Automatic Security Identification in Software Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing software applications on mobile devices require manual intervention and are prone to errors, as developers must manually identify and mark security-critical parts, which is time-consuming and costly, and requires integration of security tools into development environments that need frequent updates.
Innovation Solution
A method that automatically identifies security-critical parts of a software application by analyzing program code for network connections, transaction variables, and allocation constants, storing this information in a data structure for later protection, thereby eliminating the need for manual marking and integration into development environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual marking of security-critical parts is performed by developers, then security measures can be applied to identified parts, but the process becomes time-consuming and error-prone
Solution Approach 1:
The system performs automatic identification of security-critical parts through static analysis of the program code, eliminating the need for manual developer intervention. The analysis device autonomously detects network connection calls, transaction variables, and allocation constants without requiring developer training or manual marking.
Solution Approach 2:
The manual mechanical process of developers marking security-critical parts is replaced by an automated software-based static analysis system that uses program analysis algorithms to identify security-relevant code elements automatically.
2Reliability
If manual marking of security-critical parts is performed by developers, then security measures can be applied, but errors and omissions occur due to human limitations
Solution Approach 1:
The static analysis system autonomously identifies security-critical parts through automated program analysis, eliminating human errors and omissions. The system consistently detects all network connection calls, transaction variables, and allocation constants without being affected by developer fatigue or lack of training.
3Reliability
If security tools are integrated into development environments, then security measures can be applied during development, but the integration requires frequent updates and maintenance
Solution Approach 1:
The static analysis for security identification is extracted as a separate, independent process that operates on the program code without requiring integration into the development environment. This eliminates the need to modify or maintain development environments while still providing comprehensive security analysis.
Solution Approach 2:
The static analysis device acts as an intermediary that processes the program code independently, producing results that can be used by security tools without requiring direct integration into the development environment. This mediator approach avoids complexity in the development environment while maintaining security functionality.
4Reliability
If manual marking is required, then developers must receive specialized training, but this increases training costs and time
Solution Approach 1:
The static analysis system performs security identification automatically without requiring developer expertise in security marking. Developers can use the system without specialized training, as the automated analysis handles the identification of security-critical parts.
Data Source
Figure 1(a1)~1(e)
AI summary
According to a method for automatically identifying parts of a software application that need to be secured, (a) calls to operating system API functions for establishing network connections are identified in the provided program code of the software application, and corresponding connection variables (b) representing the network connection are captured. Furthermore, transaction variables (c) used in connection with a captured connection variable are identified, as well as assignment variables and/or assignment constants (d) associated with assigning a value to a transaction variable. Information about the identified transaction variables and assignment variables and/or assignment constants is stored in a data structure relating to the parts of the software application that need to be secured, and the software application is ultimately secured based on this data (e).