# US 12,008,373 B1 · Instance instrumentation for different data sources > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,373 B1 - Document ID: US12008373B1 - Status: Granted - Kind: B1 - Application number: 17/450,564 - Filed: 2021-10-12 - Granted: 2024-06-11 - Earliest claimed: 2020-10-12 - Assignees: Synopsys, Inc. - Applicants: Synopsys, Inc. - Inventors: Allon Mureinik; Niv Mamam - Web page: https://patentgrep.com/patent/US12008373B1 ## CPC - G06F 9/3017: {Runtime instruction translation, e.g. macros} - G06F 9/44521: {Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/54: by adding security routines or objects to programs - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Instance instrumentation is provided for different data sources by identifying an instance of a function in a program that receives input from an untrusted source; and replacing, at runtime of the program, the instance of the function with an instrumented version of the function that includes a marking function to indicate an output of the instrumented version of the function is tainted by the input received from the untrusted source. Additionally, instance instrumentation can be provided by identifying a second instance of the function in the program that does not receive input from the untrusted source; and leaving, at runtime of the program, the second instance of the function alone, wherein the second instance of the function is not replaced with the instrumented version of the function. ## Claims ### Claim 1 A method, comprising: identifying a first instance of a function in a program that receives tainted input data from an untrusted source, the first instance of the function being a subset of all instances of the function; and replacing, during runtime of the program, the first instance of the function receiving the tainted input data, being the subset of all the instances of the function, with an instrumented version of the function that calls a marking function that indicates an output of the instrumented version of the function includes the tainted input data received from the untrusted source. ### Claim 2 (depends on 1) The method of claim 1, further comprising: identifying a second instance of the function in the program that only receives trusted input data from trusted sources; and maintaining, during runtime of the program, the second instance of the function as an un-instrumented version of the function without marking the trusted input data. ### Claim 3 (depends on 1) The method of claim 1, further comprising: identifying a downstream instance of a second function in the program that only receives inputs from trusted sources and does receive input from the instrumented version of the function; and replacing, at runtime of the program, the downstream instance of the second function with a second instrumented version of the second function that includes the marking function to indicate a second output of the downstream instance of the second function was affected by the tainted input data received from the untrusted source. ### Claim 4 (depends on 1) The method of claim 1, wherein a status checking function is prevented from being called when the first instance of the function receiving the tainted input data is selectively replaced with the instrumented version of the function. ### Claim 5 (depends on 1) The method of claim 1, wherein a plurality of instances of the function are identified and replaced with the instrumented version of the function. ### Claim 6 (depends on 1) The method of claim 1, further comprising: identifying an instance of a second function in the program that receives input from a second untrusted source; and replacing, at runtime of the program, the instance of the second function with an instrumented version of the second function that includes the marking function to indicate an output of the instrumented version of the second function is tainted by the input received from the second untrusted source. ### Claim 7 (depends on 1) The method of claim 1, further comprising: identifying an instance of a second function in the program that receives input from a given source providing input data that are confidential; and replacing, at runtime of the program, the instance of the second function with an instrumented version of the second function that includes a second marking function that indicates when an output of the instrumented version of the second function is affected by the input data received from the given source to thereafter also be confidential. ### Claim 8 A non-transitory computer readable medium including instructions that when executed by a processor perform an operation, comprising: identifying a first instance of a function in a program that receives tainted input data from a given source of a given type associated with a first classification of data, the first instance of the function being a subset of all instances of the function; and replacing, during runtime of the program, the first instance of the function receiving the tainted input data, being the subset of all the instances of the function, with an instrumented version of the function that calls a marking function that indicates an output of the instrumented version of the function carries data of the first classification affected by the tainted input data received from the given source to thereafter also be classified according to the first classification. ### Claim 9 (depends on 8) The non-transitory computer readable medium of claim 8, wherein the operation further comprises: identifying a second instance of the function in the program that does not receive input from the given source; and leaving, at runtime of the program, the second instance of the function alone, wherein the second instance of the function is not replaced with the instrumented version of the function. ### Claim 10 (depends on 8) The non-transitory computer readable medium of claim 8, the operation further comprises: identifying a downstream instance of a second function in the program that does not receive input from the given source and does receive input from the instrumented version of the function; and replacing, at runtime of the program, the downstream instance of the second function with a second instrumented version of the second function that includes the marking function to indicate a second output of the downstream instance of the second function was affected by the tainted input data received from the given source. ### Claim 11 (depends on 8) The non-transitory computer readable medium of claim 8, wherein a status checking function is prevented from being called when the first instance of the function receiving the tainted input data is selectively replaced with the instrumented version of the function. ### Claim 12 (depends on 8) The non-transitory computer readable medium of claim 8, wherein the operation further comprises: identifying an instance of a second function in the program that receives second input data from a second source of the given type; and replacing, at runtime of the program, the instance of the second function with an instrumented version of the second function that includes the marking function to indicate an output of the instrumented version of the second function carries data of the first classification as being affected by the second input data received from the second source to thereafter also be classified according to the first classification. ### Claim 13 (depends on 8) The non-transitory computer readable medium of claim 8, further comprising: identifying an instance of a second function in the program that receives input from a second source of a second type associated with a second classification of data unrelated to the first classification; and replacing, at runtime of the program, the instance of the second function with an instrumented version of the second function that includes a second marking function to indicate an output of the instrumented version of the second function is affected by the input received from an untrusted source to thereafter also be classified according to the second classification. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein an instance of a third function receives input from the instance of the function and the instance of the second function, the operation further comprising: replacing, at runtime of the program, the instance of the third function with an instrumented version of the third function that includes the marking function and the second marking function to indicate an output of the instrumented version of the third function is affected by inputs received from the given source and the second source to thereafter also be classified according to the first classification and the second classification. ### Claim 15 A system, comprising: a processor; and a memory including computer-readable instructions that when executed by the processor enable performance of an operation comprising: identifying a first instance of a function in a program that receives tainted input data from an untrusted source, the first instance of the function being a subset of all instances of the function; and replacing, during runtime of the program, the first instance of the function receiving the tainted input data, being the subset of all the instances of the function, with an instrumented version of the function that calls a marking function that indicates an output of the instrumented version of the function includes the tainted input data received from the untrusted source. ### Claim 16 (depends on 15) The system of claim 15, the operation further comprising: identifying a second instance of the function in the program that does not receive input from the untrusted source; and leaving, at runtime of the program, the second instance of the function alone, wherein the second instance of the function is not replaced with the instrumented version of the function. ### Claim 17 (depends on 15) The system of claim 15, the operation further comprising: identifying a downstream instance of a second function in the program that does not receive input from the untrusted source and does receive input from the instrumented version of the function; and replacing, at runtime of the program, the downstream instance of the second function with a second instrumented version of the second function that includes the marking function to indicate a second output of the downstream instance of the second function was affected by the input received from the untrusted source. ### Claim 18 (depends on 15) The system of claim 15, wherein a status checking function is prevented from being called when the first instance of the function receiving the tainted input data is selectively replaced with the instrumented version of the function. ### Claim 19 (depends on 15) The system of claim 15, the operation further comprising: identifying an instance of a second function in the program that receives input from a second untrusted source; and replacing, at runtime of the program, the instance of the second function with an instrumented version of the second function that includes the marking function to indicate an output of the instrumented version of the second function is tainted by the input received from the second untrusted source. ### Claim 20 (depends on 15) The system of claim 15, wherein the marking function indicates one of more of a bi-modal status and a multi-modal status for data processed by the function.