信息网络安全

信息网络安全 ›› 2016, Vol. 16 ›› Issue (9): 134-138.doi: 10.3969/j.issn.1671-1122.2016.09.027

• • 上一篇    下一篇

基于粒度抽取的ELF文件完整性校验方法

张永棠1,2(), 丑佳文1   

  1. 1. 广东东软学院计算机科学与技术系,广东佛山 528225
    2. 江西微软技术中心,江西南昌 330003
  • 收稿日期:2016-07-25 出版日期:2016-09-20 发布日期:2020-05-13
  • 作者简介:

    作者简介： 张永棠（1981—）,男,江西,副教授,硕士,主要研究方向为通信及无线传感器网络、互联网及电信安全;丑佳文（1990—）,女,湖南,硕士,主要研究方向为Android开发与人机交互。

  • 基金资助:
    国家自然科学基金[61363047,61563036];广东省普通高校特色创新项目[2014KTSCX212];江西省教育厅科学技术研究项目[GJJ13355]

The ELF File Integrity Checking Method Based on Granularity Extraction

Yongtang ZHANG1,2(), Jiawen CHOU1   

  1. 1. Department of Computer Science and Technology, Guangdong Neusoft Institute, Foshan Guangdong 528225, China
    2. Jiangxi Microsoft Technology Center, Nanchang Jiangxi 330003, China
  • Received:2016-07-25 Online:2016-09-20 Published:2020-05-13

RichHTML

2

PDF (PC)

94

摘要：

文章提出了一种可以配合各种成熟的HASH算法使用的移动可信平台ELF文件完整性校验方法——RMAC（Random-MAC）,并从ELF文件的节内容的关键性和关联性对不同类型和属性的节做分类,按照一定粒度随机选取各节的内容,然后进行校验以期达到高效率和高安全性,评价不同选取粒度对安全和效率的影响。文章在不同版本的Linux系统中,搜集了2249个不同格式的ELF文件的粒度样本进行完整性校验分析。结果表明,在合适的抽取粒度下,RMAC可以将校验效率提高一倍甚至更多。虽然RMAC一次校验安全性能在可接受范围内有所下降,但由于其引入随机性,使目前已有的病毒都无法做到每次都能通过RMAC校验。所以RMAC可以阻止病毒的大规模爆发。

关键词: 可信平台, 移动平台, 可执行文件, 完整性校验

Abstract:

This paper proposes a mobile trusted platform for ELF file integrity checking method (Random-MAC). And classifing the ELF file as the section of the key link and the section of different types and attribute classification, and according to a certain size, the contents of each section were selected and then proceed to checkout. In order to achieve high efficiency and high safety, the evaluation of different effect of particle size on the safety and efficiency of selection is made. In different versions of the Linux system, the collection of 2249 different formats of the ELF file and sizes of the sample is analysised by the integrity of the verification. The results show that RMAC can improve the calibration efficiency even more than twice the size of the appropriate extraction. While the RMAC one time check security performance in the acceptable range has declined. But because of its introduction, the random nature of the existing viruses can not be done every time through the RMAC check. So RMAC can prevent the outbreak of the virus.

Key words: trusted platform, mobile platform, executable file, integrity checking

中图分类号: