IKEChecker: grammar-guided stateful fuzzer for IKE protocol implementions

ZHENG Yonghui; ZHAO Dongliang; GU Chunxiang; ZHANG Xieli

doi:10.11959/j.issn.2096-109x.2024057

您当前的位置：

首页 >

文章列表页 >

IKEChecker: grammar-guided stateful fuzzer for IKE protocol implementions

Papers

- IKEChecker: grammar-guided stateful fuzzer for IKE protocol implementions
- Chinese Journal of Network and Information Security Vol. 10, Issue 4, Pages: 109-122(2024)
- 作者机构：
  
  信息工程大学，河南郑州 450001
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2024057
  CLC： TP393
- Received：28 December 2023，
  
  Revised：2024-07-26，
  
  Published：25 August 2024
- 稿件说明：
移动端阅览
郑永辉, 赵栋梁, 顾纯祥, 等. IKEChecker:语法引导的IKE协议有状态模糊测试[J]. 网络与信息安全学报, 2024, 10(4): 109-122.

Format: ZHENG Y H, ZHAO D L, GU C X, et al. IKEChecker: grammar-guided stateful fuzzer for IKE protocol implementions[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 109-122.
郑永辉, 赵栋梁, 顾纯祥, 等. IKEChecker:语法引导的IKE协议有状态模糊测试[J]. 网络与信息安全学报, 2024, 10(4): 109-122. DOI： 10.11959/j.issn.2096-109x.2024057.

Format: ZHENG Y H, ZHAO D L, GU C X, et al. IKEChecker: grammar-guided stateful fuzzer for IKE protocol implementions[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 109-122. DOI： 10.11959/j.issn.2096-109x.2024057.

摘要

互联网密钥交换（IKE，internet key exchange）协议用于在IPSec（internet protocol security）协议中进行身份验证和密钥协商，其安全性对保护IP通信至关重要，复杂的协议逻辑导致协议实现中难免存在安全漏洞。模糊测试是检测协议实现中潜在漏洞的有效手段，但将现有模糊测试工具直接应用于IKE协议时，存在生成测试用例质量不高、难以探索深层状态空间等局限性。针对上述问题，设计了基于IKE协议语法的变异策略来减少无效测试用例的生成，同时增加测试用例的多样性；引入了基于进化策略的变异调度方案来自动优化变异算子的概率分布，进一步提高生成高质量测试用例的概率；设计了消息处理器用来维护协议交互上下文信息并执行密码学相关的操作，从而支持在黑盒条件下对IKE协议进行测试，并实现对深层协议交互行为和状态空间的探索。基于上述方法实现了IKE协议有状态模糊测试工具IKEChecker，该工具支持对IKEv1和IKEv2协议进行测试。对两种广泛使用的支持IKE协议实现的开源软件strongSwan和Libreswan进行测试，发现4个未公开漏洞；通过与其他模糊测试工具对比，评估了IKEChecker在漏洞检测方面的效率。

Abstract

The internet key exchange (IKE) protocol

integral to the authentication and key negotiation process within the Internet Protocol Security (IPSec) framework

has been utilized for the protection of IP communications. Given the complex protocol logic

security vulnerabilities in the implementation of the IKE protocol are inevitably present. Fuzz testing

recognized as an effective means of detecting potential vulnerabilities in protocol implementations

has been conventionally applied. However

the direct application of existing fuzzing tools to the IKE protocol has been found to present limitations

such as the generation of low-quality test cases and difficulty in exploring deep states. To address these issues

a mutation strategy based on the grammar of the IKE protocol was designed

aiming to reduce the generation of invalid test cases while increasing the diversity of generated test cases. Additionally

an evolutionary strategy-based mutation scheduling scheme was introduced

which automatically optimized the probability distribution of mutation operators

further increasing the likelihood of generating high-quality test cases. A message handler was designed to maintain protocol interaction context information and perform cryptographic operations

thereby supporting testing of the IKE protocol under black-box conditions. This enabled the exploration of deep protocol interaction behavior and state space. Utilizing the aforementioned methods

an IKE protocol stateful fuzz testing tool named IKEChecker was implemented

supporting testing of both IKEv1 and IKEv2 protocols. Testing was conducted on two widely used open-source IKE protocol implementations

strongSwan and Libreswan

resulting in the revelation of 4 undisclosed vulnerabilities. By comparing IKEChecker with other fuzz testing tools

its efficiency in vulnerability detection was evaluated.

关键词

Keywords

references

MANÈS V J M , HAN H , HAN C , et al . The art, science, and engineering of fuzzing: a survey [J ] . IEEE Transactions on Software Engineering , 2021 , 47 ( 11 ): 2312 - 2331 .

PHAM V T , BÖHME M , ROYCHOUDHURY A . AFLNet: a greybox fuzzer for network protocols [C ] // Proceedings of the 2020 IEEE 13th International Conference on Software Testing, Validation and Verification . Piscataway : IEEE Press , 2020 : 460 - 465 .

BA J S , MARCEL B , ZAHRA M , et al . Stateful greybox fuzzing [C ] // Proceedings of USENIX Security Symposium . Boston : USENIX Association , 2022 : 3255 - 3272 .

MILLER B P , FREDRIKSEN L , SO B . An empirical study of the reliability of UNIX utilities [J ] . Communications of the ACM , 1990 , 33 ( 12 ): 32 - 44 .

KAKSONEN R , LAAKSO M , TAKANEN A . System security assessment through specification mutations and fault injection [C ] // Proceedings of the IFIP TC6/TC11 International Conference on Communications and Multimedia Security Issues of the New Century . New York : ACM , 2001 : 173 - 183 .

LUO Z X , YU J Z , ZUO F L , et al . Bleem: packet sequence oriented fuzzing for protocol implementations [C ] // Proceedings of USENIX Security Symposium . Anaheim : USENIX Association , 2023 : 4481 - 4498 .

NATELLA R . StateAFL: greybox fuzzing for stateful network servers [J ] . Empirical Software Engineering , 2022 , 27 ( 7 ): 191 .

ANDRONIDIS A , CADAR C . SnapFuzz: high-throughput fuzzing of network applications [C ] // Proceedings of the 31st ACM Sigsoft International Symposium on Software Testing and Analysis . New York : ACM , 2022 : 340 - 351 .

LI J Q , LI S Y , SUN G , et al . SNPSFuzzer: a fast greybox fuzzer for stateful network protocols using snapshots [J ] . IEEE Transactions on Information Forensics and Security , 2022 , 17 : 2673 - 2687 .

QIN S S , HU F , MA Z Y , et al . NSFuzz: towards efficient and state-aware network service fuzzing [J ] . ACM Transactions on Software Engineering and Methodology , 2023 , 32 ( 6 ): 160 .

LIU D G , PHAM V T , ERNST G , et al . State selection algorithms and their impact on the performance of stateful network protocol fuzzing [C ] // Proceedings of the 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) . Piscataway : IEEE Press , 2022 : 720 - 730 .

LIU D G , ERNST G , MURRAY T , et al . Legion: best-first concolic testing (competition contribution) [C ] // Proceedings of International Conference on Fundamental Approaches to Software Engineering . Cham : Springer , 2020 : 545 - 549 .

HARKINS D , CARREL D . The Internet Key Exchange (IKE) [S ] . RFC 2409, 1998 : 1 - 41 .

KAUFMAN C , HOFFMAN P , NIR Y , et al . Internet Key Exchange Protocol Version 2 (IKEv2) [S ] . RFC 7296, 2014 : 1 - 142 .

MAUGHAN D , SCHERTLER M , SCHNEIDER M , et al . Internet Security Association and Key Management Protocol (ISAKMP) [S ] . RFC 2408, 1998 : 1 - 86 .

WU M Y , JIANG L , XIANG J H , et al . One fuzzing strategy to rule them all [C ] // Proceedings of the 2022 IEEE/ACM 44th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2022 : 1634 - 1645 .

DE RUITER J , POLL E . Protocol state fuzzing of TLS implementations [C ] // Proceedings of USENIX Security Symposium (USENIX Security 15) . Washington : USENIX Association , 2015 : 193 - 206 .

ANGLUIN D . Learning regular sets from queries and counterexamples [J ] . Information and Computation , 1987 , 75 ( 2 ): 87 - 106 .

JAUERNIG P , JAKOBOVIC D , PICEK S , et al . DARWIN: survival of the fittest fuzzing mutators [J ] . arXiv Preprint: arXiv: 2210.11783 , 2022 .

NATELLA R , PHAM V T . ProFuzzBench: a benchmark for stateful protocol fuzzing [C ] // Proceedings of the 30th ACM Sigsoft International Symposium on Software Testing and Analysis . New York : ACM , 2021 : 662 - 665 .

TSANKOV P , DASHTI M T , BASIN D . SECFuzz: Fuzz-testing security protocols [C ] // Proceedings of the 2012 7th International Workshop on Automation of Software Test (AST) . Piscataway : IEEE Press , 2012 : 1 - 7 .

TEAN P , JANSSEN R , VAANDRAGER F . Combining model learning and model checking to analyze TCP implementations [C ] // Proceedings of International Conference on Computer Aided Verification . Cham : Springer , 2016 : 454 - 471 .

FITERĂU-BROŞTEAN P , LENAERTS T , POLL E , et al . Model learning and model checking of SSH implementations [C ] // Proceedings of the 24th ACM Sigsoft International SPIN Symposium on Model Checking of Software . New York : ACM , 2017 : 142 - 151 .

GUO J X , GU C X , CHEN X , et al . Model learning and model checking of IPSec implementations for internet of things [J ] . IEEE Access , 2019 , 7 : 171322 - 171332 .

KLEES G , RUEF A , COOPER B , et al . Evaluating fuzz testing [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2018 : 2123 - 2138 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Amplification vulnerability mining method based on state-guided

5G-based smart airport network security scheme design and security analysis

Security issues and system structure of internet of vehicles

Related Author

JIANG Sikang

CAI Ruijie

YIN Xiaokang

CHEN Hongyu

LIU Shengli

Xinxin XING

Qingya ZUO

Jianwei LIU

Related Institution

School of Cyber Science and Technology, Beihang University

International School, Beijing University of Posts and Telecommunications

School of Computer Science and Communication Engineering, Jiangsu University

Automotive Engineering Research Institute,Jiangsu University

Innovation Centre of Information Support ＆ Assurance Technology,Anhui University,Hefei

⁰