Security Tag and Reference Count Batching for Runtime Overhead Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current runtime monitoring techniques for information flow security in software systems are excessively computationally intensive due to the need to mirror all program operations, resulting in significant runtime overhead, and have not effectively addressed how to aggregate dynamic checks or utilize hardware transactional memory for information flow security violations.
Innovation Solution
A system and method that utilize modified variants of standard reference counting and deferred reference counting automatic memory management to aggregate information flow security checks by deferring them while maintaining necessary bookkeeping, reducing computational and memory overhead through spatial and temporal locality of access, and combining security tag updates with reference count updates for efficient monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional runtime monitoring techniques are used to mirror all program operations for information flow security, then security monitoring completeness is improved, but runtime overhead increases significantly
Solution Approach 1:
The patent segments the monitoring process by dividing memory into regions with different security tags and grouping reference count updates into batches. Instead of monitoring every individual operation, the system divides the monitoring task into manageable segments that can be processed efficiently, reducing the overall runtime overhead while maintaining security monitoring completeness.
Solution Approach 2:
The patent performs preliminary actions by pre-calculating and batching reference count updates before they are needed. The system prepares security tag updates and reference count modifications in advance, so that when actual memory operations occur, the monitoring overhead is minimized. This preliminary preparation allows the system to maintain complete security monitoring without the performance penalty of real-time processing of every operation.
2Measurement precision
If all program operations are mirrored in lockstep to maintain soundness of information flow tracking, then tracking accuracy is improved, but computational intensity increases
Solution Approach 1:
The patent merges multiple reference count updates into single batched operations. Instead of processing each reference count change separately in lockstep with program execution, the system combines multiple updates into aggregated operations that maintain tracking accuracy while significantly reducing computational intensity. This merging approach allows the system to preserve soundness without the linear overhead of individual operation mirroring.
Solution Approach 2:
The patent implements periodic action by batching reference count updates at specific intervals rather than continuously mirroring every operation. The system accumulates reference count changes and processes them periodically in bulk operations, maintaining tracking accuracy through structured batch processing while reducing computational intensity compared to continuous lockstep monitoring.
3Reliability
If extensive operation mirroring is performed to enforce information flow security, then security enforcement completeness is improved, but runtime performance deteriorates
Solution Approach 1:
The patent performs preliminary actions by pre-computing security tag updates and reference count modifications before they are applied to memory operations. The system prepares the necessary security enforcement data in advance, allowing actual memory operations to proceed with minimal overhead. This preliminary preparation ensures complete security enforcement while preserving runtime performance by avoiding real-time computation during critical execution paths.
Solution Approach 2:
The patent segments security enforcement into discrete, manageable units based on memory regions and object types. By dividing the enforcement task into segmented operations that can be processed independently and efficiently, the system maintains complete security coverage while improving runtime performance through optimized segment-level processing rather than monolithic operation mirroring.
4Manufacturing precision
If reference counting and security tag updates are performed separately for each memory operation, then operational accuracy is improved, but system complexity increases
Solution Approach 1:
The patent merges reference counting and security tag updates into unified batched operations. Instead of maintaining separate processing paths for reference counts and security tags, the system combines these operations into integrated batches that process both types of updates together. This merging reduces system complexity by eliminating redundant processing infrastructure while maintaining operational accuracy through coordinated batch processing of both reference counts and security tags.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Described is a system and method for monitoring and enforcing information Sow security in software systems. The system maintains security tags and reference counts for objects in computer memory. When an object or a portion of an object in the computer memory Is being modified, the system arbitrarily performs operations of updating a security tag for the object being modified; updating reference counts for all objects that the portion of the object in the computer memory being modified pointed to immediately prior to modification; and updating reference counts for all objects that the portion of the object in the computer memory being modified points to immediately after the modification. Subsequently, the system examines the security tags and If the examination reveals a potential information flow security violation, a corrective action is performed.