Taint injection and tracking

• US 9,298,918 B2
• Filed: 11/30/2011
• Issued: 03/29/2016
• Est. Priority Date: 11/30/2011
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Elwha LLC (Intellectual Ventures LLC)
• Inventors: Glew, Andrew F., Tegreene, Clarence T., Gerrity, Daniel A.
• Primary Examiner(s): Le, David
• Application Number:
  US13/373,832
• Publication Number:
  US 20130139262A1
• Time in Patent Office: 1,581 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

An embodiment or embodiments of an electronic device can comprise an input interface and a hardware component coupled to the input interface. The input interface can be operable to receive a plurality of taint indicators corresponding to at least one of a plurality of taints indicative of potential security risk which are injected from at least one of a plurality of resources. The hardware component can be operable to track the plurality of taints.

Claims

1. An electronic device comprising:

an input interface operable to receive a plurality of taint indicators corresponding to at least one of a plurality of taints injected from at least one of a plurality of resources;

at least one taint vector including a plurality of vector fields operable upon one or more instructions in parallel to track at least one taint of the plurality of taints; and

a hardware component coupled to the input interface and operable to track the plurality of taints.

2. The electronic device according to claim 1 wherein:

the input interface is operable to receive at least one taint indicator from a tagged system call associated with accessing information from a web page wherein an operating system injects a label originating from a browser at an identified site.

3. The electronic device according to claim 1 wherein:

the hardware component is operable to inject at least one taint of the plurality of taints when the at least one taint is known a priori to indicate an event and/or condition is suspected of at least one of propagating unsafe data or data received from an unsafe source.

4. The electronic device according to claim 1 further comprising:

monitoring logic operable to monitor the at least one taint vector and detect a predetermined taint condition wherein a predetermined condition of data is indicated.

5. The electronic device according to claim 1 further comprising:

monitoring logic operable to increment the at least one taint vector upon detection of a predetermined taint condition wherein a predetermined condition of data is indicated.

6. The electronic device according to claim 1 further comprising:

at least one taint vector including a plurality of vector fields operable one or more instructions in parallel to list at least one taint of a plurality of taints indicative of potential security risk of at least one of potentially unsafe data or data received from a potentially unsafe source originating from at least one of the plurality of resources; and

response logic operable to respond to a predetermined taint condition.

7. The electronic device according to claim 1 further comprising:

monitoring logic operable to monitor taints and create a trust profile based on the monitoring; and

response logic operable to trap to a software process based at least partly on determination of a suspicious condition.

8. The electronic device according to claim 1 further comprising:

monitoring logic operable to monitor taints in network input/output operations; and

response logic operable to trap to a software process based at least partly on determination of a network input/output condition of an attempt of malware to communicate to a malware operator.

9. The electronic device according to claim 1 further comprising:

monitoring logic operable to monitor taints using a hardware device; and

response logic operable to insert initial taint notifications using a software process.

10. The electronic device according to claim 1 further comprising:

response logic operable to respond to at least one security risk event with at least one of;

ignoring the at least one security risk event;

logging the at least one security risk event;

displaying a notification;

displaying a warning message;

generating an alarm;

preventing a memory and/or register write;

modifying operating frequency;

modifying operating voltage;

modifying an operating parameter;

performing a system call;

calling a trap and/or exception;

terminating operation of selected resources;

or

activating a system shutdown.

11. The electronic device according to claim 1 further comprising:

monitoring logic operable to accumulate the plurality of taint indicators independently using at least one of;

comparing one or more of the accumulated plurality of taint indicators to at least one predetermined threshold;

performing power law analysis;

performing a race function;

counting a number of taints;

counting a number of taints per memory unit;

counting a number of instructions tainted;

counting a number of tainted instructions;

counting a number of instructions written as a result of a taint;

counting a number of data loads and stores;

counting a number of memory accesses;

counting a number of calls;

counting a number of returns;

counting a number of branches;

counting a number of integer overflows;

counting a number of network input/output events;

counting a number of null pointer references;

counting a number of buffer overruns/overflows;

or

counting a number of repeated attempts to access a key.

12. The electronic device according to claim 1 further comprising:

monitoring logic operable to allocate taints at a selected granularity via at least one of;

allocating taints by memory page;

allocating taints by byte;

allocating taints by word;

allocating taints by memory block;

allocating taints by hardware process identifier (PID);

allocating taints to enable a cross-thread taint;

allocating taints among hardware devices;

allocating taints by component;

or

allocating taints by software component.

13. The electronic device according to claim 1 further comprising:

monitoring logic operable to acquire and monitor a history of the one or more of the at least one taint vector in a feedback loop that correlates taints with responses to the taints.

14. The electronic device according to claim 1 further comprising:

monitoring logic operable to apply at least one function to at least one entry of the at least one taint vector.

15. The electronic device according to claim 14 wherein:

the at least one function includes at least one of weights, masks, sums, combinations, arithmetic functions, logical operations, or transforms.

16. The electronic device according to claim 1 wherein at least one of the plurality of taints includes at least one of:

a null pointer reference;

an attempt to access a secured part of a processor;

an attempt to access a secured resource;

a buffer overrun;

an event originating in a region that raises suspicion;

a fault;

an integer overflow;

a plurality of taint indicators that exceeds at least one predetermined threshold;

a taint indicated by power law analysis;

a taint indicated by a race function;

an attempt to access a key;

or

information indicating a privacy violation.

17. The electronic device according to claim 1 wherein:

the plurality of taints comprise one or more of a plurality of distinct classes comprising a plurality of distinct affiliates, system characteristics, sources, events, activities, or conditions.

18. The electronic device according to claim 1 wherein the plurality of taints are injected by one or more of the plurality of resources including one or more of physical and/or logical instances of:

processors, central processing units (CPUs), graphics hardware, network controllers, memory, memory management, hardware, microarchitecture, sound cards, video cards, network interfaces, instruction set architecture (ISA), library calls, library functions, software objects, compilers, or operating systems.

19. The electronic device according to claim 1 wherein:

one or more of the plurality of taints are injected by a resource of the plurality of resources that is remote from the electronic device and at least one taint indicator corresponding to the injected one or more of the plurality of taints is communicated to the electronic device.

20. The electronic device according to claim 1 wherein:

one or more of the plurality of taints are injected by remote software that is remote from the electronic device and at least one taint indicator corresponding to the injected one or more of the plurality of taints is communicated to the electronic device.

21. The electronic device according to claim 1 wherein:

one or more of the plurality of taints are injected by a resource of the plurality of resources that is locally coupled to the electronic device and at least one taint indicator corresponding to the injected one or more of the plurality of taints is directly accessed by the electronic device.

22. The electronic device according to claim 1 wherein:

one or more of the plurality of taints are injected by local software that is local to the electronic device and at least one taint indicator corresponding to the injected one or more of the plurality of taints is directly accessed by the electronic device.

23. The electronic device according to claim 1 wherein:

one or more of the at least one taint vector are operable as an accumulator of a plurality of taint indicators indicative of potential security risk of at least one of potentially unsafe data or data received from a potentially unsafe source from a plurality of distinct sources at distinct times.

24. The electronic device according to claim 1 wherein:

one or more of the at least one taint vector comprises an entry that is allocated to selected one or more of the plurality of resources, wherein one or more taints of the selected one or more of the plurality of resources are federated to the entry.

25. The electronic device according to claim 1 wherein:

one or more of the at least one taint vector comprises a composite taint vector that correlates a taint source and a taint activity type.

38. The electronic device according to claim 1 wherein the hardware component comprises:

at least one timer register configured to change at a predetermined rate; and

at least one accumulator configured to update in a predetermined manner in response to receipt of the one or more of the plurality of taint indicators and in response to a predetermined condition of the at least one timer register.

39. The electronic device according to claim 1 wherein the hardware component comprises:

at least one accumulator configured into a plurality of portions that update independently according to distinct accumulation functions in response to receipt of the one or more of the plurality of taint indicators corresponding selectively to distinct taint conditions and sources.

40. The electronic device according to claim 1 wherein the hardware component comprises:

hardware threading circuitry configured for at least one of simultaneous multithreading (SMT) or hyperthreading operating upon the plurality of vector fields of the at least one taint vector in parallel using the one or more instructions; and

at least one accumulator configured into a plurality of portions that update independently according to distinct accumulation functions in response to receipt of the one or more of the plurality of taint indicators corresponding selectively to distinct threads executing on the hardware threading circuitry.

41. The electronic device according to claim 1 further comprising:

a processor coupled to the input interface and including at least the hardware component, the processor operable to execute one or more instructions in an instruction set architecture configured for at least one of simultaneous multithreading (SMT) or hyperthreading operating upon the plurality of vector fields of the at least one taint vector in parallel using the one or more instructions included in the instruction set architecture.

42. The electronic device according to claim 1 further comprising:

a processor coupled to the input interface and including at least the hardware component, the processor operable to execute one or more instructions in an instruction set architecture configured for hardware execution of one or more threads concurrently for at least one of simultaneous multithreading (SMT) or hyperthreading operating upon the plurality of vector fields of the at least one taint vector in parallel using the one or more instructions included in the instruction set architecture.

43. The electronic device according to claim 1 further comprising:

a processor coupled to the input interface and including at least the hardware component, the processor configured to execute the one or more instructions that operate upon the plurality of vector fields in the at least one taint vector in parallel to execute a thread hierarchy including a currently running list of threads and a pool of non-running threads, at least one of the plurality of vector fields operable to receive computational limit information for at least one of the plurality of resources.

44. The electronic device according to claim 1 further comprising:

a processor coupled to the input interface and including at least the hardware component, the processor configured to execute the one or more instructions that operate upon the plurality of vector fields in the at least one taint vector in parallel to set computational limits for at least one of a plurality of resources based at least in part on a priority level indicative of resource availability specified in at least one of the plurality of vector fields operable to receive computational limit information.

45. The electronic device according to claim 1 further comprising:

a processor coupled to the input interface and including at least the hardware component, the processor configured to execute the one or more instructions that operate upon the plurality of vector fields in the at least one taint vector in parallel to set computational limits for at least one of a plurality of resources based at least in part on a user-specified override configured to override computational limit information received from at least one of the plurality of resources, the user-specified override specified in at least one of the plurality of vector fields operable to receive computational limit information.

26. A method operable in a computing device for handling security risk comprising:

receiving a plurality of taint indicators corresponding to at least one of a plurality of taints injected from at least one of a plurality of resources;

executing one or more instructions that operate upon at least one taint vector including a plurality of vector fields;

operating upon the plurality of vector fields of the at least one taint vector in parallel using the one or more instructions; and

tracking at least one taint of the plurality of taints.

27. The method according to claim 26 further comprising:

receiving at least one taint indicator from a tagged system call associated with accessing information from a web page wherein an operating system injects a label originating from a browser at an identified site.

28. The method according to claim 26 further comprising:

injecting at a hardware component at least one taint of the plurality of taints when the at least one taint is known a priori to indicate an event and/or condition is suspicious.

29. The method according to claim 26 further comprising:

indicating potential security risk originating from at least one of the plurality of resources by at least one taint of the plurality of taints;

allocating the at least one taint of the plurality of taints in the at least one taint vector;

monitoring the at least one taint vector; and

detecting a predetermined taint condition wherein a predetermined condition of data is indicated.

30. The method according to claim 26 further comprising:

indicating potential security risk originating from at least one of the plurality of resources by at least one taint of the plurality of taints;

allocating the at least one taint of the plurality of taints in the at least one taint vector; and

incrementing the at least one taint vector upon detection of a predetermined taint condition wherein a predetermined condition of data is indicated.

31. The method according to claim 26 further comprising:

indicating potential security risk originating from at least one of the plurality of resources by at least one taint of the plurality of taints;

listing the at least one taint of the plurality of taints in the at least one taint vector; and

responding to a predetermined taint condition.

32. The method according to claim 26 further comprising:

monitoring at least one of the plurality of taints;

creating a trust profile based on the monitoring; and

trapping to a software process based at least partly on determination of a suspicious condition.

33. The method according to claim 26 further comprising:

monitoring at least one of the plurality of taints in one or more network input/output operations; and

trapping to a software process based at least partly on determination of a network input/output condition of an attempt of malware to communicate to a malware operator.

34. The method according to claim 26 further comprising:

monitoring at least one of the plurality of taints using a hardware device; and

inserting one or more initial taint notifications using a software process.

35. The method according to claim 26 further comprising:

responding to at least one security risk event with at least one of;

ignoring the at least one security risk event;

logging the at least one security risk event;

displaying a notification;

displaying a warning message;

generating an alarm;

preventing a memory and/or register write;

modifying operating frequency;

modifying operating voltage;

modifying an operating parameter;

performing a system call;

calling a trap and/or exception;

terminating operation of selected resources;

or

activating a system shutdown.

36. The method according to claim 26 further comprising:

accumulating the plurality of taint indicators independently using at least one of;

comparing one or more of the accumulated plurality of taint indicators to at least one predetermined threshold;

performing power law analysis;

performing a race function;

counting a number of taints;

counting a number of taints per memory unit;

counting a number of instructions tainted;

counting a number of tainted instructions;

counting a number of instructions written as a result of a taint;

counting a number of data loads and stores;

counting a number of memory accesses;

counting a number of calls;

counting a number of returns;

counting a number of branches;

counting a number of integer overflows;

counting a number of network input/output events;

counting a number of null pointer references;

counting a number of buffer overruns/overflows;

or

counting a number of repeated attempts to access a key.

37. A computing system comprising:

means for receiving a plurality of taint indicators corresponding to at least one of a plurality of taints injected from at least one of a plurality of resources;

means for executing one or more instructions that operate upon at least one taint vector including a plurality of vector fields;

means for operating upon the plurality of vector fields of the at least one taint vector in parallel using the one or more instructions; and

means for tracking one or more of the plurality of taints.