TAINT INJECTION AND TRACKING
An embodiment or embodiments of an electronic device can comprise an input interface and a hardware component coupled to the input interface. The input interface can be operable to receive a plurality of taint indicators corresponding to at least one of a plurality of taints indicative of potential security risk which are injected from at least one of a plurality of resources. The hardware component can be operable to track the plurality of taints.
1 .- 64 . (canceled)
65 . An electronic device comprising:
at least one input interface operable to receive at least one data access request associated with at least one of a plurality of resources, the at least one data access request including at least one of read or write data access;
at least one taint vector including a plurality of vector positions configured for facilitating monitoring of one or more taints associated with the at least one data access request, wherein the plurality of vector positions includes at least (1) at least one position configured for describing the at least one of the plurality of resources, (2) at least one position configured for specifying at least one permission to access the at least one of the plurality of resources associated with the at least one data access request, and (3) at least one position configured for specifying at least one taint associated with one or more accesses of the at least one of the plurality of resources; and
circuitry configured for monitoring the one or more accesses of the at least one of the plurality of resources wherein the monitoring includes at least detecting the at least one taint and updating the at least one position configured for specifying at least one taint.
66 . The electronic device according to claim 65 wherein the at least one input interface operable to receive at least one data access request associated with at least one of a plurality of resources, the at least one data access request including at least one of read or write data access comprises:
at least one input interface operable to receive at least one data access request from at least one of processors, central processing units (CPUs), graphics hardware, network controllers, memory, memory management, hardware, microarchitecture, sound cards, video cards, network interfaces, instruction set architecture (ISA), library calls, library functions, software objects, compilers, or operating systems.
67 . The electronic device according to claim 65 wherein the plurality of resources comprises:
at least one of processors, central processing units (CPUs), graphics hardware, network controllers, memory, memory management, hardware, microarchitecture, sound cards, video cards, network interfaces, instruction set architecture (ISA), library calls, library functions, software objects, compilers, or operating systems.
68 . The electronic device according to claim 65 wherein the plurality of resources comprises:
at least one of memory portions. memory blocks, read-only memory, random access memory, non-volatile memory, or volatile memory.
69 . The electronic device according to claim 65 wherein the at least one taint vector including a plurality of vector positions configured for facilitating monitoring of one or more taints associated with the at least one data access request comprises:
at least one taint vector including a plurality of vector positions configured for facilitating monitoring of one or more taints associated with the at least one data access request, wherein the plurality of vector positions further includes at least one position configured for specifying at least one attribute of the requestor of the at least one data access request to access data associated with the at least one of a plurality of resources.
70 . The electronic device according to claim 65 wherein the at least one taint vector including a plurality of vector positions configured for facilitating monitoring of one or more taints associated with the at least one data access request comprises:
at least one taint vector including a plurality of vector positions configured for facilitating monitoring of one or more taints associated with the at least one data access request, wherein the plurality of vector positions further includes at least one position configured for specifying at least one granularity of the at least one of the plurality of resources.
71 . The electronic device according to claim 65 wherein the at least one taint vector including a plurality of vector positions configured for facilitating monitoring of one or more taints associated with the at least one data access request comprises:
at least one taint vector including a plurality of vector positions configured for facilitating monitoring of one or more taints associated with the at least one data access request, wherein the plurality of vector positions further includes at least one position configured for specifying at least one granularity of the at least one of the plurality of resources including at least specifying at least one start address and at least one end address.
72 . The electronic device according to claim 65 wherein the at least one taint vector including a plurality of vector positions configured for facilitating monitoring of one or more taints associated with the at least one data access request comprises:
at least one taint vector including a plurality of vector positions configured for facilitating monitoring of one or more taints associated with the at least one data access request, wherein the plurality of vector positions further includes at least one position configured for specifying at least one granularity of the at least one of the plurality of resources including at least specifying at least one of:
specifying a memory page;
specifying a byte;
specifying a word;
specifying a memory block;
specifying a hardware process identifier (PID);
allocating taints to enable a cross-thread taint;
allocating taints among hardware devices;
specifying a component; or
specifying a software component.
73 . The electronic device according to claim 65 wherein the at least one taint vector including a plurality of vector positions configured to facilitate monitoring of one or more taints associated with the at least one data access request associated with at least one of a plurality of resources, the at least one data access request including at least one of read or write data access comprises:
at least one taint vector including a plurality of vector positions configured to facilitate monitoring of one or more taints associated with the at least one data access request associated with at least one of a plurality of resources, the at least one data access request including at least one of read or write data access, wherein the plurality of vector positions further includes at least one position configured to specify at least one level of criticality associated with at least one taint associated with one or more accesses of the at least one of the plurality of resources.
74 . The electronic device according to claim 65 further comprising:
response circuitry configured for responding to the detection of the at least one taint wherein the responding is specified according to at least one level of criticality associated with at least one taint associated with one or more accesses of the at least one of the plurality of resources.
75 . The electronic device according to claim 65 further comprising:
response circuitry configured for responding to the detection of the at least one taint wherein the responding is specified according to a predetermined critical level of criticality associated with at least one taint associated with one or more accesses of the at least one of the plurality of resources and wherein the responding includes at least one of:
ignoring the at least one security risk event;
logging the at least one security risk event;
displaying a notification;
displaying a warning message; or
generating an alarm.
76 . The electronic device according to claim 65 further comprising:
response circuitry configured for responding to the detection of the at least one taint wherein the responding is specified according to a predetermined critical level of criticality associated with at least one taint associated with one or more accesses of the at least one of the plurality of resources and wherein the responding includes at least one of:
preventing a memory and/or register write;
modifying operating frequency;
modifying operating voltage;
modifying an operating parameter;
performing a system call;
calling a trap and/or exception;
terminating operation of selected resources; or
activating a system shutdown.
77 . The electronic device according to claim 65 further comprising:
response circuitry configured for responding to the detection of the at least one taint wherein the responding includes at least one of:
ignoring the at least one security risk event;
logging the at least one security risk event;
displaying a notification;
displaying a warning message;
generating an alarm;
preventing a memory and/or register write;
modifying operating frequency;
modifying operating voltage;
modifying an operating parameter;
performing a system call;
calling a trap and/or exception;
terminating operation of selected resources; or
activating a system shutdown.
78 . The electronic device according to claim 65 wherein the one or more taints associated with the at least one data access request associated with at least one of a plurality of resources include:
at least one of a null pointer reference, an attempt to access a secured part of a processor, an attempt to access a secured resource, a buffer overrun, an event originating in a region that raises suspicion, a fault, an integer overflow, a plurality of taint indicators that exceeds at least one predetermined threshold, a taint indicated by power law analysis, a taint indicated by a race function, or an attempt to access a key.
79 . The electronic device according to claim 65 wherein the one or more taints associated with the at least one data access request associated with at least one of a plurality of resources include:
at least one of a distinct affiliate, a system characteristic, a source, an event, an activity, metadata, or a condition.
80 . The electronic device according to claim 65 wherein the circuitry configured for monitoring the one or more accesses of the at least one of the plurality of resources including circuitry configured for detecting the at least one taint and circuitry configured for updating the at least one position configured for specifying at least one taint includes at least:
circuitry configured for monitoring the plurality of taints; and
circuitry configured for creating a trust profile based on the monitoring.
81 . The electronic device according to claim 65 wherein the circuitry configured for monitoring the one or more accesses of the at least one of the plurality of resources including circuitry configured for detecting the at least one taint and circuitry configured for updating the at least one position configured for specifying at least one taint comprises:
circuitry configured for detecting at least one violation of the specified at least one permission to access the at least one of the plurality of resources associated with the at least one data access request.
82 . The electronic device according to claim 65 wherein the circuitry configured for monitoring the one or more accesses of the at least one of the plurality of resources including circuitry configured for detecting the at least one taint and circuitry configured for updating the at least one position configured for specifying at least one taint comprises:
circuitry configured for detecting at least one violation of at least one of prohibitions of memory locations to which data is written, prohibitions of when program code is allowed to execute, prohibitions of how long writing is allowed, prohibitions of specified purposes to which data is written, or prohibitions of a number of times data is written.
83 . A method for operating an electronic device comprising:
receiving at least one data access request associated with at least one of a plurality of resources, the at least one data access request including at least one of read or write data access;
allocating at least one taint vector including a plurality of vector positions configured for facilitating monitoring of one or more taints associated with the at least one data access request, wherein the plurality of vector positions includes at least (1) at least one position configured for describing the at least one of the plurality of resources, (2) at least one position configured for specifying at least one permission to access the at least one of the plurality of resources associated with the at least one data access request, and (3) at least one position configured for specifying at least one taint associated with one or more accesses of the at least one of the plurality of resources; and
monitoring the one or more accesses of the at least one of the plurality of resources wherein the monitoring includes at least detecting the at least one taint and updating the at least one position configured for specifying at least one taint.
84 . An electronic device comprising:
at least one input interface operable to receive at least one data access request associated with at least one of a plurality of resources, the at least one data access request including at least one of read or write data access;
at least one taint vector including a plurality of vector positions configured for facilitating monitoring of one or more taints associated with the at least one data access request, wherein the plurality of vector positions includes at least (1) at least one position configured for describing the at least one of the plurality of resources, (2) at least one position configured for specifying at least one granularity associated with the at least one of the plurality of resources, and (3) at least one position configured for specifying at least one taint associated with one or more accesses of the at least one of the plurality of resources; and
circuitry configured for monitoring the one or more accesses of the at least one of the plurality of resources wherein the monitoring includes at least detecting the at least one taint and updating the at least one position configured for specifying at least one taint.