Security defending method and electronic apparatus
A security defending method and an electronic apparatus are disclosed. The security defending method is applicable in a coprocessor, including: receiving a jump destination encryption request for the operation task; using mask configuration to perform first mask processing on the first jump destination address value to obtain a first intermediate jump destination address value; performing an authentication operation based on the first jump destination storage address, a key reference value corresponding to the operation task and the first intermediate jump destination address value, to obtain a first encryption result value; using the mask configuration to perform second mask processing on the first encryption result value to obtain a first intermediate encryption result value; performing an authentication operation on the first intermediate encryption result value and the first jump destination address value to obtain a first encryption jump destination address value. The security defending method can prevent buffer overflow attacks.
1 . A security defending method of an operation task, applicable in a main processor running the operation task, comprising:
sending a mask configuration instruction from the main processor to a coprocessor, wherein the mask configuration instruction is used to instruct the coprocessor to save mask configuration in a mask register of the coprocessor, wherein the mask configuration is used for the coprocessor to perform mask processing on a received destination address value in an encryption procedure and an authentication procedure; and
sending a reference address configuration instruction corresponding to the operation task from the main processor to the coprocessor, wherein the reference address configuration instruction is used to instruct the coprocessor to save a reference address in a reference address register of the coprocessor, wherein the reference address is used for the coprocessor to perform an authentication operation in the authentication procedure,
wherein the encryption procedure comprises:
performing, by the coprocessor, mask processing on a first jump destination address value according to the mask configuration to obtain a first intermediate jump destination address value;
performing, by the coprocessor, the authentication operation based on the first intermediate jump destination address value, a key reference value and a first jump destination storage address to obtain a first encryption jump destination address value,
wherein the authentication procedure comprises:
performing, by the coprocessor, mask processing on a second jump destination address value according to the mask configuration to obtain a second intermediate jump destination address value;
performing, by the coprocessor, the authentication operation based on the second intermediate jump destination address value, the key reference value and a second jump destination storage address to obtain a second address value;
determining, by the coprocessor, whether an authentication succeeds based on the second address value and the reference address,
wherein the authentication operation comprises a symmetric encryption operation or a Message Authentication Code algorithm,
wherein the security defending method further comprises:
sending a jump destination encryption instruction to the coprocessor, wherein the jump destination encryption instruction comprises information for acquiring the first jump destination storage address and the first jump destination address value corresponding to the operation task; and
receiving the first encryption jump destination address value from the coprocessor.
2 . The security defending method according to claim 1 , further comprising:
sending a key reference value loading instruction to the coprocessor, in a case where a process corresponding to the operation task starts or cuts in on the main processor, to save the key reference value in a key reference value register of the coprocessor, wherein the key reference value is used for the coprocessor to generate a key in the encryption procedure and the authentication procedure.
3 . The security defending method according to claim 2 , wherein the key reference value loading instruction comprises a source register saving the key reference value in the main processor, so that the coprocessor reads the key reference value from the source register, or
the key reference value loading instruction instructs the coprocessor to generate the key reference value.
4 . The security defending method according to claim 3 , further comprising:
generating the key reference value in the main processor and saving the key reference value in the source register.
5 . The security defending methods according to claim 2 , wherein the key reference value is a random number.
6 . The security defending method according to claim 2 , further comprising:
sending a key reference value storage instruction to the coprocessor, in a case where a process corresponding to the operation task is cut out on the main processor; and
receiving and saving the key reference value returned by the coprocessor according to the key reference value storage instruction.
7 . The security defending method according to claim 6 , wherein the key reference value is saved in a Process Control Block (PCB) corresponding to the operation task in the main processor.
8 . The security defending method according to claim 1 , wherein the reference address conforms to a first mode defined by the mask configuration.
9 . The security defending method according to claim 8 , wherein the first mode is high-order data bits of a first number, and the reference address is a base address for high-order data bits of the first number.
10 . The security defending method according to claim 1 , wherein the first jump destination storage address is an operation task return address or a function pointer address; and the first jump destination address value is an operation task return address value or a function pointer address value.
11 . The security defending method according to claim 1 , further comprising:
sending a jump destination authentication instruction to the coprocessor, wherein the jump destination authentication instruction comprises information for acquiring the second jump destination storage address and the second jump destination address value corresponding to the operation task, the second jump destination address value is a jump destination address value that has been encrypted, and the coprocessor performs the authentication operation according to the mask configuration, the second jump destination storage address and the second jump destination address value; and
receiving a standby jump destination address value that has been decrypted corresponding to the operation task from the coprocessor in response to the authentication succeeding, or, receiving exception information from the coprocessor in response to the authentication failing, wherein the coprocessor obtains the standby jump destination address value according to the reference address and the second jump destination address value.
12 . An electronic apparatus, comprising a main processor, a coprocessor in communication with the main processor, and a memory,
wherein the memory stores a computer executable code, and the computer executable code, when executed by the main processor and the coprocessor, is configured to implement a security defending method, wherein the security defending method, applicable in a main processor running an operation task, comprises:
sending a mask configuration instruction from the main processor to a coprocessor, wherein the mask reference address configuration instruction is used to instruct the coprocessor to save mask configuration in a mask register of the coprocessor, wherein the mask configuration is used for the coprocessor to perform mask processing on a received destination address value in an encryption procedure and an authentication procedure; and
sending a reference address configuration instruction corresponding to the operation task from the main processor to the coprocessor, wherein the reference address configuration instruction is used to instruct the coprocessor to save a reference address in a reference address register of the coprocessor, wherein the reference address is used for the coprocessor to perform an authentication operation in the authentication procedure,
wherein the encryption procedure comprises:
performing, by the coprocessor, mask processing on a first jump destination address value according to the mask configuration to obtain a first intermediate jump destination address value;
performing, by the coprocessor, the authentication operation based on the first intermediate jump destination address value, a key reference value and a first jump destination storage address to obtain a first encryption jump destination address value,
wherein the authentication procedure comprises:
performing, by the coprocessor, mask processing on a second jump destination address value according to the mask configuration to obtain a second intermediate jump destination address value;
performing, by the coprocessor, the authentication operation based on the second intermediate jump destination address value, the key reference value and a second jump destination storage address to obtain a second address value;
determining, by the coprocessor, whether an authentication succeeds based on the second address value and the reference address,
wherein the authentication operation comprises a symmetric encryption operation or a Message Authentication Code algorithm,
wherein the security defending method further comprises:
sending a jump destination encryption instruction to the coprocessor, wherein the jump destination encryption instruction comprises information for acquiring the first jump destination storage address and the first jump destination address value corresponding to the operation task; and
receiving the first encryption jump destination address value from the coprocessor.
13 . The electronic apparatus according to claim 12 , wherein the main processor and the coprocessor communicate with each other through a communication interface.
14 . The electronic apparatus according to claim 13 , wherein the main processor is a RISC-V processor, and the communication interface is a RoCC interface.