• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>2014 Communications security conference >Reverse analysis of secure communication protocol based on taint analysis
【24h】

Reverse analysis of secure communication protocol based on taint analysis

机译：基于异味分析的安全通信协议反向分析

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

To maintain communications confidentiality, security protocols are widely used in more and more network applications. Moreover, some malwares even leverage these kinds of protocols to evade inspection by IDS. Most security protocols are designed and verified by formalized methods; however, observation shows that protocol implementations commonly contain flaws or vulnerabilities. Therefore, research on reverse engineering of security protocols can play an important role in improving the security of network applications, especially by providing another way to fight against malwares. Nevertheless, previous protocol reverse engineering technologies, which are based on analysis of network traces, encounter great challenges when the network messages transmitted between different protocol principals are encrypted. This paper proposes a taint analysis based method, which aims to infer the message format from dynamic execution of security protocol applications. The proposed approach is based on the observation that the process of message parsing in cryptographic protocol applications reveals rich information about the hierarchical structures and semantics of their messages. Hence, by observing calls to library function and instruction execution in network programs, the proposed approach can reverse derive large amount of information about their protocol, such as message format and protocol model, even the communication is encrypted. Experiments show that the reverse analysis results not only accurately identify message fields, but also unveil the structure of the encrypted message fields.
机译：为了维护通信的机密性，安全协议被越来越多的网络应用广泛使用。此外，某些恶意软件甚至利用这些协议来逃避IDS的检查。大多数安全协议都是通过形式化的方法设计和验证的。但是，观察表明协议实现通常包含缺陷或漏洞。因此，对安全协议的逆向工程的研究可以在提高网络应用程序的安全性方面发挥重要作用，特别是通过提供另一种对抗恶意软件的方式。尽管如此，当对不同协议主体之间传输的网络消息进行加密时，基于网络跟踪分析的先前协议反向工程技术仍面临巨大挑战。本文提出了一种基于异味分析的方法，旨在从安全协议应用程序的动态执行中推断出消息格式。提出的方法基于以下观察：密码协议应用程序中的消息解析过程揭示了有关其消息的层次结构和语义的丰富信息。因此，通过观察对网络程序中库函数的调用和指令在执行中的执行，即使通信被加密，所提出的方法也可以反向推导有关其协议的大量信息，例如消息格式和协议模型。实验表明，反向分析结果不仅可以准确识别消息字段，而且还揭示了加密消息字段的结构。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号