Static Analysis Data Flow Tracking in Access-Controlled Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing environments, it is challenging to determine data flow and enforce access controls, especially as the size of the environment grows and sensitive data is exchanged between multiple entities, making it difficult to identify sources and sinks of data and ensuring proper access control enforcement.
Innovation Solution
A method is introduced to evaluate computer system code to identify data flow by using static analysis and access control information, determining whether the code acts as an intermediary for data movement, and facilitating the tracking of sensitive data through the environment by parsing logically structured function calls and evaluating service calls, with the aid of a data flow mapping entity and static analysis entity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis is performed on source code to identify data sources and sinks, then data flow tracking capability is improved, but the ability to utilize access control information is reduced
Solution Approach 1:
The patent segments the data flow analysis process into distinct phases: access control policy retrieval, code instrumentation, static analysis execution, and result processing. This segmentation allows each phase to specialize in its function, with the access control information being systematically integrated at appropriate stages rather than being overlooked in traditional static analysis approaches
Solution Approach 2:
The patent introduces access control policies as an intermediary layer between the static analysis engine and the data flow tracking process. These policies act as mediators that guide the analysis by specifying which data movements require tracking, enabling the system to leverage access control information to enhance rather than hinder data flow identification
2Quantity of substance
If the computing environment grows in size, then the amount of sensitive data and access entities increase, but the ability to track data locations and enforce access controls deteriorates
Solution Approach 1:
The patent performs preliminary instrumentation of source code during the development or deployment phase, embedding tracking capabilities before the actual data flow occurs. This preliminary action ensures that as the computing environment grows, the tracking infrastructure is already in place and scales automatically with the system, rather than requiring retroactive analysis of uninstrumented code
Solution Approach 2:
The patent adds a new dimension to data tracking by incorporating access control policy information alongside traditional data flow metadata. This creates a multi-dimensional tracking model that not only follows data movement but also contextualizes it with authorization information, enabling effective monitoring even as system complexity increases
Data Source
AI summary
Method and apparatus for identifying a flow of data from a first data store to a second data store are disclosed. In the method and apparatus, a service may send the data from the first data store to the second data store, whereby the service may be associated with an access control policy that specifies whether the service is permitted to send or receive the data. The access control policy may be used as a basis for the evaluation of executable instructions of the service, and evaluation of the executable instructions may be used to identify the first data store or the second data store.