Instruction set adapted for security risk monitoring

• US 20130081134A1
• Filed: 09/24/2011
• Published: 03/28/2013
• Est. Priority Date: 09/24/2011
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Elwha LLC (Intellectual Ventures LLC)
• Inventors: Glew, Andrew F., Gerrity, Daniel A., Tegreene, Clarence T.
• Granted Patent: US 8,955,111 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A processor is adapted to manage security risk by updating and monitoring a taint storage element in response to receipt of taint indicators, and responding to predetermined taint conditions detecting by the monitoring. The processor can be operable to execute instructions of a defined instruction set architecture and comprises an instruction of the instruction set architecture operable to access data from a source and operable to receive a taint indicator indicative of potential security risk associated with the data. The processor can further comprise a taint storage element operable for updating in response to receipt of the taint indicator and logic. The logic can be operable to update the taint storage element, process the taint storage element, determine a security risk condition based on the processing of the taint storage element, and respond to the security risk condition.

Claims

1. A processor operable to execute instructions of a defined instruction set architecture comprising:

an instruction of the instruction set architecture operable to access data from a source and operable to receive a taint indicator indicative of potential security risk associated with the data;

a taint storage element operable for updating in response to receipt of the taint indicator; and

logic operable to update the taint storage element, process the taint storage element, determine a security risk condition based on the processing of the taint storage element; and

respond to the security risk condition.

2. The processor according to claim 1 wherein:

the instruction of the instruction set architecture is operable to access the data is operable to perform at least one operation of a group of operations including reading, moving, performing arithmetic operations, performing logical operations, inputting, comparing, popping, rotating, shifting.

3. The processor according to claim 1 wherein:

the source is at least one of a group consisting of a memory element, a memory page, memory block, a register, a port receiving data from a remote source, and a stack.

4. The processor according to claim 1 further comprising:

an instruction of the instruction set architecture operable to pass the data to a destination and operable to associate a taint indicator aspect based on the taint indicator and/or the processed taint storage element with the destination.

5. The processor according to claim 4 wherein:

the instruction of the instruction set architecture operable to pass the data is operable to perform at least one operation of a group of operations including storing, writing, moving, and outputting.

6. The processor according to claim 4 wherein:

the destination is at least one of a group consisting of a memory element, a memory page, memory block, a register, a port for sending to a remote destination, and a stack.

7. The processor according to claim 1 wherein:

the logic operable to update the taint storage element, process the taint storage element, determine a security risk condition based on the processing of the taint storage element; and

respond to the security risk condition is operable to trap to software in response to the security risk condition.

8. The processor according to claim 1 further comprising:

an instruction of the instruction set architecture specified to store to a predetermined memory address that stores to a hash of the predetermined memory address.

9. The processor according to claim 1 further comprising:

a memory taint hash table;

wherein;

the logic is operable to use the memory taint hash table to indicate a level of taint per memory block.

10. The processor according to claim 9 wherein:

the logic is operable to access the memory taint hash table, and indicate a level of taint per memory block using the memory taint hash table.

11. The processor according to claim 1 further comprising:

an instruction of the instruction set architecture specified to operate on data at a destination that passes a taint indicator aspect based on the taint indicator and/or the processed taint storage element associated with the destination.

12. The processor according to claim 11 wherein:

the instruction of the instruction set architecture operable to operate on the data is operable to perform at least one operation of a group of operations including storing, writing, moving, and outputting.

13. The processor according to claim 11 wherein:

the destination is at least one of a group consisting of a memory element, a memory page, memory block, a register, a port for sending to a remote destination, and a stack.

14. The processor according to claim 1 wherein:

the taint storage element is operable for updating in response to receipt of a plurality of taint indicators indicative of potential security risk associated with information used by the processor.

15. The processor according to claim 1 wherein:

the taint storage element is operable for updating in response to receipt of a plurality of taint indicator indicative of potential security risk from a plurality of distinct sources at distinct times; and

the logic is operable to accumulate the plurality of taint indicator independently using a corresponding plurality of distinct accumulation functions and assess the security risk condition according to a risk assessment function that is cumulative of the plurality of taint indicator.

16. The processor according to claim 15 wherein:

the logic is operable to accumulate the plurality of taint indicator on a basis selected from a group consisting of per-source, per-data, overall, and combination.

17. The processor according to claim 15 wherein:

the logic is operable to assess whether information from a particular source or entity is trusted based on assessment of the security risk condition.

18. The processor according to claim 15 wherein:

the logic is operable to accumulate the plurality of taint indicator independently using ones of the plurality of accumulation functions are selected from a group consisting of;

comparing ones of the accumulated plurality of taint indicator to at least one predetermined threshold;

performing power law analysis;

performing a race function;

counting a number of taints;

counting a number of taints per memory unit;

counting a number of instructions tainted;

counting a number of tainted instructions;

counting a number of instructions written as a result of a taint;

counting a number of data loads and stores;

counting a number of memory accesses;

counting a number of calls;

counting a number of returns;

counting a number of branches;

counting a number of integer overflows;

counting a number of network input/output events;

counting a number of null pointer references;

counting a number of buffer overruns/overflows; and

counting a number of repeated attempts to access a key.

19. The processor according to claim 15 wherein:

the logic is operable to accumulate the plurality of taint indicator comprising counting taint indicator affiliated with a plurality of entities per affiliation and merge a low level for a plurality of affiliations up to a higher level.

20. The processor according to claim 1 wherein:

the taint storage element is operable in a federated system comprising a least a first entity and a second entity for updating in response to receipt of a plurality of taint indicator; and

the logic is operable to track at least one of the plurality of taint indicator of the first entity against at least one of the plurality of taint indicator of the second entity.

21. The processor according to claim 1 wherein:

the logic is operable to define a plurality of pathways through a federated system, track sources of information through the federated system, and pass information of a specified pathway of the plurality of pathways through a validator.

22. The processor according to claim 1 wherein:

the logic is operable to form a trust profile using the accumulated plurality of taint indicator, dynamically raise and lower trust level of the trust profile based on the accumulated plurality of taint indicator, and respond to security risk in response to the trust level.

23. The processor according to claim 1 wherein:

the logic is operable to track a taint indicator characterized by a range of taintedness from potentially suspicious to definite taints.

24. The processor according to claim 1 wherein:

the instruction of the instruction set architecture is operable to receive taint indicator from a tagged system call associated with accessing information from a web page wherein an operating system injects a label indicating originating from a browser at an identified site.

25. The processor according to claim 1 wherein:

the logic is operable to allocate taints at a selected granularity selected from a group consisting of;

allocating taints by memory page;

allocating taints by byte;

allocating taints by word;

allocating taints by memory block;

allocating taints by hardware process identifier (PID);

allocating taints to enable a cross-thread taint;

allocating taints among hardware devices;

allocating taints by component; and

allocating taints by software component.

26. The processor according to claim 1 wherein:

the logic is operable to tracking taints using hardware devices, and insert initial taint notifications using software components.

27. The processor according to claim 1 wherein:

the logic is operable to determine whether to ignore one or more taint indicator, and log occurrences of the ignored one or more taint indicator in a ignore problems taint vector.

28. The processor according to claim 1 wherein:

the taint storage element comprises a plurality of bit fields of a taint vector corresponding to plurality of sources, events, activities, and/or conditions; and

the logic is further operable to assign a plurality of taint indicator indicative of potential security risk to the bit fields of the taint vector, and monitor the plurality of sources, events, activities, and/or conditions over time using the taint vector.

29. The processor according to claim 28 wherein:

the instruction of the instruction set architecture is operable to receive the plurality of taint indicator from a plurality of distinct sources at distinct times; and

the logic is operable to accumulate the plurality of taint indicator in the bit fields of the taint vector independently using a corresponding plurality of distinct accumulation functions, and assess the security risk condition according to a risk assessment function that is cumulative of the plurality of taint indicator.

30. The processor according to claim 28 wherein:

the logic is operable to monitor comparisons selected from a group consisting of;

determining whether any elements are greater than a predetermined threshold;

determining whether all elements are greater than a predetermined threshold;

determining whether the sum of some elements is greater than a predetermined threshold; and

determining whether the sum of all elements is greater than a predetermined threshold.

31. The processor according to claim 28 further comprising:

an instruction of the instruction set architecture operable to specify a plurality of decay options corresponding to the plurality of taint indicator according to information type; and

a decay control element operable to control delay of the plurality of taint indicator according the specified decay options;

wherein;

the logic is operable to apply the decay options to the bit fields of the taint vector.

32. The processor according to claim 31 wherein:

the instruction of the instruction set architecture operable to specify a plurality of decay options is operable to specify at least one of a plurality of decay options selected from a group consisting of;

applying decay after a predetermined number of operations to avoid triggering on outlying events;

setting decay to account for rare and spurious events with a probability of occurrence by chance during long term monitoring;

incrementing/decrementing using a single vector;

subtracting a predetermined number;

shifting a taint vector in an interval of time;

shifting a taint vector at a predetermined instruction count;

shifting a taint vector at a predetermined processor cycle count;

copying a taint vector periodically to memory to maintain an old version while incrementing/decrementing to enable restoration following an invalid or error condition;

imposing decay that balances accumulation;

applying decay periodically;

applying decay with a varying period that varies based on a sensitivity meter;

applying decay with a varying period that varies based on environment;

applying decay with a varying period that varies based on activity type; and

applying decay according to a programmable parameter at a programmable rate.

33. The processor according to claim 28 wherein:

the logic is operable to detect at least one security risk event as a result of monitoring the plurality of sources, events, activities, and/or conditions; and

respond to security risk in response to determination of the at least one security risk event.

34. The processor according to claim 33 wherein the logic is operable to respond to determination of the at least one security risk event with a response selected from a group consisting of:

ignoring the at least one security risk event;

logging the at least one security risk event;

displaying a notification;

displaying a warning message;

generating an alarm;

preventing a memory and/or register write;

modifying operating frequency;

modifying operating voltage;

modifying an operating parameter;

performing a system call;

calling a trap and/or exception;

terminating operation of selected resources; and

activating a system shutdown.

35-46. -46. (canceled)

47. A processor operable to execute instructions of a defined instruction set architecture comprising:

an instruction of the instruction set architecture specified to store to a predetermined memory address that stores to a hash of the predetermined memory address; and

logic operable to compute a hash of the predetermined memory address and store to the hash of the predetermined memory address.

48-49. -49. (canceled)

50. A processor operable to execute instructions of a defined instruction set architecture comprising:

an instruction of the instruction set architecture specified to operate on data at a destination that passes a taint indicator aspect associated with the destination;

a taint storage element operable for updating in response to receipt of a taint indicator; and

logic operable to process the taint storage element, derive the taint indicator aspect based on the taint indicator and/or the processed taint storage element associated with the destination, and pass the taint indicator aspect.

51-104. -104. (canceled)