Design and implementation of hardware-based dynamic instruction set randomization framework

San DU; Hui SHU; Fei KANG

doi:10.11959/j.issn.2096-109x.2017.00216

您当前的位置：

首页 >

文章列表页 >

Design and implementation of hardware-based dynamic instruction set randomization framework

Academic paper | 更新时间：2024-06-03

- Design and implementation of hardware-based dynamic instruction set randomization framework
- Journal of network and information security Vol. 3, Issue 11, Pages: 29-39(2017)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00216
  CLC： TP309.1
- Online First：2017-11，
  
  Published：15 November 2017
- 稿件说明：
移动端阅览
San DU, Hui SHU, Fei KANG. Design and implementation of hardware-based dynamic instruction set randomization framework[J]. Journal of network and information security, 2017, 3(11): 29-39.
DOI：

San DU, Hui SHU, Fei KANG. Design and implementation of hardware-based dynamic instruction set randomization framework[J]. Journal of network and information security, 2017, 3(11): 29-39. DOI： 10.11959/j.issn.2096-109x.2017.00216.

摘要

针对现有的指令集随机化方法存在从代码段中剥离数据困难、静态指令集随机化密钥固定和伪随机数密钥不安全等问题，设计并实现了基于硬件的动态指令集随机化框架（HDISR），通过在装载程序时加密程序代码，将指令集随机化引入内核层和应用层的安全防护，内核使用单独的内核密钥，不同的应用程序使用不同的用户密钥。实验结果表明，HDISR 能将代码注入攻击降级为拒绝服务攻击，且额外硬件损耗少于2.57%，每兆字节代码加密的启动延时0.31 s。

Abstract

All the existing ISR methods have some defects including stripping data from code segment is hard to accomplish

static ISR has fixed key and pseudo-random key is not secure.To introduce ISR technology into the se-curity protection of kernel layer and application layer

hardware-based dynamic instruction set randomization framework (HDISR) was designed and implemented

in which program code was encrypted at loading time.Kernel encryption uses kernel key and applications encryption uses a different user key per process.The experimental re-sults show that HDISR can degrade code injection attack to Denial of Service attack with less than 2.57% additional hardware and 0.31s startup delay of each megabyte code encryption.

关键词

Keywords

references

NIST . USA national vulnerability database [EB/OL ] . http://web.nvd.nist.gov/view/vuln/statistics http://web.nvd.nist.gov/view/vuln/statistics .

CHEN P , WANG J , PAN L , et al . Research and implementation of SQL injection prevention method based on ISR [C ] // IEEE Interna-tional Conference on Computer and Communications . 2017 : 1153 - 1156 .

BARUA A , ZULKERNINE M , WELDEMARIAM K . Protecting Web browser extensions from JavaScript injection attacks [C ] // The International Conference on Engineering of Complex Computer Systems . 2013 : 188 - 197 .

汤战勇，李光辉，房鼎益，等 . 一种具有指令集随机化的代码虚拟化保护系统 [J ] . 华中科技大学学报 ( 自然科学版 ), 2016 , 44 ( 3 ): 28 - 33 .

TANG Z Y , LI G H , FANG D Y , et al . Code virtualized protection system with instruction set randomization [J ] . Journal of Huazhong University of Science and Technology ( Natural Science Edition ), 2016 , 44 ( 3 ): 28 - 33 .

DANGER J L , GUILLEY S , PRADEN F . Hardware-enforced protection against Software reverse-engineering based on an in-struction set encoding [C ] // ACM Sigplan on Program Protection and Reverse Engineering Workshop . 2014 : 5 .

LIU B , WANG B . reconfigurable logic for ASIC design obfuscation against supply chain attacks [C ] // Design,Automation and Test in Europe Conference and Exhibition . 2014 : 1 - 6 .

KC G S , KEROMYTIS A D , PREVELAKIS V . Countering code-injection attacks with instruction-set randomization [C ] // ACM Conference on Computer and Communications Security . 2003 : 272 - 280 .

PORTOKALIDIS G , KEROMYTIS A D . Fast and practical instruc-tion-set randomization for commodity systems [C ] // Computer Secu-rity Applications Conference . 2010 : 41 - 48 .

PORTOKALIDIS G , KEROMYTIS A D . Global ISR:toward a comprehensive defense against unauthorized code execution [M ] . Moving Target Defense . New York : Springer . 2011 : 49 - 76 .

王奕森，舒辉，谢耀滨，等 . 基于指令集随机化的代码注入型攻击防御技术 [J ] . 计算机应用与软件， 2016 , 33 ( 5 ): 312 - 316 .

WANG Y S , SHU H , XIE Y B , et al . Defense technology against code-injection attacks based on instruction set randomization [J ] . Computer Applications and Software , 2016 , 33 ( 5 ): 312 - 316 .

SOVAREL A N , EVANS D , PAUL N . Where's the FEEB? the effectiveness of instruction set randomization [C ] // USENIX Security Symposium . 2005 : 10 .

PAPADOGIANNAKIS A , LOUTSIS L , PAPAEFSTATHIOU V , et al . ASIST:architectural support for instruction set randomiza-tion [C ] // ACM Sigsac Conference on Computer ＆ Communications Security . 2013 : 981 - 992 .

SINHA K , KEMERLIS V P , SETHUMADHAVAN S . Reviving instruction set randomization [C ] // IEEE International Symposium on Hardware Oriented Security and Trust . 2017 .

欧海文，赵静，于慧红，等 . 基于振荡器的真随机数发生器的研究 [J ] . 通信技术， 2011 , 44 ( 12 ): 153 - 155 .

OU H W , ZHAO J , YU H H , et al . Study on oscillator-based truly random number generator [J ] . Communications Technology . 2011 , 44 ( 12 ): 153 - 155 .

郭弘，刘钰，党安红，等 . 物理真随机数发生器 [J ] . 科学通报， 2009 ( 23 ): 3651 - 3657 .

GUO H , LIU Y , DANG A H , et al . Physical true random number generator [J ] . Chinese Science Bulletin . 2009 ( 23 ): 3651 - 3657 .

HENNING J L . SPEC CPU2006 benchmark descriptions [J ] . ACM Sigarch Computer Architecture News , 2006 , 34 ( 4 ): 1 - 17 .

Views

2645

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Survey of evolutionary kernel fuzzing

Related Author

Yan SHI

Weizhong QIANG

Deqing ZOU

Hai JIN

Related Institution

National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab

Hubei Key Laboratory of Distributed System Security

School of Cyber Science and Engineering, Huazhong University of Science and Technology

School of Computer Science and Engineering, Huazhong University of Science and Technology

⁰