Secure Program Execution Via Dynamic Information Flow Tracking

Abstract

We present a simple architectural mechanism called dynamicinformation flow tracking that can significantly improve thesecurity of computing systems with negligible performanceoverhead. Dynamic information flow tracking protects programs against malicious software attacks by identifying spurious information flows from untrusted I/O and restrictingthe usage of the spurious information.Every security attack to take control of a program needsto transfer the program’s control to malevolent code. Inour approach, the operating system identifies a set of inputchannels as spurious, and the processor tracks all information flows from those inputs. A broad range of attacks areeffectively defeated by checking the use of the spurious values as instructions and pointers.Our protection is transparent to users or application programmers; the executables can be used without any modification. Also, our scheme only incurs, on average, a memoryoverhead of 1.4% and a performance overhead of 1.1%.