# Cloud Security Using Fine-Grained Efficient Information Flow Tracking
## 5 Data Leak Prevention Using CloudMonitor
### The Information Flow Tracking Mechanism  
The CloudMonitor framework observes computational actions made on values of sensitive data at the machine instruction level and publishes labels accordingly. The framework supports operations involving the combination of values of multiple (usually two) unique operands by merging the input label values. Label merging is a core function that generates a fresh data label by combining the policies specified by the input labels. Given a pair of labels \(L1=p1\) and \(L2=p2\), where \(p1\) and \(p2\) represent arbitrary policy sets, the merge operator (denoted \(\bigoplus\)) produces a new label corresponding to the union of the input policy sets: \(L1\oplus L2=p1\cup p2\). New label A contains the policy sets of \(p1\) and the policy sets of \(p2\) (A = \(p1\cup p2\)). This definition of label merging eliminates the danger of information leakage caused by computations expressed using binary operators. The resultant label specifies the least restrictive secrecy policy while enforcing all limitations on the input operands utilized in the computation. Thus, CloudMonitor scrutinizes all clearly defined data movements originating from variable assignments and mathematical operations in the current design. We also monitor indirect flows resulting from pointer dereferencing, in which utilizing the value of sensitive data as a foundation pointer or an offset to access another value in memory. The CloudMonitor does not handle implicit channels that result from the dependency of control flow, like when a labeled value affects a conditional branch. Such enforcement is extremely difficult to appropriately identify these runtime dependencies without previous static analysis at the source code level. Next, we explain the concept of instruction-level label tracking and highlight the distinction between explicit and implicit information channels using numerous simple examples. Figure 9 depicts the C-language and assembly-language implementations of the simple function compute sum. This function receives two integer inputs and returns their total, as suggested by its name. Assume that the input variables (\(a\) and \(b\)) are contaminated with the relevant data labels \(La\) and \(Lb\). At the instruction level, CloudMonitor monitors the computation and propagates the following labels when this operation is conducted within the CloudMonitor-managed environment. The first instruction moves the previous stack base pointer value (register \(epp\)) into the stack. In the IFT context, \(epp\) is a control register that typically does not include sensitive user information. Therefore, we do not monitor the labels' propagation into this register and presume that its contents are always non-sensitive. Consequently, this instruction transfers a four-byte value that is not sensitive to the top of the stack, and CloudMonitor removes the sensitivity label linked with the appropriate memory address: \(Leme[esp+(0\dots 3)]\to L\phi\). The instruction at location +0x3 moves ebp from the stack into \(edx\), and CloudMonitor assigns the label \(Lb\) to \(edx\) to track its effects: \(Lex\to Lb\). Likewise, the following instruction propagates the label \(La\) to \(eax:Leax\to La\). The final instruction at position +0x9 computes the total by adding the value in \(edx\) to the contents of \(eax\), then CloudMonitor updates the register labels by merging the labels of the two input operands: \(Leax\gets Leax\oplus Ledx\). The final two instructions restore control to the caller by restoring the values of \(epp\) and \(eip\) from the stack. Since CloudMonitor does not monitor the flow of data through these registers, no further action is required. Figure 10 demonstrates the implementation of a fundamental table lookup operation and the publication of data labels by dereferencing the pointer. Assume the table contains sensitive values marked with \(Lt\) and the input parameter (table index) is contaminated with \(Li\).