中国科技核心期刊

中文核心期刊

CSCD来源期刊

空间控制技术与应用 ›› 2021, Vol. 47 ›› Issue (2): 17-24.doi: 10.3969/j.issn.1674-1579.2021.02.003

• 论文与报告 • 上一篇    下一篇

一种嵌入式软件安全漏洞的代码加固方法

  

  1. 西北工业大学计算机学院
  • 出版日期:2021-04-10 发布日期:2021-04-19
  • 基金资助:
    高可信嵌入式软件工程技术实验室开放基金课题资助(HCESET20193)

A Codes Reinforcement Method for Embedded Software Security Vulnerability

  • Online:2021-04-10 Published:2021-04-19

摘要: 软件定义的概念和技术的发展和应用,装备嵌入式系统的功能主要由软件定义完成,导致装备嵌入式软件规模性和复杂性都在急剧增加,软件安全问题已经成为嵌入式系统乃至装备产品研制和运行维护的核心关注点.借助主流软件代码安全性检测技术,对装备嵌入式软件的漏洞行为和结构分析,建立装备嵌入式软件漏洞特征和系统不安全行为属性规约,通过对软件属性规约的逻辑演算,形成软件安全性加固需求,提出基于安全规约属性模板的漏洞加固代码生成技术,对软件代码中潜在的安全漏洞进行修复和加固,实现装备嵌入式软件强制安全保障.

关键词: 安全漏洞检测, 软件强制安全, 嵌入式软件, 代码加固, 软件定义

Abstract: With the development and application of software definition X, functions of embedded systems are implemented with software definitions, which leads to large increase in scale and complexity of embedded software. Software security has become a key concern of embedded systems and products in operation and maintenance phases. In this paper, the vulnerable behavior and structure are analyzed with existing technology or tool to detect software program vulnerable bug, and some vulnerabilities characteristics and insecurity behavior attributes of software embedded in equipment system are created. Through verifying logic propositions among software attribute specifications, software requirements of security reinforcement are gathered. The vulnerability reinforcement code generation technology based on the security template of attribute specification is proposed to generate reinforcement codes automatically, which can be used for fixing potential security bugs in software code and guarantee the protection of embedded software.

Key words: security bug detection, software security enforcement, embedded software, code reinforcement, software definition

中图分类号: 

  • TP311