Test Application Isolating Third-Party Library Vulnerabilities

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Identifying security vulnerabilities in third-party software components, such as libraries, is challenging due to their complexity and the difficulty in isolating vulnerabilities from full software applications, which can lead to increased review time and resource consumption.

Innovation Solution

A method involving the generation of a test application that calls all externally accessible data paths in the software component, analyzed using a static application security testing (SAST) code analyzer to identify vulnerabilities, with manual inspection to filter out false positives and generate rules for future testing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If full software application is compiled and analyzed to identify vulnerabilities in third-party components, then vulnerability detection is thorough, but memory requirements and scan duration increase significantly

Engineering Contradiction:

Improvevulnerability detection thoroughnessVSAvoidmemory requirements

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent segments the vulnerability analysis by creating a dedicated test application that isolates third-party components from the full software application. This test application specifically targets and analyzes only the third-party components through controlled data paths, separating the analysis scope from the complete application to reduce resource consumption while maintaining detection reliability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent extracts third-party components from the full software application context and creates a standalone test application that analyzes only these components. By taking out the third-party components and creating a minimal test harness, the system reduces memory requirements and scan duration while still thoroughly analyzing vulnerability data paths.

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If full software application is compiled and analyzed to identify vulnerabilities in third-party components, then vulnerability detection is thorough, but scan duration increases significantly

Engineering Contradiction:

Improvevulnerability detection thoroughnessVSAvoidscan duration

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent segments the analysis process by creating a dedicated test application that focuses exclusively on third-party components. This segmentation allows the SAST code analyzer to process only the relevant code paths of third-party components rather than the entire software application, significantly reducing scan duration while maintaining detection thoroughness.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies partial action by analyzing only the necessary data paths and methods of third-party components rather than the complete software application. The test application is designed to call specific externally accessible data paths, performing just enough analysis to identify vulnerabilities without the excessive resource consumption of full application analysis.

Inventive Principle:

Principle #16Partial or excessive action

3Adaptability or versatility

If third-party component complexity is increased to provide more functionality, then adaptability improves, but difficulty in identifying security vulnerabilities increases

Engineering Contradiction:

ImprovefunctionalityVSAvoidvulnerability identification difficulty

Core Design Contradiction:

Adaptability or versatilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent introduces a test application as an intermediary that bridges the complexity of third-party components and the vulnerability analysis process. This intermediary test application systematically calls and tracks data paths through the third-party components, making vulnerability detection easier even as component functionality and complexity increase.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent uses data flow tracking with taint analysis to visually distinguish and track sensitive data paths through the third-party components. By marking and tracking tainted data flow, the system makes vulnerability detection easier to identify and measure, even in complex components with multiple functionality.

Inventive Principle:

Principle #32Color changes

Data Source

PatentUS20240121261A1Automated Security Analysis of Software Libraries

Publication Date: 2024.04.11 WELLS FARGO BANK NA

AI summary

A method for identifying security vulnerabilities in a third party software component includes generating a test application for the third party software component. The test application is generated such that every externally accessible data path in the third party component is called. The test application and the third party software component are analyzed using a static application security testing (SAST) code analyzer. One or more test results are obtained from the SAST code analyzer. The one or more test results are used to identify security vulnerabilities in the third party component.