Overflow attack defense method and system based on stack randomization

Abstract

The invention belongs to the technical field of computer security, and particularly relates to an overflow attack defense method and system based on stack randomization, and the method comprises the steps: a random seed generator generates a random seed according to a control parameter provided by a service routine; the random number generator generates a random number for representing a relative distance between a return address and a data overflow point according to the random seed; determining the length of a data fragment used for randomly and dynamically inserting a return address according to the random number, inserting the data fragment with the length determined by the random number into the return address, and generating an embedded component content for randomizing the return address; the content of the embedded component is recompiled through a compiler to generate programs with the same function and added with a security mechanism, and in the security mechanism, the position of a return address in a stack is randomly uncertain when program function calling occurs through return address randomization processing, so that the overflow attack difficulty of a stack buffer area is increased; return address integrity detection and other work are avoided, and the overall efficiency of return address protection is improved.

Description

technical field [0001] The invention belongs to the technical field of computer security, in particular to a stack randomization-based overflow attack defense method and system. Background technique [0002] The stack buffer overflow attack is to continuously write data into the stack, thereby overwriting the return address, so that the software control flow changes. The key to the success of a stack buffer overflow attack is that the attacker can accurately determine the location of the return address. In a real attack scenario, once an attacker finds that the software has a stack buffer overflow attack vulnerability, he can often determine the location of the return address through a limited number of tests. For stack buffer overflow attacks, the most classic defense method is StackGuard. To put it simply, StackGuard inserts a flag word into the stack as a "sentinel". When an attacker tampers with the return address by continuously injecting illegal addresses, the "senti...

AI Technical Summary

Problems solved by technology

For example, the shadow stack strategy: Some shadow stacks still have a certain address mapping relationship with the return address, so the attacker can continue to overwrite the return address in the shadow stack after overwriting the return address. At the same time, due to the shadow stack and detection overhead, the shadow stack It will bring a certain performance loss to the running of the software.

The above method does necessary inspection and protection around the return address, but does not process the return address itself

Images