Automated Sensitive Data Access Identification via Source Code Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing technologies face challenges in efficiently identifying source codes that access sensitive data, particularly in the context of DevOps and Cloud environments, where rapid software development and deployment make it difficult for security teams to enforce application security standards and manage risks effectively.

Innovation Solution

A system that uses source-code analysis to determine whether a repository and its files are pertinent to security by applying inclusion and exclusion filters, and then identifies sensitive data access by tokenizing the code and applying rules to detect keywords indicative of sensitive data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If security teams manually review source code to identify sensitive data access, then measurement precision can be maintained, but productivity decreases significantly

Engineering Contradiction:

Improveaccuracy of identifying sensitive data accessVSAvoidspeed of identifying sensitive data access

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent replaces manual mechanical review processes with automated computational analysis. The system uses programmatic source code analysis, tokenization, and rule-based detection to automatically identify sensitive data access patterns, substituting human reviewers with automated tools that maintain precision while dramatically increasing productivity.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent introduces an intermediary automated analysis system between the source code and security teams. This intermediary performs initial filtering, tokenization, and pattern matching to identify potential sensitive data access, presenting only relevant findings to security teams for verification, thus maintaining precision while improving throughput.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If security teams review all source code repositories, then measurement precision is maintained, but loss of time increases due to the volume of code to analyze

Engineering Contradiction:

Improveaccuracy of security assessmentVSAvoidtime required to review all repositories

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent extracts and analyzes only the critical elements of source code relevant to sensitive data access. By tokenizing code and applying targeted rules to identify specific patterns (e.g., API calls to sensitive endpoints, data access functions), the system extracts only the necessary information for security assessment, eliminating the need to review entire repositories and reducing time loss.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent segments the source code analysis into discrete tokenizable units and applies rules to individual tokens or code segments. This segmentation allows parallel processing of multiple code sections and enables the system to quickly scan large repositories by analyzing small, manageable code fragments rather than reviewing complete files sequentially.

Inventive Principle:

Principle #1Segmentation

3Productivity

If automated tools are used to scan source code, then productivity increases, but measurement precision decreases due to false positives

Engineering Contradiction:

Improvespeed of security analysisVSAvoidaccuracy of sensitive data access detection

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The patent implements dynamic rule application where the analysis system adapts its detection criteria based on context. Rules are applied conditionally based on code structure, programming language, and specific patterns observed, allowing the system to adjust its sensitivity and reduce false positives while maintaining high productivity through automated analysis.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS20250165637A1Automated identification of sensitive data access based on source-code analysis

Publication Date: 2025.05.22 CHECKMARX LTD

AI summary

A system for facilitating the identification of sensitive data access based on source-code analysis is provided. During operation, the system can determine whether a repository in a source-code management platform is pertinent to security. If the repository is pertinent to security, the system can determine whether a respective source code file in the repository is pertinent to security. If the source code file is pertinent to security, the system can determine a set of symbols from the source code file and determine, based on the set of symbols, whether the source code file accesses sensitive data. If the source code file accesses sensitive data, the system can present information associated with the source code file in a user interface.