论文标题
使用硬件性能计数器调查黑框功能识别
Investigating Black-Box Function Recognition Using Hardware Performance Counters
论文作者
论文摘要
本文介绍了使用硬件性能计数器（HPC）识别Black-Box程序功能的新方法和结果，调查员可以在其中调用和测量功能调用。重要用例包括分析编译的库，例如静态和动态链接库，以及受信任的执行环境（TEE）应用程序。我们开发了一种通用方法来对一系列全面的硬件事件进行分类，例如分支错误预测和指导退休，以识别标准的基准测试和加密库功能。这包括各种签名，验证和哈希功能以及以多种操作模式的密码。使用现成的Intel/X86-64，ARM和RISC-V CPU评估三个体系结构。接下来，我们表明可以使用修补程序和未拨打的库版本之间的HPC差异来检测几个已知的CVE-number-number openssl漏洞。此外，我们证明，可以使用非安全世界HPC测量值识别ARM Trustzone TEE应用程序中的标准化加密功能，这适用于在TEE执行过程中不安全安全的性能监控单元（PMU）的平台。在所有情况下，根据应用，建筑和汇编假设的不同，在所有情况下均达到高精度（86.22-99.83％）。最后，我们讨论了未来研究的缓解，出色的挑战和方向。
This paper presents new methods and results for recognising black-box program functions using hardware performance counters (HPC), where an investigator can invoke and measure function calls. Important use cases include analysing compiled libraries, e.g. static and dynamic link libraries, and trusted execution environment (TEE) applications. We develop a generic approach to classify a comprehensive set of hardware events, e.g. branch mis-predictions and instruction retirements, to recognise standard benchmarking and cryptographic library functions. This includes various signing, verification and hash functions, and ciphers in numerous modes of operation. Three architectures are evaluated using off-the-shelf Intel/X86-64, ARM, and RISC-V CPUs. Next, we show that several known CVE-numbered OpenSSL vulnerabilities can be detected using HPC differences between patched and unpatched library versions. Further, we demonstrate that standardised cryptographic functions within ARM TrustZone TEE applications can be recognised using non-secure world HPC measurements, applying to platforms that insecurely perturb the performance monitoring unit (PMU) during TEE execution. High accuracy was achieved in all cases (86.22-99.83%) depending on the application, architectural, and compilation assumptions. Lastly, we discuss mitigations, outstanding challenges, and directions for future research.
