SandTrap: Tracking information flows on demand with parallel permissions

Conference Paper

The most promising way to improve the performance of dynamic information-flow tracking (DIFT) for machine code is to only track instructions when they process tainted data. Unfortunately, prior approaches to on-demand DIFT are a poor match for modern mobile platforms that rely heavily on parallelism to provide good interactivity in the face of computationally intensive tasks like image processing. The main shortcoming of these prior efforts is that they cannot support an arbitrary mix of parallel threads due to the limitations of page protections. In this paper, we identify parallel permissions as a key requirement for multithreaded, on-demand native DIFT, and we describe the design and implementation of a system called SandTrap that embodies this approach. Using our prototype implementation, we demonstrate that SandTrap’s native DIFT overhead is proportional to the amount of tainted data that native code processes. For example, in the photo-sharing app Instagram, SandTrap’s performance is close to baseline (1x) when the app does not access tainted data. When it does, SandTrap imposes a slowdown comparable to prior DIFT systems (∼8x).

Full Text

Duke Authors

Cited Authors

  • Razeen, A; Meijer, A; Lebeck, AR; Pistol, V; Liu, DH; Cox, LP

Published Date

  • June 10, 2018

Published In

  • Mobisys 2018 Proceedings of the 16th Acm International Conference on Mobile Systems, Applications, and Services

Start / End Page

  • 230 - 242

International Standard Book Number 13 (ISBN-13)

  • 9781450357203

Digital Object Identifier (DOI)

  • 10.1145/3210240.3210321

Citation Source

  • Scopus