Taint Tracking Mechanism for Software Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security techniques for computational systems are inadequate in detecting and preventing attacks that exploit vulnerabilities in software, such as buffer overflow attacks, as they often require binary-rewriting or source code analysis, and are not practical for widespread implementation due to the need for CPU modifications or operating system redesigns.
Innovation Solution
Implementing taint tracking mechanisms that propagate taint status for memory locations in correspondence with information flows, allowing for security responses when restricted uses occur, without requiring modifications to CPU hardware or operating systems, using instrumented execution modes and virtualization systems to track and manage tainted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If taint tracking is implemented using binary-rewriting or source code analysis, then security detection capability is improved, but device complexity and ease of operation deteriorate
Solution Approach 1:
The patent introduces a virtual machine monitor as an intermediary layer between the untrusted software and the host system. This mediator intercepts and monitors software executions, tracking taint status of data without requiring modifications to the software being monitored. The virtual machine monitor acts as a transparent observer that can detect security violations while leaving the monitored software unchanged, thus avoiding the complexity of binary-rewriting or source code analysis.
2Reliability
If CPU modifications or operating system redesigns are performed to implement security techniques, then security reliability is improved, but ease of manufacture and adaptability deteriorate
Solution Approach 1:
The patent segments the computing system into distinct layers: the host system, the virtual machine monitor, and the untrusted software. By isolating the security monitoring functionality in the virtual machine monitor layer, the solution avoids modifying the underlying CPU hardware or operating system. This segmentation allows existing systems to run unmodified while providing security monitoring through the intermediate virtualization layer, thus maintaining adaptability and compatibility.
3Measurement precision
If comprehensive taint tracking is implemented for all memory locations and registers, then measurement precision of tainted data is improved, but use of energy and device complexity worsen
Solution Approach 1:
The patent implements taint tracking selectively rather than universally. The virtual machine monitor tracks taint status for data that flows through monitored software executions, focusing on data that may be relevant to security attacks. The system maintains taint information in a efficient manner, tracking only the necessary data paths and memory locations involved in the monitored execution, thus reducing the computational overhead and energy consumption compared to comprehensive tracking of all system state.
Data Source
AI summary
A system that includes a memory and processor is provided. The processor is programmed to receive input data, determine that the input data is tainted, store the tainted input data in a location in the memory, and based on storing the tainted input data in the location, label the location as a tainted location. The processor is further programmed to assign a triggering event to the tainted location such that an action is initiated when the triggering event has occurred.