# Dynamic Information Flow Tracking: Taxonomy, Challenges, and Opportunities
## 4 Software-Based Dynamic Information Flow Tracking
### System-Level Dynamic Information Flow Tracking  
[PERSON] et al. in [PERSON] et al. (2018) presented an operating system supporting information flow tracking. They tried to accomplish the following two goals: (i) reducing the amount of code that needs to be trusted; and (ii) separating the trusted function from untrusted functions. The tag design of their work is different from the common DIFT design, as their method assigns a tag for the basic kernel object type, e.g., thread, address space, segments, gates, containers and devices. The tag is checked and accompanied with the information flow between different objects. A _container_ is used to enforce access control and tag allocation on different objects. This work combines the information flowing tracking with operating system abstraction effectively. However, a new programming model is required to enforce security rules on target programs. [PERSON] et al. in [PERSON] et al. (2018) presented a new infrastructure for DIFT operations on CMPs. Supported by this infrastructure, the DIFT operations are performed in a helper thread and the target program runs on the main thread. This work uses a dynamic binary translator (DBT) to manage the helper thread and the main thread. The DBT is responsible for generating additional code in the main thread, and the helper thread is used for the communication between these two threads. The main thread communicates with the helper thread through the shared memory. Exceptions and interrupts are raised in the helper thread once any security rules are violated. This design introduces higher performance overhead for two reasons: an inter-thread communication overhead and the instructions required for DIFT operation. The helper thread needs to follow the main thread's control flow and only execute the DIFT-related instructions. Differently from the sequential DIFT tools in [PERSON] et al. (2018), [PERSON] et al. in [PERSON] et al. (2018) presented a parallelized DIFT framework to speed up the tag checking on CMPs. They adopted multiple worker (or helper) threads to check the tag in order to reduce the performance overhead. However, the serial dependencies need to be solved before executing DIFT operations. Their method tracks the tag symbolically rather than tracking the tag values. The tag symbols are saved temporarily in the symbolic inheritance table until the tag value can be determined explicitly. The binary operation presents a new challenge because each node relies on the tag value from two nodes. To solve the limitation, leveraging the log based architecture (LBA), a master thread is introduced to assign the task to worker threads and wait for the summary from worker threads. Additionally, every worker thread is responsible for the unary node. In addition to the software solution to solve inconsistency on data and its metadata, [PERSON] et al. in [PERSON] et al. (2018) used hardware to track the data and enforce the same ordering on metadata. Every instruction is assigned an ID shared between the main thread and the worker (or helper) thread. According to the ID, worker threads deal with the requests and follow the instruction order. Moreover, [PERSON] et al. in [PERSON] et al. (2018) decoupled the program and replayed the program in other cores. They used a function _fork_ to copy the runtime states of the program from the target core to other cores when a security check was executed. The target program can then be continued on other cores. Next, the security check operation was executed in the manner of speculative execution. The affected states can be rolled back once the security check fails. However, this method may introduce other speculation based attacks such as the Spectre [PERSON] et al. (2018). [PERSON] et al. in [PERSON] et al. (2018) proposed a whole system-level DIFT framework to resist in-memory injection attacks, which are difficult to be detected using current malware analysis solutions.