Runtime Data Flow Integrity Enforcement via Intermediate Representation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cybersecurity solutions fail to protect against non-control data attacks, which can breach data confidentiality and integrity, as they primarily focus on control-data attacks and neglect the threat of pure data attacks.
Innovation Solution
A framework for runtime enforcement of data flow integrity is developed, where a processor translates application binaries into intermediate representation, applies data flow integrity controls, and adds instrumentation to prevent unauthorized data tampering, operating transparently and with minimal performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional cybersecurity solutions focus on control-data attacks, then control flow integrity is improved, but data confidentiality and integrity against non-control data attacks deteriorates
Solution Approach 1:
The patent segments the memory space into different protection domains by introducing data flow integrity controls that distinguish between control data and non-control data. The system implements separate integrity verification mechanisms for different data types, allowing control flow protection while adding non-control data attack prevention through data provenance tracking and flow-sensitive authorization.
2Reliability
If data flow integrity controls are applied at runtime, then data security is improved, but application performance deteriorates
Solution Approach 1:
The patent performs preliminary analysis of the application binary to construct data flow graphs and identify critical data paths before runtime execution. By pre-computing data flow relationships and marking sensitive data locations, the system reduces runtime overhead during actual execution, as the integrity verification can proceed with pre-established knowledge of legitimate data flows.
Solution Approach 2:
The patent replaces heavy mechanical inspection of every memory access with a more efficient flow-based authorization system. Instead of universally checking all memory operations, the system uses data flow graphs to track and authorize only critical data paths, substituting comprehensive mechanical verification with intelligent flow-based control that reduces performance impact.
3Adaptability or versatility
If proprietary ad hoc sandboxing is used, then application isolation is improved, but data separation within application deteriorates
Solution Approach 1:
The patent extends the sandboxing concept from application-level isolation to data-level segmentation within the application. By implementing data flow integrity controls that track and separate data based on its provenance and usage context, the system achieves both application isolation and internal data separation, preventing unauthorized data access even within the sandboxed environment.
Data Source
AI summary
Disclosed herein are embodiments of systems, methods, and products comprise a processor, which provides runtime enforcement of data flow integrity. The processor accesses the application binary file from the disk to execute an application and translates the application binary into intermediate representation. The processor applies the logic of data flow integrity controls to the intermediate representation. Specifically, the processor identifies the vulnerable code in the intermediate representation. The processor applies data flow integrity controls to the vulnerable code. The processor adds simple instrumentation that only changes the application's behavior when unauthorized data tampering occurs while preserving the application's normal behavior. When certain operations may cause unauthorized data tampering, the processor takes proper measures to stop the operations. The processor translates the intermediate representation back to a machine code and replaces the original binary with the machine code.