Security Critical Data Containers for Platform Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Writing secure code for platforms that enable applications to be downloaded and installed from the Internet without prompting is challenging due to the difficulty in preventing untrusted code from running with elevated privileges, leading to potential security flaws and a complex code-review process.
Innovation Solution
A system and method where metadata describes 'criticality' for data fields and methods, allowing access to critical data through marked 'Get' and 'Set' containers, reducing the number of methods and data fields that need to be reviewed for security without compromising security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code is marked as critical to ensure security, then security is improved, but the code-review process becomes more complex and time-consuming
Solution Approach 1:
The patent segments the monolithic criticality marking into fine-grained security attributes that can be applied selectively to specific code elements (methods, fields, properties). Instead of marking entire classes or methods as critical, the system allows individual members to have security attributes, thereby reducing the scope of code that requires intensive review while maintaining security where needed.
Solution Approach 2:
The patent applies local quality by allowing security attributes to be applied at the member level rather than the class level. This enables security-critical operations to be identified and protected locally where they occur, while non-critical portions of the code remain unmarked and require less review effort.
2Reliability
If comprehensive code review is performed to ensure security, then security flaws are detected, but the review process becomes extremely complex and burdensome
Solution Approach 1:
The patent applies partial action by performing security review only on code elements that have security attributes, rather than reviewing all code comprehensively. This selective approach maintains security flaw detection capability for critical code while significantly improving review efficiency by excluding non-critical code from intensive scrutiny.
Solution Approach 2:
The patent replaces manual comprehensive code review with an automated attribute-based security model. Static analysis tools can automatically identify and review only the marked security-critical elements, substituting mechanical manual review processes with automated systems that focus resources where they are most needed.
3Adaptability or versatility
If platform code is written with elevated privileges to operate properly, then functionality is improved, but security flaws can inadvertently expose internal methods to untrusted code
Solution Approach 1:
The patent introduces security attributes as intermediaries between platform code and untrusted code. These attributes act as markers that identify which code elements require protection, creating a layer of abstraction that allows the runtime to enforce security policies without requiring complex manual review of all elevated-privilege code.
Solution Approach 2:
The patent applies preliminary action by marking security-critical code elements in advance during development. This upfront identification allows static analysis tools and the runtime to automatically enforce security policies on known critical elements, preventing inadvertent exposure before deployment without requiring comprehensive review of all platform code.
Data Source
AI summary
Described are security critical data containers for platform code, comprising a Get container and Set container that allow data to be marked as security critical for critical usage of that data, but left unmarked for non-critical usage. The number of critical methods in the code is reduced, facilitating better code analysis. A container's method may be marked as security critical, with the only access to the data via the method. By using a generic class for a Get container, access to the critical data only occurs through the property on the class, which is marked as critical. The field pointing to the generic class instance need not be critical, whereby initialization or existence checking may remain non-critical. The Set container handles security critical situations such as data that controls whether code can elevate permissions; a set method is marked as critical, while other methods can be accessed by non-critical code.