Value-based information flow tracking in software packages

1. A computer-implemented method of improving the computer security of a device, the device housing one or more sensors and a digital processor, the method comprising:

automatically capturing one or more sensor readings from one of the sensors of the device;

storing in cache memory data values of the captured one or more sensor readings, the cache memory storing the data values in a collection of sensitive data;

evaluating a data flow from the one sensor to a numerical operation being performed by the digital processor, said evaluating the data flow determining whether numerical values involved in performance of the numerical operation are included in the collection of sensitive data, wherein the numerical operation has a numerical computation; and

based upon outcome of the determining, preventing one or more data values of the collection of sensitive data from being transmitted from a sink of the device, wherein the preventing is further based on recency of the numerical values involved in performance of the numerical operation being included in the collection of sensitive data.

2. The computer-implemented method of claim 1 , wherein:

the numerical operation includes arithmetic operations, and the numerical values involved include operands and return values of the arithmetic operations;

the evaluating determines whether one or more representations of the operands and return values of the arithmetic operations are included in the collection of sensitive data by directly comparing the one or more representations to the data values of the collection of sensitive data; and

the preventing is further based upon outcome of the determining of the one or more representations.

3. The computer-implemented method of claim 1 , wherein the storing is performed in response to one or more security policies.

4. The computer-implemented method of claim 1 , wherein the determining is performed while the data flow is being accessed and processed.

5. The computer-implemented method of claim 1 , wherein the sink includes any of a network socket, a file, or a message.

6. The computer-implemented method of claim 1 , wherein at least one of:

the device is a mobile device, an embedded controller, a desktop computer, a laptop computer, or a computer processing device; and

the cache memory is configured as any of a ring buffer, a value table, and an array.

7. The computer-implemented method of claim 1 , further comprising:

reporting a violation based upon the determining; and

in response to the reported violation, performing the preventing of one or more values of the collection of sensitive data from being transmitted from the sink of the device.

8. The computer-implemented method of claim 1 , wherein the one or more sensors generate numerical values, and the one sensor is any of: an accelerometer, a gyroscope, an ambient light sensor, a microphone, a global positioning system (GPS), and a heart rate sensor.

9. The computer-implemented method of claim 1 , wherein the one sensor generates sensitive data and/or generates data values from which an inference of interest can be calculated.

10. A computer system, comprising:

a digital processor;

a cache memory;

a data module executable by the digital processor and automatically capturing one or more sensor readings from a sensor housed in a device;

the data module storing in the cache memory data values of the captured one or more sensor readings, the cache memory holding the data values in a collection of sensitive data; and

a computing module executable by the digital processor, and evaluating a data flow from the sensor to a numerical operation being performed by a processor of the device, the evaluating determining whether numerical values involved in performance of the numerical operation are included in the collection of sensitive data, wherein the numerical operation has a numerical computation; and

based upon outcome of the determining, the computing module preventing one or more data values of the collection of sensitive data from being transmitted from a sink of the device, wherein the preventing is further based on recency of the numerical values involved in performance of the numerical operation being included in the collection of sensitive data.

11. The computer system of claim 10 , wherein:

the numerical operation includes arithmetic operations, and the numerical values involved include operands and return values of the arithmetic operations; and

the computing module further determines whether one or more representations of the operands and return values of the arithmetic operations are included in the collection of sensitive data by directly comparing the one or more representations to the data values of the collection of sensitive data, and the preventing by the computing module is further based upon outcome of the determining of the one or more representations.

12. The computer system of claim 10 , wherein the data module stores the data values in the cache memory in response to one or more security policies.

13. The computer system of claim 10 , wherein the computing module is executed while the data flow is being accessed and processed by processors of the device.

14. The computer system of claim 10 , wherein the sink includes any of a network socket, a file, or a message.

15. The computer system of claim 10 , wherein at least one of:

the device is a mobile device, an embedded controller, a desktop computer, a laptop computer, or a computer processing device; and

the cache memory is configured as any of a ring buffer, a value table, and an array.

16. The computer system of claim 10 , wherein the computing module further generates and outputs a report reporting a violation based upon the determining.

17. The computer system of claim 10 , wherein the sensor generates numerical values and includes any of: an accelerometer, a gyroscope, an ambient light sensor, a microphone, a global positioning system (GPS), and a heart rate sensor.

18. The computer system of claim 10 , wherein the sensor generates sensitive data and/or generates data values from which an inference of interest can be calculated.

19. A computer program product comprising:

a non-transitory computer-readable storage medium having code instructions stored thereon such that, when executed by a digital processor, the code instructions cause the digital processor to:

automatically capture one or more sensor readings from a sensor housed in a device;

store in cache memory data values of the captured one or more sensor readings in a collection of sensitive data;

evaluate a data flow from the sensor to a numerical operation being performed by a processor of the device, the evaluating determining whether numerical values involved in performance of the numerical operation are included in the collection of sensitive data, wherein the numerical operation has a numerical computation; and

based upon outcome of the determining, prevent one or more data values of the collection of sensitive data from being transmitted from a sink of the device, wherein the preventing is further based on recency of the numerical values involved in performance of the numerical operation being included in the collection of sensitive data.

20. The computer program product of claim 19 , wherein:

the numerical operation includes arithmetic operations, and the numerical values involved include operands and return values of the arithmetic operations; and

the digital processor further determines whether one or more representations of the operands and return values of the arithmetic operations are included in the collection of sensitive data by directly comparing the one or more representations to the data values of the collection of sensitive data, and the preventing by the digital processor is further based upon outcome of the determining of the one or more representations.