基于密码库函数程序加解密过程分析.docVIP

基于密码库函数程序加解密过程分析 　　摘 要: 　　 　　针对常见密码算法种类多及实现方式不同，采用现有特征扫描和动态调试的方法分析程序中的加解密过程非常困难的问题。提出一种基于库函数原型分析和库函数调用链构造的加解密过程分析方法，库函数原型分析是分析常见密码库函数所包含的密码算法知识和库框架知识，并记录形成知识库，库函数调用链是根据密码库函数调用时参数值的相等关系构建的库函数调用的先后关系链，最后根据知识库在链上提取展示密码库及密码算法相关知识。该方法对运用到常见库的程序中的算法的识别精确度达到近100%，能详细分析算法调用时的数据、密钥、模式，并有助于对多个算法的协同处理关系作分析。该方法有助于辅助分析木马、蠕虫之类恶意程序，也可用于检测程序对库密码算法的运用是否正确。 　　?ス丶?词:密码算法；加解密过程；加解密模式；密钥；加解密数据 　　 　　?ブ型挤掷嗪?: TP309 　　 　　文献标志码:A 　　英文标题?? 　　 　　Cryptographic procedure analysis based on cryptographic library function 　　?び⑽淖髡呙? 　　 　　 　　ZHANG Yanwen????1??*??, YIN Qing??2, SHU Hui??2, LI Zhenglian??1, CHANG Rui??2 　　?び⑽牡刂?( 　　 　　 　　1.Information Engineering University, Zhengzhou Henan 450000, China??;???? 　　2.State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou Henan 450000, China 　　 　　英文摘要)?? 　　Abstract: 　　Since it??s hard to analyze the cryptographic procedure using method of property scan or debugging for the variety and different implementation of cryptographic algorithms, a method was proposed based on library function prototype analysis and their calling??graph building. Library functions prototype analysis is analyzing cryptographic algorithm knowledge and library frame knowledge to form a knowledge base. Calling??graph building is building a calling??graph that reflects the function calling order according to parameter value of thefunctions. Finally cryptographic algorithm knowledge and library frame knowledge on the calling??graph were extracted. The method discriminated common cryptographic algorithm almost 100%, and it could not only recover cryptographic data, key and cryptographic mode, but also help to analyze the relationship between more than two cryptographic algorithms dealing with the same data. The method could be used to analyze Trojan, worm and test whether the library is used correctly. 　　英文关键词??Key words: 　　 　　cryptographic algorithm; cryptographic procedure; cryptographic mode; key; cryptographic data??