A method to eliminate random number misjudgments in multi-variant execution
Ruicheng Xi, Zheng Zhang, Zijing Liu, Pengzhe Zhu · 2022
Multi-variant Execution (MVX) technology can effectively resist various types of memory leak attacks. Since it was proposed in 2006, after years of development, as an active defense method, it is widely used in cyberspace security. in defense. The multi-variant execution technology distributes the program input to multiple functions through distribution agents, executes executions with different structures in parallel, sets up voting points, and detects whether it is attacked by comparing the output results of the executions of the executions by the monitor. When the multi-variant execution technology is applied to the actual scene, there will be some wrong judgments. For example, the execution body is not attacked, but because the execution bodies are isolated from each other and executed in parallel, random numbers will be generated when the execution body executes the program. These random numbers are included in the output results and are sent to the monitor for voting. Based on the consistency judgment voting, the monitor compares the output results to determine that the execution results are inconsistent, and the misjudgment system is attacked.A multi-variant system is modified by multi-variant execution technological. Such misjudgments are called misjudgment of random numbers. This paper summarizes and analyzes the voting misjudgment caused by random numbers in the multi-variant system, points out the reasons for the misjudgment of random numbers, lists common use cases, summarizes the previous solutions and ideas, and proposes a method to use the file system to synchronize random numbers. Experiments have shown that this method can effectively reduce the misjudgment of random numbers in multi-variant systems and improve the availability of multi-variant systems.