Downgrader Placement for Software Security Vulnerability Remediation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Static analysis tools face challenges in accurately determining the optimal placement of downgraders within computer software applications to remediate security vulnerabilities, as misplacement can leave vulnerabilities intact or introduce new issues, and existing methods often require excessive code changes.

Innovation Solution

A method is developed to construct and apply a downgrader specification that identifies candidate placement locations and downgraders within security-sensitive data flows, ensuring full coverage by eliminating unnecessary placements and adhering to specific criteria, such as distance from data input and security operations, to maximize code quality and maintainability.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If downgrader placement locations are determined manually or using simple heuristics, then code quality and maintainability are improved, but security vulnerability remediation coverage may be insufficient

Engineering Contradiction:

Improvesecurity vulnerability remediation coverageVSAvoidcode changes required

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system automatically identifies candidate downgrader placement locations by analyzing security-sensitive data flows and applying downgrader specifications, eliminating the need for manual placement decisions while ensuring comprehensive coverage of security vulnerabilities

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system provides feedback by identifying specific candidate placement locations and determining whether a downgrader specification provides full coverage, allowing developers to iteratively refine their downgrader specifications based on coverage results

Inventive Principle:

Principle #23Feedback

2Reliability

If multiple downgraders are placed throughout the code to ensure coverage, then security vulnerability remediation is improved, but code complexity and maintenance difficulty increase

Engineering Contradiction:

Improvesecurity vulnerability remediationVSAvoidcode maintainability

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system extracts and identifies specific candidate downgrader placement locations from the codebase by analyzing data flows, allowing developers to place downgraders only where necessary rather than throughout the entire codebase, thus maintaining security effectiveness while reducing code complexity

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system segments the codebase into security-sensitive data flows and identifies specific transition points within those flows as candidate placement locations, enabling targeted downgrader placement that maintains security coverage while minimizing interference with existing code structure

Inventive Principle:

Principle #1Segmentation

3Device complexity

If downgrader placement is optimized for minimal code changes, then code maintainability is improved, but risk of leaving vulnerabilities uncovered increases

Engineering Contradiction:

Improvenumber of code changesVSAvoidvulnerability coverage completeness

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The system automatically determines whether a downgrader specification provides full coverage by checking if at least one candidate placement location exists within each security-sensitive data flow, giving developers confidence that minimal code changes achieve complete vulnerability remediation

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system provides feedback on coverage completeness by determining whether the downgrader specification covers all security-sensitive data flows, allowing developers to verify that minimal code changes achieve full vulnerability remediation before deployment

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS11176248B2Remediation of security vulnerabilities in computer software

Publication Date: 2021.11.16 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Processing a downgrader specification by constructing a set of candidate downgrader placement locations found within a computer software application, where each of the candidate downgrader placement locations corresponds to a transition between a different pair of instructions within the computer software application, and where each of the transitions participates in any of a plurality of data flows in a set of security-sensitive data flows within the computer software application, applying a downgrader specification to the set of candidate downgrader placement locations, and determining that the downgrader specification provides full coverage of the set of security-sensitive data flows within the computer software application if at least one candidate downgrader placement location within each of the security-sensitive data flows is a member of the set of candidate downgrader placement locations.