面向应用安全的特权级硬件挖掘研究

Information hiding (IH) has been an important building block for many defenses against code reuse attacks, because of its effectiveness and performance. It employs randomization to probabilistically “hide” sensitive memory areas, called safe areas, from attackers and ensures no pointer pointing to safe areas could be leaked. However, recent works have shown that IH is still vulnerable to various attacks. Domain-based isolation technique could address this security problem, but it suffers from high performance overhead when applying to protect the frequent accessed safe areas. . To address the performance problem, we propose to exploit the privileged hardware feature to achieve more efficient isolation technique. To the best of our knowledge, this research is the first work to use the privileged hardware to protect the inter-process domain. How to use the privileged hardware to achieve a security and efficient isolation technique will meet many challenges. To address these challenges, we will deploy the following three research contents:.1) How to achieve the privileged hardware based isolation technique;.2) How to ensure there is no extra attack surfaces incurred when the application running in Ring 0, compared with running in Ring 3;.3) How to achieve an efficient runtime environment, when support the application running in Ring 0;. After this research, this work will propose a novel privileged hardware based isolation technique for use-space application and implement a prototype which support the application running in Ring 0 without incurring any attack surfaces. Based on this prototype, the security researchers could develop many privileged hardware based defenses.

信息隐藏技术作为防御的基础被众多防御机制用来抵御代码重用攻击，保护其安全区域。然而，最近的一系列研究表明该技术不再安全有效。基于域的隔离技术能够有效保护安全区域，但是面临着严重的性能问题。为了解决这个问题，我们将首次通过挖掘特权级硬件实现更加高效的域隔离技术，并用其保护进程内的内存区域。但是如何利用特权级硬件实现一个安全并且高效的域隔离技术面临着非常多的挑战。针对这些挑战，本研究将部署以下三个研究内容：1）研究如何实现基于特权级硬件的域隔离技术；2）相比用户态下，研究如何不增加特权态下应用的攻击面；3）研究支持特权态下应用运行的低开销运行时环境；. 通过本项目的研究，该项工作将提出一个基于特权级硬件的安全并且高效的域隔离技术。同时，该工作将实现一个支持特权态下应用安全运行的原型系统。基于该原型系统，安全研究人员可以研究更多基于特权级硬件的防御机制。

广泛存在的漏洞给计算机系统造成了严重的威胁。高效的系统隔离技术以失效安全为目标，将系统中的组件进行功能解耦和安全隔离，使得攻击者即使攻陷某个系统组件，也无法危害整个系统。本项目围绕系统隔离技术，从以下三个方面开展了研究。.1）高效的硬件辅助内存隔离技术：本项目综合运用编译技术和系统方法深度挖掘主流X86和ARM平台下硬件特性在内存隔离方面的潜力，成功运用虚拟化等技术将特权级硬件特性（例如，X86 SMAP、ARM PAN）安全地释放给非特权应用实现高效的内存隔离。.2）面向瞬态执行的微体系结构安全：本项目通过设计标签化的Cache结构和投机敏感的端口执行调度器实现线程内和跨线程的瞬态执行攻击防护，实现体系结构层的安全加固，阻止攻击者利用瞬态执行漏洞打破系统层面的内存隔离。.3）组件代码多样化技术：本项目探索组件代码的多样化方法，可以在系统内存隔离和体系结构安全都失效的情况下，通过随机引入不确定性阻止攻击者的跨组件攻击行为。.项目开展期间，项目组先后在IEEE S&P、USENIX Security、USENIX ATC、ACM CCS、ACM ISSTA、TDSC等顶级学术会议和期刊上发表论文9篇（CCF A类8篇，B类1篇），申请专利4项，软件著作权1项。相关科研成果也被应用在国家重要安全部门，受到了广泛好评。