Automatic Downgrader Correction for Software Vulnerability Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security analysis tools assume the correctness of user-implemented security downgraders, which are often applied incorrectly, leading to incomplete or ineffective protection against vulnerabilities in software applications.

Innovation Solution

An automatic method and system that disregards existing user-provided downgraders to detect vulnerable flows, locates candidate downgraders, determines their effectiveness, and transforms them by adding validating or sanitizing steps to ensure complete protection against vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If user-provided downgraders are used to protect against vulnerabilities, then security protection is provided, but the correctness and completeness of protection cannot be verified

Engineering Contradiction:

Improvesecurity protectionVSAvoidverification of downgrader correctness

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent implements a feedback mechanism where the security analyzer verifies the correctness of downgraders by checking if they actually prevent identified vulnerability flows. The system provides feedback about whether downgraders are working correctly and automatically adjusts or removes insufficient downgraders based on this verification results.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent performs preliminary verification of downgraders during the security analysis process itself, before final security assessment. The system checks whether downgraders correctly prevent vulnerability flows as part of the initial analysis, rather than relying on assumed correctness.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If security analysis verifies downgrader correctness, then protection effectiveness is improved, but analysis complexity and time increase

Engineering Contradiction:

Improvedowngrader effectivenessVSAvoidsecurity analysis system

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies partial verification by focusing only on the specific vulnerability flows identified in the program, rather than verifying all possible execution paths. The system performs excessive analysis only where needed - on flows that pass through downgraders - leaving other parts of the system unchanged.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent segments the security analysis into distinct phases: initial vulnerability flow identification, downgrader verification on specific flows, and selective adjustment of downgraders. This segmentation allows the complex verification task to be broken into manageable parts that can be performed efficiently.

Inventive Principle:

Principle #1Segmentation

3Measurement precision

If existing downgraders are disregarded to detect vulnerable flows, then complete vulnerability detection is achieved, but false positives may occur

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoidfalse positive vulnerability reports

Core Design Contradiction:

Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

The patent uses an inverted approach by first performing security analysis while disregarding user-provided downgraders to identify all potential vulnerability flows, then subsequently verifying which of these flows are actually blocked by the downgraders. This inversion allows the system to start with complete detection and then filter out false positives.

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS8990949B2Automatic correction of security downgraders

Publication Date: 2015.03.24 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Methods and systems for automatic correction of security downgraders includes performing a security analysis that disregards existing user-provided downgraders to detect flows that are vulnerable; locating candidate downgraders on the flows; determining whether each of the candidate downgraders protects against all vulnerabilities associated with each downgrader's respective flow; and transforming candidate downgraders that do not protect against all of the associated vulnerabilities, such that the transformed downgraders do protect against all of the associated vulnerabilities.