Dynamic Security Policy Analyzer for Application Permission Accuracy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current static code analyzers overestimate the required permissions for accessing external resources, leading to unnecessary permissions being granted to applications, especially in secure environments, as they consider the entire application rather than the specific parts executed by the user, resulting in inefficient and inaccurate security policy management.
Innovation Solution
A dynamic code analysis system that records and analyzes execution data to determine a 'perfect-fit' security policy, which can then be compared to existing policies to identify a 'best-fit' policy, allowing for more restrictive permissions without affecting application functionality, and suggests changes to the source code to refine the security policy iteratively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static code analyzers are used to determine security permissions, then security issues can be detected earlier in the development cycle, but the required permissions are overestimated because the entire application is considered rather than only the executed parts
Solution Approach 1:
The system performs preliminary static code analysis to identify potential security issues and required permissions, then refines these results through dynamic execution monitoring to achieve accurate permission determination
Solution Approach 2:
The system uses feedback from dynamic execution monitoring to correct and refine the permission requirements initially identified by static code analysis, creating an iterative improvement process
2Reliability
If the entire application is considered for security permissions, then all potential security issues are covered, but unnecessary permissions are granted leading to excessive resource exposure
Solution Approach 1:
The system segments the application into executed and non-executed parts by monitoring actual runtime behavior, then applies security permissions only to the relevant executed segments rather than the entire application
Solution Approach 2:
The system extracts and identifies the specific code paths and components that are actually executed during runtime, separating them from the rest of the application to apply targeted security permissions
3Reliability
If multiple custom security policies are created to achieve accurate permissions, then application security is improved, but policy management complexity increases
Solution Approach 1:
The system creates a universal security policy determination mechanism that automatically adapts to different applications based on their executed code, eliminating the need for multiple custom policies
Data Source
AI summary
System and method for accurately determining security policy for an application based on dynamic code analysis of application runtime execution(s). A dynamic recorder, dynamic code analyzer and security policy analyzer can evaluate and determine the security decisions and access to secure resources made during a security event within one or more executions of an application in order to identify an existing security policy that best matches an application's security needs. Security events may be analyzed to determine which security decisions and access to secure resources are necessary and which can be eliminated or replaced with alternative decisions or resources.