Obfuscated Code Analysis for Confidential Deficiency Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software code analysis methods expose proprietary code to third parties, risking unauthorized access and legal or business risks due to potential copyright, trademark, and vulnerability issues.
Innovation Solution
A code checking system analyzes user software code for deficiencies using obfuscated data structures, such as Bloom filters, without accessing the raw code, identifying issues like licenses and vulnerabilities by comparing obfuscated user code with reference data structures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If software code is sent to a third party for analysis, then deficiencies can be identified, but code confidentiality is compromised
Solution Approach 1:
The system creates a copy of the software code and analyzes the copy instead of the original. A code representation is generated from the submitted code, and this representation is what gets stored and analyzed in the database, not the actual proprietary code itself. This allows deficiency detection while preserving code confidentiality.
Solution Approach 2:
The patent introduces an intermediary code representation as a mediator between the submitted code and the analysis system. This representation serves as a proxy that contains the necessary information for deficiency detection without exposing the actual proprietary code. The intermediary structure enables analysis while maintaining a security barrier.
2Measurement precision
If comprehensive code analysis is performed, then all deficiencies are detected, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-populating a database with code representations from various sources (open source repositories, vulnerability databases, license databases) before the actual analysis is needed. When code is submitted for analysis, the system can quickly query this pre-prepared database rather than performing comprehensive analysis from scratch, significantly reducing processing time while maintaining detection completeness.
3Productivity
If code is stored in a database for analysis, then deficiency checking is efficient, but security risks increase
Solution Approach 1:
The system stores copies of code in the database rather than the actual proprietary code. The code representation stored in the database is a transformed version that enables efficient deficiency checking through database queries, but does not contain the sensitive proprietary information. This resolves the contradiction by enabling efficient analysis through database storage while eliminating security risks through the use of non-sensitive copies.
Data Source
AI summary
An exemplary method for securely identifying deficiencies in software code comprises: receiving, from a user device, a user query comprising obfuscated user software code data and a user-specified software code portion specification; obtaining, based on the user-specified software code portion specification, one or more obfuscated reference software code data structures constructed from reference software code associated with one or more predefined deficiencies; comparing the obfuscated user software code data with the one or more obfuscated reference software code data structures; if the obfuscated user software code data matches at least one of the obfuscated reference software code data structures, identifying the one or more predefined deficiencies in the obfuscated user software code data; and providing an indication of the identified one or more predefined deficiencies to the user device for flagging.