Dynamic, non-invasive taint tracking using auto-generated datatypes

Patent metadata

Field	Value
Publication number	US-10783243-B2
Application number	US-201815862347-A
Country	US
Kind code	B2
Filing date	Jan 4, 2018
Priority date	Jan 4, 2018
Publication date	Sep 22, 2020
Grant date	Sep 22, 2020

Abstract

Systems and methods are provided herein for dynamic, non-invasive taint tracking using auto-generated datatypes. A proxy entry point component of a taint-aware environment continuously monitors for a request to initiate an application. The application has an associated runtime environment and profile parameters specific to the application. Upon identifying the request, a core component of the taint-aware environment generates a set of augmented classes based on the profile parameters. The set of augmented classes contains taint-tracking functionality. The proxy entry point component modifies an initiation pathway of the application to force the runtime environment to retrieve the set of augmented classes prior to execution of the application. The runtime environment continuously monitors for tainted data or tainted code passed through or contained within the application based on the taint-tracking functionality of the set of augmented classes.

First claim

What is claimed is:

1. A method implemented by one or more data processor forming one or more computing devices, the method comprising:
continuously monitoring, at a proxy entry point component of a taint-aware environment, for a request to initiate an application, the application having an associated runtime environment and profile parameters specific to the application;
upon identifying the request, generating, by a core component of the taint-aware environment, a set of augmented classes comprising application specific strings for the application based on the profile parameters, the set of augmented classes containing taint-tracking functionality;
modifying, by the proxy entry point component, an initiation pathway of the application to force the runtime environment to retrieve the set of augmented classes prior to execution of the application; and
continuously monitoring, by the runtime environment, for tainted data or tainted code passed through or contained within the application based on the taint-tracking functionality of the set of augmented classes, wherein the tainted data or the tainted code comprise one or more tainted strings identified based on the application specific strings.

2. The method of claim 1 , further comprising:
identifying, by the runtime environment, tainted data or tainted code based on the taint-tracking functionality of the set of augmented classes; and
remedying, by the runtime environment, the tainted data or the tainted code by at least one of providing a user alert on a graphical user interface, preventing the application from executing, or injecting identification data into the tainted data or the tainted code to flag the presence of the tainted data or the tainted code.

3. The method of claim 1 , wherein the set of augmented classes includes system class code or non-system class code.

4. The method of claim 1 , further comprising modifying, by an agent component of the taint-aware environment, the non-system class code using byte-code instrumentation to include the taint-tracking functionality.

5. The method of claim 1 , wherein the set of augmented classes are identified by an application-specific instrumentation profile.

6. The method of claim 1 , wherein the core component interfaces with a template component containing stanzas to generate the set of augmented classes using stored string templates.

7. The method of claim 1 , wherein the taint tracking functionality identifies the tainted data or the tainted code at a character level.

8. The method of claim 1 , wherein the application further includes at least one command line parameter provided by a user of the application.

9. The method of claim 1 , wherein the application specific strings are bundled as an archive package for class lookup during initialization of the application.

10. A system comprising:
at least one data processor;
memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
continuously monitoring, at a proxy entry point component of a taint-aware environment, for a request to initiate an application, the application having an associated runtime environment and profile parameters specific to the application;
upon identifying the request, generating, by a core component of the taint-aware environment, a set of augmented classes comprising application specific strings for the application based on the profile parameters, the set of augmented classes containing taint-tracking functionality;
modifying, by the proxy entry point component, an initiation pathway of the application to force the runtime environment to retrieve the set of augmented classes prior to execution of the application; and
continuously monitoring, by the runtime environment, for tainted data or tainted code passed through or contained within the application based on the taint-tracking functionality of the set of augmented classes, wherein the tainted data or the tainted code comprise one or more tainted strings identified based on the application specific strings.

11. The system of claim 10 , wherein the operations further comprise:
identifying, by the runtime environment, tainted data or tainted code based on the taint-tracking functionality of the set of augmented classes; and
remedying, by the runtime environment, the tainted data or the tainted code by at least one of providing a user alert on a graphical user interface, preventing the application from executing, or injecting identification data into the tainted data or the tainted code to flag the presence of the tainted data or the tainted code.

12. The system of claim 10 , wherein the set of augmented classes includes system class code or non-system class code.

13. The system of claim 10 , wherein the operations further comprise modifying, by an agent component of the taint-aware environment, the non-system class code using byte-code instrumentation to include the taint-tracking functionality.

14. The system of claim 10 , wherein the set of augmented classes are identified by an application-specific instrumentation profile.

15. The system of claim 10 , wherein the core component interfaces with a template component containing stanzas to generate the set of augmented classes using stored string templates.

16. The system of claim 10 , wherein the taint tracking functionality identifies the tainted data or the tainted code at a character level.

17. The system of claim 10 , wherein the application further includes at least one command line parameter provided by a user of the application.

18. The system of claim 10 , further comprising an in-memory database storing the memory storing instructions.

19. A non-transitory computer-programmable product including storing instructions which, when executed by at least one data processor forming part of at least computing system, result in operations comprising:
continuously monitoring, at a proxy entry point component of a taint-aware environment, for a request to initiate an application, the application having an associated runtime environment and profile parameters specific to the application;
upon identifying the request, generating, by a core component of the taint-aware environment, a set of augmented classes comprising application specific strings for the application based on the profile parameters, the set of augmented classes containing taint-tracking functionality;
modifying, by the proxy entry point component, an initiation pathway of the application to force the runtime environment to retrieve the set of augmented classes prior to execution of the application; and
continuously monitoring, by the runtime environment, for tainted data or tainted code passed through or contained within the application based on the taint-tracking functionality of the set of augmented classes, wherein the tainted data or the tainted code comprise one or more tainted strings identified based on the application specific strings.

20. The non-transitory computer-programmable product of claim 19 , wherein the operations further comprise:
identifying, by the runtime environment, tainted data or tainted code based on the taint-tracking functionality of the set of augmented classes; and
remedying, by the runtime environment, the tainted data or the tainted code by at least one of providing a user alert on a graphical user interface, preventing the application from executing, or injecting identification data into the tainted data or the tainted code to flag the presence of the tainted data or th

Assignees

• Sap Se

Inventors

• Loch Florian
• Johns Martin

Classifications

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F3/0622

  in relation to access · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title