Static Analysis for Sensitive Data Usage Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As distributed systems grow in scale and complexity, managing sensitive data usage becomes increasingly complicated due to the difficulty in identifying and securing sensitive operations and data flows within service-oriented architectures, leading to potential security breaches.
Innovation Solution
A method for sensitive data usage detection using static analysis, which involves retrieving and validating service models, extracting operation and parameter names, identifying sensitive operations, and mapping data flows, coupled with pattern-based detection using data injection to verify findings and enhance security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If distributed systems grow in scale and complexity to provide more computing resources and services, then the system's productivity and versatility improve, but the difficulty of managing and securing sensitive data usage increases
Solution Approach 1:
The patent introduces an intermediary system that sits between the distributed system components and the sensitive data flows. This intermediary automatically detects, classifies, and manages sensitive data usage by analyzing service models and data flows, thereby reducing the management burden on system operators while maintaining security controls in complex distributed environments.
2Reliability
If manual methods are used to identify and secure sensitive operations in service-oriented architectures, then security measures can be implemented, but the ease of operation and time required for security management deteriorate
Solution Approach 1:
The system enables self-service security management by automatically analyzing service models, identifying sensitive data flows, and classifying operations without requiring manual intervention. The system autonomously generates security policies and alerts, allowing organizations to maintain reliable security protection while significantly improving the ease of operation and reducing time requirements for security management.
3Reliability
If comprehensive security monitoring is implemented across all data flows in distributed systems, then security reliability improves, but the device complexity and resource consumption increase
Solution Approach 1:
The patent extracts and focuses monitoring efforts specifically on sensitive data flows by first identifying and classifying sensitive operations within the service model. Rather than monitoring all data flows comprehensively, the system extracts only the critical sensitive paths for detailed analysis, thereby maintaining high security reliability while reducing the complexity and resource consumption of the monitoring system.
Data Source
AI summary
Methods, systems, and computer-readable media for implementing sensitive data usage detection using static analysis are disclosed. A specification of one or more operations exposed by a service in a service-oriented system is obtained from a repository. The names of the one or more operations are determined in the specification. The names of one or more parameters of the one or more operations are determined in the specification. The names of the one or more operations and the names of the one or more parameters are checked against a dictionary of sensitive terms. One or more sensitive operations are determined among the one or more operations. One or more consumers of the one or more sensitive operations are determined.