Automated Code Analysis Tool with Identity Manager
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Automated code analysis tools face challenges in analyzing application code without executing it, particularly in verifying user identity and security status of resources accessed, which is crucial for ensuring the security and integrity of applications.
Innovation Solution
An automated code analysis tool that analyzes application code and application-specific additional information without executing it, using methods to determine how application-specific information is implemented and querying an identity manager to verify user identity and security status of resources, thereby providing an application-specific context for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated code analysis tools analyze application code without executing it, then analysis efficiency is improved, but the ability to verify user identity and security status of resources is worsened
Solution Approach 1:
The patent introduces an identity manager as an intermediary component that bridges the static analysis tool and the application's security context. The identity manager receives queries from the analysis tool about user identities and security statuses, and returns verified information without requiring full application execution. This mediator enables the analysis tool to obtain accurate security verification data while maintaining the efficiency benefits of static analysis.
2Adaptability or versatility
If automated code analysis tools focus on general code analysis, then analysis coverage is improved, but application-specific security context verification is worsened
Solution Approach 1:
The patent implements preliminary action by having the analysis tool query the identity manager in advance during the static analysis phase. Instead of waiting for runtime execution to verify security contexts, the tool proactively queries user identities, access permissions, and resource security statuses before analyzing the code. This preliminary verification of security context enables precise application-specific analysis while maintaining broad code coverage.
Data Source
AI summary
An automatic code analysis tool is disclosed. The automatic code analysis tool can automatically analyze an application code of a subject application and application-specific additional information of a resource used by the subject application. The automatic code analysis tool can implement a method to receive the application code for analysis. A determination is made as to how application-specific information from resources operably coupled to the application code is implemented via the application code. The determination is performed with an automatic analysis without running the application code.