Hardware Tagged Secure Data Compartments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for protecting sensitive data from unauthorized dissemination by third-party applications in cloud computing face challenges such as lack of access to source code, high performance overhead, and limited flexibility in policy enforcement, especially in detecting implicit information flows and preventing secondary dissemination of protected information.
Innovation Solution
A system and method that utilizes a software-hardware architecture to create secure data compartments with hardware tags, allowing unvetted applications to access data while enforcing confidentiality policies through dynamic information flow tracking, propagating tags across memory operations, and enforcing unbypassable output control without modifying the applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If binary translation or compiler-assisted binary re-writing is used to track information flow, then information flow tracking capability is improved, but performance overhead increases significantly
Solution Approach 1:
The patent replaces software-based information flow tracking (binary translation, compiler assistance) with hardware-based tracking using processor tags and circuit-level monitoring. This substitution eliminates the performance overhead of software interpretation while maintaining tracking capability through dedicated hardware mechanisms that operate transparently to the application.
Solution Approach 2:
The patent introduces hardware tags as intermediary markers attached to data in memory and registers. These tags serve as mediators that enable the system to track information flow without requiring software intervention or modification of application code, thereby avoiding performance penalties while maintaining security monitoring.
2Measurement precision
If hardware DIFT solutions are programmed with specific security policies, then detection capability for specific vulnerabilities is improved, but flexibility to detect other vulnerabilities deteriorates
Solution Approach 1:
The patent implements dynamic policy configuration capabilities where security policies can be modified, updated, or reconfigured without changing the underlying hardware architecture. The system allows flexible definition of security rules that can adapt to different vulnerability types and threat scenarios while maintaining efficient hardware-based enforcement.
Solution Approach 2:
The hardware tracking system is designed with universal applicability to detect multiple types of security vulnerabilities through a single unified mechanism. The tag-based architecture can enforce diverse security policies ranging from data classification to information flow control, making the system versatile across different security requirements without requiring separate specialized hardware for each vulnerability type.
3Measurement precision
If GLIFT hardware is re-designed from gates up to track information flow, then tracking precision is improved, but device complexity and implementation cost increase
Solution Approach 1:
The patent segments the information flow tracking functionality into modular components: tag generation units, tag propagation logic, tag checking mechanisms, and policy enforcement modules. This segmentation allows precise tracking at each stage of data processing while keeping individual components simple and manageable, avoiding the need for complete hardware redesign.
Solution Approach 2:
The system performs preliminary tagging of data at memory allocation and assignment stages, before data processing occurs. This preliminary action embeds tracking information in advance, allowing precise tracking throughout the data lifecycle without requiring complex real-time analysis or gate-level redesign of processing logic.
Data Source
AI summary
Disclosed is a system comprising a physical memory, a processor and a software component. The software component includes a policy/domain handler for receiving data and a policy associated with the data; a hypervisor; and a file management module. The file management module receives a request from a third-party application to interact with a data file containing the data; sends an authorization and tag request to the policy/domain handler to check if the user and application are permitted to access the data, and if permitted, to generate hardware tags for the data file; and sends a secure data request to the hypervisor to create a secure data compartment for the data file and the hardware tags. Based on the authorization and tag request, and the security policy associated with the data, the policy/domain handler generates the hardware tags for the data file. Based on the secure data request, the hypervisor creates in the physical memory a secure data compartment containing the data file and the hardware tags, the hypervisor associating the hardware tags with the data in the secure data compartment. As the data is operated upon and moved to other memory areas, the hardware tags are propagated with the data according to tag propagation rules, and checked before performing operations that may lead to security breaches.