基于动态二进制插桩的密钥安全性检测

林昊; 康绯; 光焱

doi:10.11959/j.issn.2096-109x.2017.00213

您当前的位置：

首页 >

文章列表页 >

基于动态二进制插桩的密钥安全性检测

学术论文 | 更新时间：2024-06-03

- 基于动态二进制插桩的密钥安全性检测
- Key security detection based on dynamic binary instrumentation
- 网络与信息安全学报 2017年3卷第11期页码：50-58
- 作者机构：
- 作者简介：
  
  [ "林昊（1992-），男，山东荣成人，信息工程大学硕士生，主要研究方向为网络信息安全。" ]
  [ "康绯（1972-），女，河南周口人，信息工程大学教授，主要研究方向为网络信息安全。" ]
  [ "光焱（1983-），男，安徽枞阳人，博士，信息工程大学讲师，主要研究方向为密码学、网络信息安全。" ]
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00213
  中图分类号： TP309
- 网络首发：2017-11，
  
  纸质出版：2017-11-15
- 稿件说明：
移动端阅览
林昊, 康绯, 光焱. 基于动态二进制插桩的密钥安全性检测[J]. 网络与信息安全学报, 2017,3(11):50-58.

Hao LIN, Fei KANG, Yan GUANG. Key security detection based on dynamic binary instrumentation[J]. Journal of network and information security, 2017, 3(11): 50-58.
林昊, 康绯, 光焱. 基于动态二进制插桩的密钥安全性检测[J]. 网络与信息安全学报, 2017,3(11):50-58. DOI： 10.11959/j.issn.2096-109x.2017.00213.

Hao LIN, Fei KANG, Yan GUANG. Key security detection based on dynamic binary instrumentation[J]. Journal of network and information security, 2017, 3(11): 50-58. DOI： 10.11959/j.issn.2096-109x.2017.00213.

摘要

针对加密软件中的密钥安全性问题，提出一种基于动态二进制插桩的密钥安全性检测方法。该方法面向CryptoAPI加密应用程序，首先通过对CryptoAPI密钥应用模式的分析，指出潜在的密钥安全性漏洞；然后以动态二进制分析平台Pin为支撑，动态记录程序运行期间的加解密过程信息；在此基础上设计关联性漏洞检测算法，实现对密钥安全性的检测。测试结果表明，该方法能够有效检测出两大类密钥安全性漏洞。

Abstract

For the key security problem in the cryptographic software

the method of key security detection based on dynamic binary instrumentation was proposed.Aimed at CryptoAPI cryptographic software

the method firstly pointed out the potential key security vulnerabilities by analyzing the key applying patterns of CryptoAPI.Then it recorded cryptographic data information during the execution of the program dynamically using Pin platform.On this basis

a relevance vulnerability detection algorithm was designed to detect the key security.Test result indicated that it can effectively detect the two kinds of key security vulnerabilities.

关键词

Keywords

references

段钢 . 加密与解密 ( 第三版 )[M ] . 北京：电子工业出版社 . 2008 .

DUAN G . Encryption and decryption ( Third Edition )[M ] . Beijing : Electronic Industry Press . 2008 .

李舟军，张俊贤，廖湘科，等 . 软件安全漏洞检测技术 [J ] . 计算机学报， 2015 , 38 ( 4 ): 717 - 732 .

LI Z J , ZHANG J X , LIAO X K , et al . Software security vulnerability detection technology [J ] . Chinese Journal of Computers . 2015 , 38 ( 4 ): 717 - 732 .

EGELE M , BRUMLEY D , FRATANTONIO Y , et al . An empirical study of cryptographic misuse in android applications [C ] // ACM Sigsac Conference on Computer ＆ Communications Security . 2013 : 73 - 84 .

SHAO S , DONG G , GUO T , et al . Modelling analysis and au-to-detection of cryptographic misuse in android applications [C ] // IEEE International Conference on Dependable,Autonomic and Secure Computing . 2014 : 75 - 80 .

LI Y , ZHANG Y , LI J , et al . iCryptoTracer:Dynamic Analysis on Misuse of Cryptography Functions in iOS Applications [C ] // Interna-tional Conference on Network and System Security . 2014 : 349 - 362 .

MA S , LO D , LI T , et al . CDRep:automatic repair of cryptographic misuses in android applications [C ] // ACM on Asia Conference on Computer and Communications Security . 2016 : 711 - 722 .

CHATZIKONSTANTINOU A , NTANTOGIAN C , KAROPOU-LOS G , et al . Evaluation of cryptography usage in android applica-tions [C ] // Eai International Conference on Bio-Inspired Information and Communications Technologies . 2016 : 83 - 90 .

ALMEIDA J B , BARBOSA M , FILLIÂTRE J C , et al . CAOVerif:an open-source deductive verification platform for cryptographic software implementations [J ] . Science of Computer Programmin , 2014 , 91 ( 91 ): 216 - 333 .

FAHL S , HARBACH M , MUDERS T , et al . Why eve and mallory love Android:an analysis of android SSL (in)security [C ] // ACM Confe-rence on Computer and Communications Security . 2012 : 50 - 61 .

RIZZO J , DUONG T . Practical padding oracle attacks [C ] // Usenix Conference on Offensive Technologies . 2010 : 1 - 8 .

BARENGHI A , BREVEGLIERI L , KOREN I , et al . Fault injection attacks on cryptographic devices:theory,practice,and countermeasures [C ] // Proceedings of the IEEE . 2012 : 3056 - 3076 .

Automated testing of crypto software using differential fuzz-ing [EB/OL ] . https://www.blackhat.com/docs/us-17/wednesday/us-17-Aumasson-Automated-Testing-Of-Crypto-Software-Using-Differential-Fuzzing.pdf https://www.blackhat.com/docs/us-17/wednesday/us-17-Aumasson-Automated-Testing-Of-Crypto-Software-Using-Differential-Fuzzing.pdf .

LAZAR D , CHEN H , WANG X , et al . Why does cryptographic software fail?case study and open problems [C ] // Asia-Pacific Workshop . 2014 : 1 - 7 .

安天针对勒索蠕虫“魔窟”(WannaCry)的深度分析报告 [EB/OL ] . http://www.antiy.com/response/wannacry.html http://www.antiy.com/response/wannacry.html .

NEWSOME J , SONG D . Dynamic taint analysis for automatic detection,analysis,and signature generation of exploits on com-modity software [C ] // Conference on NDSS . 2015 .

NETHERCOTE N . Dynamic binary analysis and instrumentation or building tools is easy [D ] . Trinity Lane,Cambridge:University of Cambridge . 2004 .

LUK C K , COHN R , MUTH R , et al . Pin:building customized program analysis tools with dynamic instrumentation [J ] . ACM Sig-plan Notices , 2005 , 40 ( 6 ): 190 - 200 .

BRUENING D L . Efficient,transparent,and comprehensive run-time code manipulation [C ] // Massachusetts Institute of Technolo-gy . 2004 .

NETHERCOTE N , SEWARD J . Valgrind:a framework for heavyweight dynamic binary instrumentation [C ] // ACM Sigplan Conference on Pro-gramming Language Design ＆ Implementation . 2007 : 89 - 100 .

浏览量

2886

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据