# Dynamic Information Flow Tracking: Taxonomy, Challenges, and Opportunities
## 5 Software and Hardware Co-Design-Based Dynamic Information Flow Tracking  
In this section, we will discuss the hardware and software co-design DIFT framework. This type of design combines the features of both software DIFT and hardware DIFT. Using the binary instrumentation and modified compiler, the hardware and software co-design DIFT framework can provide flexible security rule configuration and fine-grained protection. Meanwhile, the dedicated hardware logic is used to reduce the software performance overhead significantly. Furthermore, the target program can be protected at runtime through cooperation between software and hardware. [PERSON] et al. in [31] used binary instrumentation and architectural support to enforce information flow security policies at runtime. The conventional ISA is translated into information-flow security (IFS) ISA through the dedicated binary translator. Every instruction in the standard ISA has a corresponding instruction in IFS ISA. Every instruction in IFS ISA is assigned extra security registers to hold the tag. The IFS ISA space is divided into four basic types, i.e., ALU, store, load and branch. The semantic of the standard ISA does not change. Additionally, the information flow check is performed in parallel with the standard instruction. For implicit flow, the binary translator appends the security registers of branches to the possible operands of all instructions that may use the values influenced by the branch. [PERSON] et al. in [32] presented a new infrastructure to solve the coherence issue between normal data and metadata processing. The processor core, coprocessor and memory hierarchy are modified in this new infrastructure to enforce metadata coherence. A coherence unit is added to track all data access events on the shared bus from the processor core. Furthermore, the access from multi-cores is synchronized in the coherence unit. However, this design introduces high complexity compared to the hardware DIFT design. [PERSON] et al. in [33] proposed a flexible and programmable tag-based architecture model for security policy customization. The security policy is defined as a function mapping between the input set and output set under a specified operation. The security policy is enforced at the level of instructions to enforce memory safety, control-flow integrity, data flow integrity and separation between code and data. Meanwhile, the enforcement of security policy includes the collaboration between symbolic rules in the software layer and concrete rules in the hardware layer. Furthermore, the security policy customized by software developers can express the security policy using abstract symbolic tags. In addition, this architecture supports multiple orthogonal policies at the same time because the rules can be achieved by pointers to the tag tuples. [PERSON] et al. in [34] analyzed the temporal locations of DIFT operations on tagged data in regard to two features: (i) the number of instructions manipulating tagged data and (ii) the duration of taint-free epochs. They found the distribution of tag access across memory and the accuracy of coarse-grained tags may influence the DIFT design. Based on these observations, they used the feature of strong temporal locality to design a lightweight, coarse-grained DIFT hardware module. The dedicated DIFT module receives the committed instructions from the pipeline. Then, the DIFT-related operations are finished in the dedicated hardware module. The dedicated hardware module can be combined with software DIFT on the single-core and multi-core platform to significantly reduce the performance overhead. The dedicated hardware module will also reduce the hardware overhead. However, it is difficult to apply this framework to general computing platforms. The different access behavior of the program may introduce false positive rates. Additionally, coarse-grained designs may not provide enough protection for the target program. [PERSON] et al.