Source Code Analysis Tool for Hard-Coded Secret Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing static analysis tools fail to effectively detect hard-coded secret vulnerabilities in source code during the development stage, leading to potential security exposures when the code is deployed.

Innovation Solution

A source code analysis tool is augmented with a pair of rule-based engines to identify lexical information indicative of hard-coded secrets, parsing the source code and processing data to determine the likelihood of secret support, providing developers with notifications or visualizations to address potential vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If existing static analysis tools are used to scan source code, then general security vulnerabilities can be detected, but hard-coded secret vulnerabilities cannot be effectively detected

Engineering Contradiction:

Improvedetection accuracyVSAvoidvulnerability detection coverage

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The analysis tool is divided into multiple specialized engines: a lexical analyzer for parsing source code, a first rule-based engine for identifying hard-coded secrets, and a second rule-based engine for identifying secret validation patterns. This segmentation allows each component to specialize in specific detection tasks, improving overall detection accuracy for hard-coded secrets while maintaining general vulnerability detection capabilities.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces intermediary data structures (lexical analysis results, rule matching results, and consolidated findings) that bridge the gap between general static analysis and specialized hard-coded secret detection. These intermediaries enable the system to process general vulnerability patterns while simultaneously applying specialized rules for secret detection.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If comprehensive scanning is performed to detect all vulnerability types, then detection coverage is improved, but false positive rates increase

Engineering Contradiction:

Improvevulnerability detection coverageVSAvoidfalse positive rate

Core Design Contradiction:

Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The system implements feedback through consolidated findings that combine results from multiple rule-based engines. By cross-referencing hard-coded secret detection with secret validation pattern detection, the system provides feedback that helps distinguish true vulnerabilities from false positives, improving measurement precision while maintaining comprehensive coverage.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent combines multiple detection approaches (lexical analysis, rule-based matching, pattern recognition) into a composite analysis system. This composite approach allows the tool to maintain broad vulnerability detection coverage while using the synergistic effect of multiple methods to reduce false positives through mutual validation.

Inventive Principle:

Principle #40Composite materials

3Measurement precision

If multiple rule-based engines are added to detect hard-coded secrets, then detection precision is improved, but device complexity increases

Engineering Contradiction:

Improvehard-coded secret detection accuracyVSAvoidanalysis tool structure

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The rule-based engines are designed with universal functionality to handle multiple detection scenarios through configurable rules. Rather than creating separate specialized components for each detection case, the engines can be configured with different rule sets to detect various types of hard-coded secrets and validation patterns, reducing overall system complexity while maintaining high detection precision.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system manages complexity by allowing rule parameters to be changed and configured based on detection needs. The rule-based engines can adjust their behavior through parameter modification rather than structural changes, enabling flexible detection of different vulnerability patterns without increasing device complexity.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS11288376B2Identifying hard-coded secret vulnerability inside application source code

Publication Date: 2022.03.29 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

A source code analysis tool is augmented to support rule-based analysis of code to attempt to identify certain lexical information indicative of hard-coded secret (e.g., password) support in the code. The tool takes the source code as input, parses the content with a lexical analyzer based on language grammar, and processes the resulting data through preferably a pair of rule-based engines. Preferably, one engine is configured to identify variables explicitly intended to be used as a hard-coded secret, and the other engine is configured to identify data strings that could potentially support such a secret. The outputs of these rules engines are consolidated and evaluated to identify a likelihood that the code under examination includes support for a hard-coded secret. The result is then provided to the developer for further action to address any potential security vulnerability identified by the analysis.