FlexiTaint: A programmable accelerator for dynamic taint propagation

Venkataramani, Guru; Doudalis, Ioannis; Solihin, Yan; Prvulovic, Milos

doi:10.1109/hpca.2008.4658637

Cited by 136 publications

(117 citation statements)

References 14 publications

Supporting

Mentioning

116

Contrasting

Order By: Relevance

“…These more frequently modified types of metadata arise in propagation-tracking (also known as dynamic information flow tracking [9][10][11] ) lifeguards such as MemCheck and TaintCheck, which propagate metadata states from sources to destinations on every instruction. Because each metadata update takes multiple instructions to perform, propagation tracking is a key source of lifeguard overhead.…”

Section: Propagation-style Metadata Updatesmentioning

confidence: 99%

“…To address this overhead, researchers have proposed several hardware optimizations, each tailored to a specific class of lifeguards: for example, memory-access monitoring, [6][7] data-race detection, 8 and information-flow tracking with simple metadata. [9][10][11] However, each of these mechanisms is useful only for the narrow class of lifeguards that it supports. Other studies have proposed more general-purpose hardware solutions.…”

Section: Instruction-grain Lifeguards Monitor Executing Programs At Tmentioning

confidence: 99%

“…Previous studies proposed hardware designs that extend processor pipelines to automatically access and propagate metadata along with the operations in the monitored program. [9][10][11] A fundamental limitation in these approaches is that because the hardware must understand metadata formats, simplifying assumptions about metadata must be made, so that the hardware supports only a single lifeguard or, at best, only a particular metadata size and organization. As a result, even simple modifications to lifeguards that perform well in their unmodified form, such as the addition of detailed tracking to TaintCheck, can reduce the lifeguard's performance from an acceptable level to a prohibitively low one.…”

Section: Inheritance Tracking For Propagation-style Metadata Updatesmentioning

confidence: 99%

See 2 more Smart Citations

Flexible Hardware Acceleration for Instruction-Grain Lifeguards

et al. 2009

View full text Add to dashboard Cite

Section: Propagation-style Metadata Updatesmentioning

confidence: 99%

Section: Instruction-grain Lifeguards Monitor Executing Programs At Tmentioning

confidence: 99%

Section: Inheritance Tracking For Propagation-style Metadata Updatesmentioning

confidence: 99%

See 1 more Smart Citation

Flexible Hardware Acceleration for Instruction-Grain Lifeguards

et al. 2009

View full text Add to dashboard Cite

“…FlexiTaint [35] and Raksha [9] generalize uniprocessor hardware support for information flow tracking (Note that Raksha prototypes full systems on FPGAs, while we use FPGAs as coprocessors for existing systems). Patil and Fischer in [23] describe an approach close to ours where the computation of an instrumented program is divided into a main thread and a shadow thread where the shadow thread could potentially execute on an idle core in a multiprocessor architecture.…”

Section: Related Workmentioning

confidence: 99%

Quantifying the Potential of Program Analysis Peripherals

Tiwari

Mysore

Sherwood

2009

2009 18th International Conference on Parallel Architectures and Compilation Techniques

View full text Add to dashboard Cite

Abstract-As programmers are asked to manage more complicated parallel machines, it is likely that they will become increasingly dependent on tools such as multi-threaded data race detectors, memory bounds checkers, dynamic dataflow trackers, and various performance profilers to understand and maintain their software. As these tools continue to grow in importance, it is worth exploring the potential for special purpose accelerators for these tasks, especially since commodity multi-cores can only provide limited speedups. Rather than performing all the instrumentation and analysis on the main processor, we explore the idea of using the increasingly highthroughput board level interconnect available on many systems to offload analysis to a parallel off-chip accelerator. There are many non-trivial technical issues in taking such an approach that may not appear in simulation, and to flush them out we have developed a prototype system that maps a DMA based analysis engine, sitting on a PCI-mounted FPGA, into the Valgrind instrumentation framework. Using this prototype we characterize the potential of such a system to both accelerate existing software development tools and enable a new class of heavyweight dynamic analysis. While many issues still remain with such an approach, we demonstrate that program analysis speedups of 29% to 440% could be achieved today with strictly off-the-shelf components on some of the state-of-the-art tools, and we carefully quantify the bottlenecks to illuminate several new opportunities for further architectural innovation.

show abstract

“…Hardware acceleration is thus an attractive alternative, especially in an era of cheap transistors. Many designs for hardware monitors have been proposed, with early designs focusing on enforcing single, hard-wired security policies [21], [22], [29], [71], [73], [79] and later ones evolving toward more programmable mechanisms [23], [31], [37], [38], [45], [70], [83] that allow quicker adaptation to a shifting attack landscape. Recent work has gone yet further in this direction by defining a generic, fully programmable hardware/software architecture for tag-based monitoring on a conventional processor extended with a Programmable Unit for Metadata Processing (PUMP) [39].…”

Section: Introductionmentioning

confidence: 99%

Micro-Policies: Formally Verified, Tag-Based Security Monitors

Amorim¹,

Dénès

Giannarakis

et al. 2015

2015 IEEE Symposium on Security and Privacy

View full text Add to dashboard Cite

Abstract-Recent advances in hardware design have demonstrated mechanisms allowing a wide range of low-level security policies (or micro-policies) to be expressed using rules on metadata tags. We propose a methodology for defining and reasoning about such tag-based reference monitors in terms of a high-level "symbolic machine," and we use this methodology to define and formally verify micro-policies for dynamic sealing, compartmentalization, control-flow integrity, and memory safety; in addition, we show how to use the tagging mechanism to protect its own integrity. For each micro-policy, we prove by refinement that the symbolic machine instantiated with the policy's rules embodies a high-level specification characterizing a useful security property. Last, we show how the symbolic machine itself can be implemented in terms of a hardware rule cache and a software controller.

show abstract

FlexiTaint: A programmable accelerator for dynamic taint propagation

Cited by 136 publications

References 14 publications

Flexible Hardware Acceleration for Instruction-Grain Lifeguards

Flexible Hardware Acceleration for Instruction-Grain Lifeguards

Quantifying the Potential of Program Analysis Peripherals

Micro-Policies: Formally Verified, Tag-Based Security Monitors

Contact Info

Product

Resources

About