Disassembling Authorized Code Services for Security Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Authorized services in computing environments face challenges in maintaining system integrity and confidentiality due to unauthorized programs potentially bypassing integrity checks and violating system confidentiality, integrity, or availability.
Innovation Solution
A method is disclosed for generating an input set by analyzing the instruction data of a software program to determine where specific input registers are referenced and determining their usage, which includes comparing, copying, or referencing storage values. This information is used to generate arrays describing possible or valid parameters for security vulnerability testing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security testing methods are used on authorized services, then security vulnerabilities can be detected, but the testing process requires extensive time and computational resources
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing parameter usage information, valid parameter values, and usage patterns in a database before actual security testing occurs. The system analyzes authorized service code, determines parameter usage, and prepares test input sets in advance, so that during actual vulnerability testing, pre-computed data can be quickly retrieved and applied without performing complex analysis in real-time
Solution Approach 2:
The patent uses copying by creating simplified representations of the authorized service's parameter usage patterns. Instead of analyzing the complete authorized service code during testing, the system copies essential information (parameter names, valid values, usage patterns) into a separate data structure that can be efficiently queried and used for generating test inputs without re-analyzing the original code
2Reliability
If comprehensive security testing is performed on authorized services, then security vulnerabilities can be identified, but the complexity of the testing system increases
Solution Approach 1:
The patent applies segmentation by dividing the security testing system into distinct modular components: (1) code analysis module that extracts parameter usage information, (2) database module that stores pre-computed parameter data and valid values, (3) test input generation module that creates test cases, and (4) vulnerability detection module that executes tests. Each module performs a specific function and can be independently developed, maintained, and optimized
Solution Approach 2:
The patent introduces an intermediary database structure that mediates between the authorized service code and the security testing logic. This database stores pre-analyzed parameter information, valid parameter values, and usage patterns, serving as an intermediary layer that simplifies the interaction between the testing system and the authorized service, reducing the complexity of direct code analysis during testing
Data Source
AI summary
Embodiments of the present disclosure provide methods, systems, and computer program products for generating an input set for implementing security vulnerability testing of a software programs for authorized services. Object code of the software program is received, and the object code is disassembled to identify instructions. The instructions are analyzed to determine where specific input registers are referenced. Usage of values stored in the specific input registers when the software program is executed is determined for at least one of comparing against the values stored in the specific input registers for test or conditional branch logic, copying the values stored in the specific input registers, or referencing storage at a location defined by the values in the specific input registers. One or more arrays describing values of one or more possible or valid parameters are generated based on the usage to provide the input set.