面向LPWAN的受限设备协议漏洞自动化检测框架

An automatic protocol vulnerability detection framework for resource-constrained devices of LPWAN

低功耗广域网(low power wide area network,LPWAN)作为一个强调低功耗的协议通常运行在资源受限设备上。一方面,受限的资源给协议实现的安全性带来了严峻的挑战,厂商通常难以在安全性与资源消耗上进行取舍。另一方面,协议栈以裸机固件的形式部署在设备上,各异的硬件特性使得其自动化分析较为困难。因此,本文专门针对资源受限设备提出了一种基于符号执行与污点分析的协议栈分析框架ProSE,能够针对固件中存在的协议漏洞进行检测。本文以LPWAN中最具代表性的LoRaWAN协议作为分析对象,实现了多种漏洞的自动化检测,并成功检测出6个厂商LoRaWAN实现中存在的20个潜在安全漏洞。

LPWAN(low power wide area network)as a protocol that emphasizes low power consumption usually runs on resource-constrained devices.On the one hand,limited resources bring serious challenges to the security of protocol implementation.Manufacturers may have trouble balancing security demands and resource consumption.On the other hand,protocol stacks are deployed on constrained devices as bare-metal firmware.The varying hardware characteristics make automatic analysis difficult.Therefore,a protocol stack analysis framework called ProSE is proposed.Based on symbolic execution and taint analysis,ProSE is specifically designed for protocol vulnerability detection on the firmware of constrained devices.LoRaWAN is chosen for analysis due to its popularity.The framework is capable of detecting various types of vulnerability.ProSE successfully detected 20 potential security vulnerabilities in the implementation of LoRaWAN of 6 manufacturers.