Static Analysis of Control Flow Graphs for Security Entity Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current programming languages lack tools to automatically identify and manage security-sensitive entities and their permissions, leading to potential security vulnerabilities due to the absence of formal specifications for access control and privilege elevations, making it difficult to detect security-related programming errors.
Innovation Solution
A method and system that analyze software libraries by generating control flow graphs to identify candidate security-sensitive entities and determine if they are guarded by permission checks, using proximity and coverage levels to classify entities as security-sensitive and detect access control errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If permission checks are enforced dynamically without formal specification, then security properties can be enforced programmatically, but security-related programming errors become difficult to detect and false positives increase
Solution Approach 1:
The patent performs static analysis on the control flow graph before runtime execution to identify candidate security-sensitive entities and verify permission check coverage. This preliminary action detects potential security errors during development rather than at runtime, reducing false positives while maintaining security enforcement.
Solution Approach 2:
The patent implements a feedback mechanism where the static analysis results (coverage metrics, candidate entities) are used to improve the permission check system. The analysis provides feedback about which entities are properly guarded and which are not, enabling continuous improvement of security properties.
2Difficulty of detecting and measuring
If automatic identification of security-sensitive entities is implemented, then detection of access control errors is improved, but analysis complexity and computational resources increase
Solution Approach 1:
The patent segments the analysis process into distinct phases: generating the control flow graph, identifying candidate security-sensitive entities, analyzing execution paths, and calculating coverage metrics. This segmentation makes the complex analysis more manageable and allows each phase to be optimized independently.
Solution Approach 2:
The patent introduces an intermediary static analysis system that bridges the gap between the program code and the runtime permission checks. This intermediary analyzes the control flow graph to identify security-sensitive entities and verify permission check coverage, simplifying the overall detection process.
3Measurement precision
If all candidate entities are analyzed with full path verification, then classification accuracy is improved, but analysis time and computational cost increase
Solution Approach 1:
The patent applies partial action by focusing the detailed path verification only on candidate entities that meet initial criteria. Not all entities undergo the full analysis - only those identified as potential security-sensitive entities based on preliminary analysis, reducing overall analysis time while maintaining accuracy for critical entities.
Data Source
AI summary
A method for analyzing a software library may include obtaining the software library, identifying a candidate security-sensitive entity in the software library, and generating a control flow graph that includes execution paths. Each execution path may include a public entry node corresponding to a public entry and a candidate security-sensitive entity node corresponding to the candidate security-sensitive entity. The public entry is a point where an application program external to the software library may access the software library. The method may further include determining whether each execution path in the control flow graph includes a permission check node between the respective public entry node and the candidate security-sensitive entity node in the respective execution path. Each permission check node may correspond to a permission check in the software library. The method may further include classifying, based on the determination, the candidate security-sensitive entity as a security-sensitive entity.