用多密钥加密方法防御面向返回编程的攻击

Prevention of return-oriented programming attacks using multi-key protection

针对面向返回编程(ROP)攻击的特性,提出了一种利用多密钥加密函数返回地址值防ROP攻击的方法。这种方法通过密钥指定位以及密钥迷惑位的巧妙设置,防止密钥在泄露情况下攻击者实施有效攻击的可能。利用二进制代码动态翻译工具PIN开发了原型系统,在实现时,为了避免攻击者攻击原型系统而直接访问密钥,引入了诱饵密钥,在增加攻击难度的同时降低了可信计算基。其有效性分析和实验结果表明,在不需要其他信息(如源码、调试信息等)条件下,多密钥加密防御方法能在适当的性能开销下,有效防御ROP攻击,并且其误报率极低。

The multi-key protection method was applied to the study,and a novel technique was presented to prevent return-oriented programming （ROP） attacks based on the analysis of ROP attack properties.This new technique,which benefits from protection of return address by multi-key,introduces obfuscated bits to prevent exploits targeted key sets.With the help of binary dynamic translator of the Intel PIN,a proof-of-concept prototype system for Linux platform was implemented.In order to prevent the direct attacks targeted prototype,the cheating keys were proposed to obfuscate attackers as well as decrease the trusted computing base.The effectiveness analysis and the experimental results demonstrate that the multi-key protection method could effectively prevent ROP attack with a modest performance penalty and low false positive rate.