US 12,008,373 B1 · Instance instrumentation for different data sources

Abstract

Instance instrumentation is provided for different data sources by identifying an instance of a function in a program that receives input from an untrusted source; and replacing, at runtime of the program, the instance of the function with an instrumented version of the function that includes a marking function to indicate an output of the instrumented version of the function is tainted by the input received from the untrusted source. Additionally, instance instrumentation can be provided by identifying a second instance of the function in the program that does not receive input from the untrusted source; and leaving, at runtime of the program, the second instance of the function alone, wherein the second instance of the function is not replaced with the instrumented version of the function.

Claims20

Dependent claims

A method, comprising:

identifying a first instance of a function in a program that receives tainted input data from an untrusted source, the first instance of the function being a subset of all instances of the function;
and
replacing, during runtime of the program, the first instance of the function receiving the tainted input data, being the subset of all the instances of the function, with an instrumented version of the function that calls a marking function that indicates an output of the instrumented version of the function includes the tainted input data received from the untrusted source.

A non-transitory computer readable medium including instructions that when executed by a processor perform an operation, comprising:

identifying a first instance of a function in a program that receives tainted input data from a given source of a given type associated with a first classification of data, the first instance of the function being a subset of all instances of the function;
and
replacing, during runtime of the program, the first instance of the function receiving the tainted input data, being the subset of all the instances of the function, with an instrumented version of the function that calls a marking function that indicates an output of the instrumented version of the function carries data of the first classification affected by the tainted input data received from the given source to thereafter also be classified according to the first classification.

Dependencies are inferred from the claim text.

Facts

Application

17/450,564Filed 12 Oct 2021 · us provisional application

Priority

12 Oct 2020

Granted

11 Jun 2024

Term ends

Not estimatedThe source records don’t support an estimate.

Classification5 codes

G06F 9/3017
Arrangements for executing machine instructions, e.g. instruction decode: runtime instruction translation, e.g. macros
G06F 9/44521
Program loading or initiating: dynamic linking or loading; Link editing at or after load time, e.g. Java class loading
G06F 21/51
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: at application…
G06F 21/54
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by adding security routines or objects to programs

Instance instrumentation for different data sources

Life of this patent

Instance instrumentation for different data sources

Life of this patent

Abstract

Claims20