摘要
针对加密软件中的密钥安全性问题,提出一种基于动态二进制插桩的密钥安全性检测方法。该方法面向CryptoAPI加密应用程序,首先通过对CryptoAPI密钥应用模式的分析,指出潜在的密钥安全性漏洞;然后以动态二进制分析平台Pin为支撑,动态记录程序运行期间的加解密过程信息;在此基础上设计关联性漏洞检测算法,实现对密钥安全性的检测。测试结果表明,该方法能够有效检测出两大类密钥安全性漏洞。
For the key security problem in the cryptographic software, the method of key security detection based on dynamic binary instrumentation was proposed. Aimed at CryptoAPI cryptographic software, the method firstly pointed out the potential key security vulnerabilities by analyzing the key applying pattems of CryptoAPI. Then it recorded cryptographic data information during the execution of the program dynamically using Pin platform. On this basis, a relevance vulnerability detection algorithm was designed to detect the key security. Test result indicated that it can effectively detect the two kinds of key security vulnerabilities.
出处
《网络与信息安全学报》
2017年第11期50-58,共9页
Chinese Journal of Network and Information Security
