Code analysis tool for recommending encryption of data without affecting program semantics

Abstract

Systems, methods and computer program products are described that analyze the code of an application and, based on the analysis, identify whether data elements (e.g., columns) referenced by the code can be encrypted, and for those data elements that can be encrypted, recommend an encryption scheme. The recommended encryption scheme for a given data element may be the highest level of encryption that can be applied thereto without affecting the semantics of the application code. The output generated based on the analysis may not only include a mapping of each data element to a recommended encryption scheme, but may also include an explanation of why each recommendation was made for each data element. Such explanation may include, for example, an identification of the application code that gave rise to the recommendation for each data element.

Description

Background technique [0001] As more and more data is stored digitally, data leakage is getting more and more attention. For example, for applications that use cloud services to manage sensitive and business-critical information, data leakage may be the main deterrent. On the public cloud, applications must guard against potential malicious cloud administrators, malicious co-tenants, and other entities that can gain access to data through various legal means. Since the computing and storage platform itself cannot be trusted, any data in plaintext anywhere on the cloud platform (on disk, memory, or on the transmission line) must be considered vulnerable to leakage or malicious destruction. In industries such as finance, banking, and healthcare, compliance requirements mandate strong protection against these types of threats. However, existing security solutions such as Transparent Data Encryption (TDE) and Transport Layer Security (TLS) only protect data at rest and in transit, ...

AI Technical Summary

Problems solved by technology

Determining the strongest encryption scheme that can be applied to each database column can be very difficult to achieve for the reasons discussed abo

Images