the return address to be verified stored in the top frame of the stack in the stack;

Wherein, the i-th return address and a random number are stored in the i-th frame in the stack, and any one of the frames from the i + 1th frame to the top frame of the stack is stored in any one of the frames. The corresponding return address and the hash value corresponding to the return address; wherein the hash value corresponding to the return address is based on the return address and the hash value corresponding to the return address stored in the previous frame of any frame in the stack, based on the Said any hash value generation algorithm, the hash value obtained; j> i≥1, where j is the sequence number of the top frame of the stack;

A verification module, configured to determine that if the hash value to be verified is different from the pre-generated correct hash value, to confirm that the return address to be verified has been tampered with; the correct hash value is based on the untampered return address of the top frame of the stack in the stack in advance; The hash value corresponding to the return address that has not been tampered with is obtained based on any one of the hash value generation algorithms.

Further, a Top register is further included, the Top register is used to store the correct hash value, and the correct hash value stored in the Top register can only be modified by a preset instruction.

Further, a hash calculation module for executing any one of the hash value generation algorithms is further included.

Further, any return address in the stack and the hash value corresponding to any of the return addresses are separately stored in different positions in the same stack frame in the stack.

Further, the verification module is further configured to determine that if the hash value to be verified is the same as the correct hash value generated in advance, it is confirmed that the return address to be verified has not been tampered with.

The above embodiments of the present disclosure provide a method and a device for detecting a tampered return address in a stack. The present disclosure stores and verifies both the return address and the hash value through a chain structure. The embodiments of the present disclosure have high security and performance. Beneficial effects such as low loss and low design complexity.

BRIEF DESCRIPTION OF THE DRAWINGS

1 is a schematic flowchart of a method for detecting that a return address in a stack is tampered according to an embodiment of the present disclosure;

2 is a schematic diagram of a hash chain structure stack in a method for detecting a tampered return address in a stack according to an embodiment of the present disclosure;

3 is a schematic structural diagram of a hash chain structure stack in a method for detecting that a return address in a stack is tampered according to an embodiment of the present disclosure;

4 is a schematic structural diagram of a stack in the prior art according to an embodiment of the present disclosure;

5 is a schematic diagram illustrating a difference between a call instruction execution and a prior art call instruction in a method for detecting a tampered return address in a stack according to an embodiment of the present disclosure;

6 is a schematic diagram illustrating a difference between execution of a return instruction and a return instruction in the prior art in a method for detecting that a return address in a stack is tampered according to an embodiment of the present disclosure;

7 is a schematic diagram of an uncompressed structure and a compressed storage structure in a method for detecting that a return address in a stack is tampered with, according to an embodiment of the present disclosure;

FIG. 8 is a schematic diagram of an overall structure of a device for detecting a tampered return address in a stack according to an embodiment of the present disclosure.

detailed description

The specific implementation of the present disclosure will be described in further detail below with reference to the drawings and embodiments. The following examples are used to illustrate the present disclosure, but not to limit the scope of the present disclosure.

In the following, the present disclosure first provides a clear explanation of various basic concepts and existing technologies and defects.

Memory Vulnerability: refers to the programmer's mistakes in the design of time or space in the operation of the memory during the software writing process, causing problems that may cause the program to violate the design of the program itself. Attackers can use the program's memory leaks to construct various attacks and perform malicious behaviors.

Buffer overflow: It is the most common memory leak. Copying data that exceeds the length of a buffer into a buffer will cause a buffer overflow, thereby overwriting other data outside the buffer. The stack overflow vulnerability is the most common type of buffer overflow vulnerability, that is, copying an excessively long data into the stack, causing the buffer data on the stack to overflow, thereby overwriting other key data on the stack.

Stack (stack): Also known as stack, it is a linear table with limited operations. The limitation is that insert and delete operations are allowed on only one end of the table. This end is called the top of the stack, and the other end is called the bottom of the stack. Inserting a new element into a stack is also called pushing, stacking, or pushing the stack. It is to place a new element on top of the stack and make it a new top element. Removing an element from a stack is also called popping or Unstacking is to delete the top element of the stack so that its adjacent elements become the new top element.

Stack overflow: It is a kind of buffer overflow. Rewriting of useful memory cells due to buffer overflows often leads to unpredictable consequences. During the running of the program, in order to temporarily access data, some memory space is generally allocated, and these spaces are usually called buffers. If data longer than its own length is written to the buffer so that the buffer cannot accommodate it, it will cause the storage unit outside the buffer to be rewritten. This phenomenon is called buffer overflow. The buffer length is generally related to the type of the buffer variable defined by the user.

Function call: When the computer is compiled or run, a function is used to complete the related command.

Return address: One of the most important data in the data stored in the stack is the function return address. When a function is called, a call instruction (such as a Call instruction) pushes the function return address onto the stack. When the function returns, the return instruction (such as the Return instruction) reads the return address stored in the stack, jumps to the original call function location according to the return address, and continues to execute. The most common method for exploiting a stack overflow vulnerability is to use stack overflow to cover the return address and change the return address to an address set by the attacker. When the function returns, it will jump to the location set by the attacker and execute the code the attacker wants to execute.

ROP attack: A classic technique that uses memory vulnerabilities to construct attacks. Because of the popularity of non-executable bit technologies (DEP or NX), it becomes difficult to directly inject code to perform malicious attacks, while ROP attacks can use the code of the program itself. Using the return address as a connection, an attack is constructed. The principle of the ROP attack is mainly to use code fragments (becoming accessories) that end with return instructions (such as the Return instruction) in the code of the program, and cooperate with the control of the stack space to continuously make the program run these accessories. When the program executes a Return, the CPU fetches an address from the current stack and jumps to the code pointed to by this address to start running. The attacker puts the address of a series of accessories into the stack first. When the CPU runs to Return, it will take the first address and jump to this accessory to start execution. When the execution of the first accessory ends, the ending return instruction (such as The Return instruction) will take the second address and jump to the second accessory to start execution. This loop will construct any malicious behavior.

The key point of attacks such as ROP attacks is tampering with the return address. At present, some existing technologies also prevent these attacks by protecting the return address. The main related work is the shadow stack (stack) and stack protection (stack cookie, also called stack canary).

The shadow stack uses a different implementation to store a backup of the return address in the stack in another area of memory (the memory area is called the shadow stack), and compare the address with the backup before the return address in the stack is used If the addresses are different, it means that the addresses in the stack have been tampered with. To put it simply, the essence of the shadow stack is to store a copy of the return address in another place, so that there is no worry that the attacker will modify the return address in the stack. Intel Corporation proposed CET technology (Control-flow Enforcement Technology) in 2016, which mainly contains two technologies, one of which is the shadow stack.

Stack protection is a practical technique used in many major compilers, such as the gcc compiler. The return address is stored on the stack, and a canary is inserted before the return address (canary, that is, the guard value, is a random number). If an attacker wants to use a stack overflow to overwrite the return address, it will necessarily overwrite the protection value. The protection value is a random number and cannot be known by the attacker, so the protection value will also change. When the function returns, check if the protection value has been changed, and you can find out whether the return address has been tampered with maliciously.

Then, the aforementioned prior art method has the following technical defects.

There are several problems with the shadow stack approach:

1. The backup in the shadow stack must be absolutely secure, which is very difficult in actual implementation. For example, Intel's CET technology proposes that a new page attribute is used to mark individual pages as "shadow stack" pages for protection. However, this page property can be changed, which has precedent in previous examples of bypassing DEP in actual attacks. Therefore, it is insufficient to protect the security in a certain area on the memory. If an attacker can modify the shadow stack and the return address on the stack at the same time, the protection of the shadow stack can be broken.

2. The backup in the shadow stack needs a separate page to store, so it will increase memory access, reduce performance, and increase memory overhead.

3. The implementation of the shadow stack is more complicated. If the security of the shadow stack itself is not considered, the design can be simpler, but the security is not enough. If you consider the security of the shadow stack itself, you need to add additional protection mechanisms to the memory where the shadow stack is located, which greatly increases the design complexity and leads to low practicality.

There are several problems with stack protection methods:

1. The stack protection needs to insert a protection value (random number) before the return address. Once the attacker knows the protection value, he can easily overwrite the return address and protection value, while ensuring that the protection value does not change.

2. Stack protection can only prevent stack overflow from overwriting the return address, but not other attacks. For example, use any address to write and directly modify the return address point-to-point.

In short, the shadow stack and stack protection are not secure enough, and the attacker can still find some ways to bypass it.

A specific embodiment of the present disclosure provides a method for detecting that a return address in a stack has been tampered with.

As shown in FIG. 1, a schematic flowchart of a method for detecting that a return address in a stack is tampered according to an embodiment of the present disclosure includes:

S1. Obtain a hash value to be verified based on any hash value generation algorithm according to the hash value corresponding to the return address to be verified and the hash value corresponding to the return address to be verified stored in the top frame of the stack;

Wherein, the i-th return address and a random number are stored in the i-th frame in the stack, and any one of the frames from the i + 1th frame to the top frame of the stack is stored in any one of the frames. The corresponding return address and the hash value corresponding to the return address; wherein the hash value corresponding to the return address is based on the return address and the hash value corresponding to the return address stored in the previous frame of any frame in the stack, based on the Said any hash value generation algorithm, the hash value obtained; j> i≥1, where j is the sequence number of the top frame of the stack;

S2. If the hash value to be verified is different from the correct hash value generated in advance, it is confirmed that the return address to be verified is tampered; wherein the correct hash value is based on the untampered return address and the untampered of the top frame of the stack in the stack in advance. The hash value corresponding to the return address of is obtained based on any one of the hash value generation algorithms.

Specifically, the embodiments of the present disclosure utilize a main hash algorithm to protect the return address. The hash algorithm has some unique advantages. For example, it is difficult to reverse the input of the hash through the output of the hash. It is also difficult for an attacker to control the input to output a desired output value. The present disclosure proposes to maintain both the return address and the hash value through a chain structure. As shown in Figure 2, the latest hash value is calculated based on the latest (stored in the top frame of the stack) return address and the previous (stored in the top frame of the stack) hash value. The hash value in the top frame of the stack is calculated based on the return address and hash value stored in the previous frame. Therefore, the return address and hash value in each frame in the stack form a chain.

FIG. 3 illustrates a stack structure according to an embodiment of the present disclosure. Compared with the normal stack structure of FIG. 4, the stack structure of the embodiment of the present disclosure stores the return address and its corresponding hash value in the same frame. It is worth noting that the hash value and return address stored in the same frame are staggered, that is, the first return address (Address 1) and a random number (RAND) are stored together; the first hash value (Hash 1) Calculated according to the first return address and a random number, stored with the second return address; and so on, the second hash value exists with the third return address; and the latest hash value (Hash 3) is stored in A special register (called the Top register). Among them, the random number RAND is the initial value of the Top register.

Further, the specific implementation process of the call instruction and the return instruction is described by taking the call and return instructions as examples in the embodiments of the present disclosure.

First introduce the execution process of the normal call instruction and the return instruction, and then introduce the execution process of the call instruction and the return instruction in the present disclosure. FIG. 5 shows a special process different from the normal execution process of the call instruction in the present disclosure, and FIG. 6 shows this The return instruction is a special procedure that is different from the normal execution procedure.

The normal call instruction (Call instruction) is executed: 1) the return address is pushed onto the stack, and 2) the target address of the call instruction (Call instruction) is stored in the PC (equivalent to jumping to the target address for execution).

The normal return instruction (return instruction) is executed: 1) the return address is popped from the stack, and 2) the return address is stored in the PC (equivalent to jumping to the return address for execution).

The calling instruction (Call instruction) of the present disclosure is executed: 1) pushing the hash value in the Top register together with the return address (the untampered return address of the top frame of the stack), 2) pushing the pushed data (that is, the first Step hash value and return address) as the input of the hash function, calculate the new hash value (correct hash value), store the new hash value in the Top register, 3) the target address of the call instruction (Call instruction) Save to PC.

The return instruction (return instruction) of the embodiment of the present disclosure is executed: 1) The hash value and the return address (the return address to be verified) are popped from the top frame of the stack, and the hash value and the return address (the return address to be verified) of the stack are calculated. The hash value (the hash value to be verified), 2) comparing the calculated hash value (the hash value to be verified) with the hash value (the correct hash value) stored in the Top register. If the two are not equal, it means that an abnormality has occurred, the alarm should be issued and the program running should be interrupted. If they are equal, it is normal and execution continues. 3) Store the popped hash value in the Top register (the popped hash value, not the hash value to be verified). 4) When the hash value to be verified is equal to the correct hash value, the return address to be verified is stored in the PC; when the hash value to be verified is not equal to the correct hash value, an exception occurs and the program is interrupted.

In another specific embodiment of the present disclosure, a method for detecting a tampered return address in a stack is provided. A processor for executing the method for detecting a tampered return address in a stack further includes a Top register, where: The Top register is used to store the correct hash value, and the correct hash value stored in the Top register can only be modified by a preset instruction.

In another specific embodiment of the present disclosure, a method for detecting tampering with a return address in a stack is provided. The processor for executing the method for detecting tampering with a return address in a stack further includes a Salt register for: A challenge value is stored as another input of the hash function, and the challenge value can only be modified by a preset instruction.

Among them, in order to implement the above specific embodiment, in the actual development, it is necessary to add at least one register, including at least a Top register, and possibly a Salt register, to a processor executing a method for detecting a return address in a stack in the embodiment of the present disclosure. The Top register is used to store the latest hash value. The challenge value stored in the Salt register is another input to the hash function. It is generally a random value or other types of values, which further increases the difficulty of guessing and cracking the hash function. .

At the beginning of a process, the Top register and the Salt register are set to random numbers or non-random numbers generated by other methods, among which random numbers are the most preferred. The hardware should ensure that the correct hash value stored in the Top register and the challenge value stored in the Salt register can only be modified by preset instructions, otherwise the disclosure will lose its defensive effect. It is easy to protect several special registers from being modified by an attacker. Even if the attacker reads the Salt register, this disclosure can still guarantee that the attacker cannot easily tamper with the return address, and still has high security.

The hardware does not need to ensure that the Top register is not read by an attacker. Whether an attacker can read the Top register has no impact on the security of this disclosure.

In another specific embodiment of the present disclosure, a method for detecting that a return address in a stack is tampered with is provided. The challenge value stored in the Salt register and the correct hash value stored in the Top register cannot pass the pre-defined privilege instruction. Specify read. Among them, the hardware should try to ensure that the Salt register is not read by an attacker, which is also relatively easy to implement technically. In addition, even if the attacker reads the Salt register, the disclosure can still guarantee that the attacker cannot easily tamper with the return address, and still has high security.

In another specific embodiment of the present disclosure, a method for detecting tampering with a return address in a stack is provided. The processor for executing the method for detecting tampering with a return address in a stack further includes a method for executing the method. A hash calculation module for any hash value generation algorithm.

The embodiment of the present disclosure does not have too many requirements on the selection of the hash algorithm. Any hash algorithm may be used, and even other encryption and decryption algorithms may be used.

In another specific embodiment of the present disclosure, a method for detecting that a return address in a stack is tampered with is provided. Any return address in the stack and a hash value corresponding to any of the return addresses are separately stored in all locations. It is described in different positions in the same stack frame in the stack. As shown in FIG. 7, in a specific embodiment of the present disclosure, storing a return address and a hash value at different locations for storage is called an uncompressed structure (or a normal structure).

In another specific embodiment of the present disclosure, a method for detecting that a return address in a stack is tampered with is provided. In a 64-bit operating system, any return address in the stack is normally stored in any position in the stack. The hash value corresponding to any one of the return addresses is stored in a high-order space of any one of the positions.

Specifically, it is found that in a 64-bit system, the return address occupies 64 bits, but the actual return address is actually not so long, generally only more than 40 bits. Therefore, the upper 64 bits are free. Therefore, it is possible to save the hash value to the upper bit of 64 bits. This storage structure is called a compressed structure, as shown in Figure 7. The difference between the compressed structure and the original stack structure is only the value of the return address in the stack (and the layout is completely consistent). This brings a major beneficial effect is that it can be compatible with the previous binary, because most programs follow the following rules: (1) the call instruction and the return instruction match; (2) only the call instruction and the return instruction use the return address , Other instructions are not used; (3) other values in the stack are determined based on the offset. If the layout is maintained, the data in other stacks can be used directly. Correspondingly, in order to achieve the above-mentioned beneficial effects, the supporting operations are as follows: the operations required to achieve this goal are: replacing all (or matching parts) call instructions and return instructions in the original program with the Invoke and return instructions, and use compressed structures. At the same time, the use of a compressed structure also has the beneficial effect of saving space compared to an uncompressed structure.

Of course, in addition to the return address, some data may be stored in the upper 64 bits, such as the ASLR random number. However, in any case, these data have not used up all the 64-bit space. Often, more than 20 bits of free space can be left, which is sufficient for storing hash values.

In another specific embodiment of the present disclosure, a method for detecting that a return address in a stack is tampered is provided. After S2, the method further includes: interrupting a program running and storing a hash value corresponding to the return address to be verified in a Top register.

If it is confirmed that the to-be-returned return address has been tampered with, it indicates that an abnormality has occurred, and an alarm should be issued and the program running interrupted.

In another specific embodiment of the present disclosure, a method for detecting that a return address in a stack is tampered with is provided. If the hash value to be verified is the same as a pre-generated correct hash value, it is confirmed that the return address to be verified has not been tampered with.

In another specific embodiment of the present disclosure, a method for detecting a tampered return address in a stack is provided. A processor for executing the method for detecting a tampered return address in a stack further includes a counter for When the stack executes a call instruction (such as a Call instruction), the count increases by one, and when the stack executes a return instruction (such as a return instruction), the count decreases by one; when the process ends, if the counter count is not 0 or Top If the correct hash value in the register is modified, an error is reported.

The specific embodiment of the present disclosure considers that it is assumed that the attacker's ability is extremely strong and has unlimited computing power. Then, the attacker may forcibly tamper with the return address through hash collision and construct the same hash value. For this extreme case, the embodiments of the present disclosure still have a way to discover that the attacker cannot control the value of the Top register and cannot guarantee that the value of the Top register after the attack is the same as the initial value, leaving traces of the attack. .

In the embodiment of the present disclosure, a Number counter is further added to record the execution times of the call instruction and the return instruction to ensure that the number of the call instruction and the return instruction is the same. At the beginning of the process, the Number counter is initialized to 0; a call instruction is executed to increment the count number by one; a return instruction is executed to decrement the count number by one; if the process ends, the number should be 0, otherwise an error is reported and the program is terminated.

Similarly, when the process ends and exits, the value of the Top register should be equal to the initial value of the Top register at the beginning of the process, otherwise it is considered that an attack has occurred, an error is reported, and the operation is terminated.

If you consider that the process may exit halfway, you also need to save and monitor the values of the Top and Number registers to ensure that the values of the Top and Number registers match when exiting halfway.

As shown in FIG. 8, a schematic diagram of an overall framework of a device for detecting tampering of a return address in a stack according to the present disclosure is shown. Generally, the device includes:

A hash value calculation module A1 is configured to obtain a hash value to be verified based on any hash value generation algorithm according to the hash value corresponding to the verification return address and the verification return address stored in the top frame of the stack in the stack;

Wherein, the i-th return address and a random number are stored in the i-th frame in the stack, and any one of the frames from the i + 1th frame to the top frame of the stack is stored in any one of the frames. The corresponding return address and the hash value corresponding to the return address, wherein the hash value corresponding to the return address is based on the return address and the hash value corresponding to the return address stored in the previous frame of any frame in the stack, based on the Said any hash value generation algorithm, the hash value obtained; j> i≥1, where j is the sequence number of the top frame of the stack;

The verification module A2 is configured to confirm that the return address to be verified is tampered if the hash value to be verified is different from the correct hash value generated in advance; wherein the correct hash value is based on the untampered return address of the top frame of the stack in the stack in advance The hash value corresponding to the return address that has not been tampered with is obtained based on any one of the hash value generation algorithms.

In another specific embodiment of the present disclosure, a device for detecting tampering with a return address in a stack is provided. The processor for executing the method for detecting tampering with a return address in a stack further includes a Top register and A Salt register:

The Top register is used to store the correct hash value, and the correct hash value stored in the Top register can only be modified by a preset instruction;

The Salt register is used to store a challenge value, which is used as another input of a hash function, and the challenge value can only be modified by a preset instruction.

In order for the above disclosure to be truly applied to a real system, support from various aspects such as a compiler, an operating system, and the like is also required. The operating system needs to know the existence of several special registers (including Top and Salt registers, etc.). At the beginning of each process, the values of these registers are initialized and set to random numbers. When the process is switched, the values of these registers are saved to ensure that each process has its own relevant information and will not affect each other. The compiler also needs to know these special registers. If it is an uncompressed structure, the compiler needs to add some code to operate using these registers. If it is a compressed structure, the compiler needs to know the specific layout of the 64-bit return address, which bits are the return address, and which bits are the hash value, so that the compiler can add special processing code to the program. If the compiler has sufficient support, the present disclosure can also be implemented using a compiler (without requiring hardware support). However, the efficiency of this implementation is lower than that of hardware-only implementation, and the performance loss is about 3%.

The present disclosure is highly flexible and compatible. For example, a multi-chain structure is adopted, and every certain number of return addresses are protected by different chains; some addresses are protected, and some addresses are not protected. This makes it more difficult for attackers to crack. This disclosure is not in conflict with other defense methods, and can be used in combination.

Compared with other technologies, the above specific embodiments adopt a chain technology, that is, linking the return address and the hash value as a chain is the core idea of the present disclosure. This disclosure utilizes hash calculations to protect the return address. Hash calculations have some unique advantages. Such as knowing the final hash value, but it is difficult to derive the original value from this. However, it is worth noting that there is still the possibility of using other encryption and decryption algorithms to replace the hash algorithm. Chained hashing brings various advantages, such as high security, low performance loss, and low design complexity.

At the same time, the above-mentioned embodiments of the present disclosure are superior to existing methods in terms of security, performance, design complexity, compatibility, practicality, and the like. Compared with a specific technology, the present disclosure is better in some aspects, while other aspects can ensure that it is not worse than the technology.

First, the present disclosure can strictly guarantee that the return address cannot be maliciously tampered with, and the security is higher than other methods. For example, the shadow stack cannot prevent the backup data of the shadow stack from being modified, and stack protection cannot prevent the leakage of protection values.

Secondly, according to experiments, the performance loss of the present disclosure using hardware support is only 0.15%, which is lower than various existing methods.

In terms of hardware, the present disclosure only needs to add a few registers and a hash operation module, the design complexity is very low, and it is easy to implement. While other methods, such as shadow stacks, may require modification of the page table management mechanism, the complexity is much higher than this disclosure.

The present disclosure is highly versatile and can be used in any mainstream computer system. Function calls and returns are the most basic program functions supported by all computers, and the present disclosure can be used for all computer systems that support function calls and returns.

The disclosure has high compatibility, and small changes to the system, and can be well incorporated into existing computer systems.

In summary, the present disclosure is a very practical technology that can be easily applied to real systems.

In addition, the present disclosure has some unique advantages. For example, once an attack is successful, none of the existing defense methods can be found. Even if this disclosure is really cracked by an attacker, the attacker will inevitably leave traces of the attack, and thus will be found.

Finally, the method of the present application is only a preferred implementation, and is not intended to limit the protection scope of the embodiments of the present disclosure. Any modification, equivalent replacement, or improvement made within the spirit and principle of the embodiments of the present disclosure shall be included in the protection scope of the embodiments of the present disclosure.

Claims (10)

A method for detecting that a return address in a stack has been tampered with is characterized by: S1. Obtain a hash value to be verified based on any hash value generation algorithm according to the hash value corresponding to the return address to be verified and the hash value corresponding to the return address to be verified stored in the top frame of the stack; Wherein, the i-th return address and a random number are stored in the i-th frame in the stack, and any one of the frames from the i + 1th frame to the top frame of the stack is stored in any one of the frames. The corresponding return address and the hash value corresponding to the return address; wherein the hash value corresponding to the return address is based on the return address and the hash value corresponding to the return address stored in the previous frame of any frame in the stack, based on the Said any hash value generation algorithm, the hash value obtained; j> i≥1, where j is the sequence number of the top frame of the stack; S2. If the hash value to be verified is different from the correct hash value generated in advance, it is confirmed that the return address to be verified is tampered; wherein the correct hash value is based on the untampered return address and the untampered frame top frame of the stack The hash value corresponding to the return address of is obtained based on any one of the hash value generation algorithms. The method according to claim 1, wherein the processor for executing the method for detecting that a return address in the stack is tampered with further comprises a Top register, wherein the Top register is used to store the correct hash value The correct hash value stored in the Top register can only be modified by a preset instruction. The method according to claim 2, wherein the processor for executing the method for detecting that a return address in the stack is tampered with, further comprises a hash calculation module for executing any one of the hash value generation algorithms . The method according to claim 1, wherein any return address in the stack and a hash value corresponding to any of the return addresses are separately stored in different positions in a same stack frame in the stack. on. The method according to claim 1, wherein S2 further comprises: If the hash value to be verified is the same as the correct hash value generated in advance, it is confirmed that the return address to be verified has not been tampered with. A device for detecting that a return address in a stack has been tampered with, comprising: A hash value calculation module is configured to obtain an hash value to be verified based on any hash value generation algorithm based on the hash value corresponding to the return address to be verified and the hash value corresponding to the return address to be verified stored in the top frame of the stack in the stack; Wherein, the i-th return address and a random number are stored in the i-th frame in the stack, and any one of the frames from the i + 1th frame to the top frame of the stack is stored in any one of the frames. The corresponding return address and the hash value corresponding to the return address; wherein the hash value corresponding to the return address is based on the return address and the hash value corresponding to the return address stored in the previous frame of any frame in the stack, based on the Said any hash value generation algorithm, the hash value obtained; j> i≥1, where j is the sequence number of the top frame of the stack; A verification module, configured to determine that if the hash value to be verified is different from the pre-generated correct hash value, to confirm that the return address to be verified has been tampered with; the correct hash value is based on the untampered return address of the top frame of the stack in the stack in advance; The hash value corresponding to the return address that has not been tampered with is obtained based on any one of the hash value generation algorithms. The device according to claim 6, further comprising a Top register, wherein the Top register is used to store the correct hash value, and the correct hash value stored in the Top register can only be modified by a preset instruction. The apparatus according to claim 7, further comprising a hash calculation module for executing the any one of the hash value generation algorithms. The apparatus according to claim 6, wherein any return address in the stack and a hash value corresponding to any of the return addresses are separately stored in different positions in a same stack frame in the stack. on. The device according to claim 6, wherein the verification module is further configured to determine that if the hash value to be verified is the same as the correct hash value generated in advance, it is confirmed that the return address to be verified has not been tampered with.

Images