US 10,120,778 B1Granted

Security validation of software delivered as a service

AssigneeWells Fargo Bank, N.A.

InventorsPeter A. Makohon, Ross Cavanaugh

Life of this patent

Estimating the term…

Loading patent…

Abstract

An electronic computing device obtains application source code to be tested. The application source code is automatically categorized into one or more hardware or software classifications. One or more tests are identified for the application source code based on the one or more hardware or software classifications. The one or more tests are run against the application source code. The one more tests are monitored as they are running. Based on results from the one or more tests, a test score representing a security risk of the application source code is automatically determined. A summary of the results from the one or more tests, including the test score, is visually displayed on the electronic computing device.

Claims15

Dependent claims

A method for testing software application source code on an electronic computing device, the method comprising:

obtaining a version level of the software application source code;
detecting when the version level of the software application code has been updated;
when the version level of the software application code is detected to have changed, automatically implementing a security test against the software application source code;
monitoring results of the security test;
when an error is detected in the security test, flagging the software application source code as vulnerable to malware;
determining whether the software application source code uses an encryption protocol;
when a determination is made that the software application source code uses an encryption protocol:
running an encryption test against the software application source code;
identifying the encryption protocol;
and
using an encryption test specific to the identified encryption protocol;
implementing one of more test strings in a custom script;
implementing the software application test code in an electronic computing device;
monitoring a performance of the electronic computing device running the custom script;
checking for security vulnerabilities in software running on the electronic computing device;
and
when a security vulnerability is identified, flagging the software application test code as vulnerable to malware.

14 more elements

An electronic computing device comprising:

a processing unit;
and
system memory, the system memory including instructions which, when executed by the processing unit, cause the electronic computing device to:
obtain the software application source code to be tested;
implement a plurality of penetration tests against the software application source code, each of the plurality of penetration tests comprising applying one or more test strings to the software application source code, at least one of the plurality of penetration tests being implemented by applying one or more test strings to a stand-alone electronic computing device, at least another of the plurality of penetration tests being implemented over a network by applying the one or more test strings to another electronic computing device connected to the network;
monitor a manner in which the software application source code processes the one or more test strings;
when an error is detected in the manner in which the software application test code processes the one or more test strings, flag the software application source code as vulnerable to malware;
implement one of more test strings in a custom script;
implement the software application test code in an electronic computing device;
monitor a performance of the electronic computing device running the custom script;
determine whether the software application source code uses an encryption protocol;
and
when a determination is made that the software application source code uses an encryption protocol:
run an encryption test against the software application source code;
identify the encryption protocol;
and
run an encryption test specific to the identified encryption protocol.

14 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/924,764Filed 19 Mar 2018 · continuation
Priority: 23 Oct 2015
Granted: 6 Nov 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

G06F 11/3612
Analysis of software for verifying properties of programs: by runtime analysis
G06F 11/3672
Testing of software: test management
G06F 16/285
Relational databases: clustering or classification
G06F 21/577
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…

Family

Application14/921,403Parent of this continuation · filed 23 Oct 2015
US 9,921,942 B1Parent of this continuation
US 10,120,778 B1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key