Automated Security Assertion Generation for Software Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software testing methods provide low confidence in the security of software, especially when it comes to detecting application-specific security flaws, which are difficult to identify and require developers to define specific security properties, often in an unfamiliar language or logic.
Innovation Solution
A computer-implemented tool with a graphical user interface that includes an assertion generator module to automatically generate assertions for verifying application-specific security properties, an assertion checker module to analyze the software, and a database to store assertions, allowing developers to interactively build robust software programs that satisfy selected security properties.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code verification and analysis of abstract program models are used to increase confidence in software security, then security confidence is improved, but technical difficulty, cost, and time consumption increase
Solution Approach 1:
The patent introduces an intermediate representation (IR) as a mediator between the original code and the verification process. The IR simplifies the code structure while preserving security-relevant properties, making verification more tractable. This intermediary layer reduces the technical difficulty of verifying application-specific security properties while maintaining high security confidence.
Solution Approach 2:
The verification process is segmented into multiple independent components: code translation to IR, automatic assertion generation, property verification, and counterexample generation. Each component handles a specific aspect of verification, reducing overall complexity and enabling modular development and maintenance of the verification system.
2Measurement precision
If developers manually define specific security properties to detect application-specific errors, then detection capability is improved, but ease of operation deteriorates due to requiring unfamiliar language or logic
Solution Approach 1:
The system performs self-service by automatically generating assertions from the intermediate representation without requiring developers to manually specify security properties in formal languages. The automatic assertion generation engine analyzes the IR and produces verification conditions that capture application-specific security properties, thereby maintaining high detection capability while dramatically improving ease of operation.
Solution Approach 2:
The patent replaces the manual mechanical process of defining security properties in formal logic with an automated computational process. The assertion generation engine uses algorithms to automatically translate code semantics into verification assertions, substituting developer effort with automated reasoning mechanisms that handle the complexity of property specification.
3Ease of operation
If traditional software testing is used to detect security flaws, then ease of operation is maintained, but reliability of security detection deteriorates
Solution Approach 1:
The patent merges the simplicity of traditional testing with the rigor of formal verification by integrating automatic assertion generation and verification into the existing software development workflow. The system combines automated analysis techniques with conventional testing approaches, maintaining ease of operation while significantly improving the reliability of security flaw detection through comprehensive property verification.
Data Source
AI summary
A computer implemented tool is described that includes an assertion generator module that can automatically generate assertions, which are usable to verify application-specific security properties, for a computer software program. An assertion checker module can automatically analyze the computer software program to ensure that it satisfies the application-specific security properties. A graphical user interface module can display feedback to diagnose security flaws detected in the computer software program based on the analysis by the assertion checker module. In support of these modules are a code preprocessor module that can translate source code of the computer software program into an intermediate abstract representation, and a database module that can store the generated assertions and associated data in a database. Each of the modules can provide functionality at any time during code construction of the computer software program.