Code Base Partitioning System
AssigneeMicrosoft Corporation
InventorsAthanasios Avgerinos, Mariusz H. Jakubowski, Marcus Peinado
Life of this patent
Estimating the term…
Abstract
The subject disclosure is directed towards partitioning a code base of a program into a trusted portion and an untrusted portion. After identifying sensitive data within the code base using annotation information, one or more program elements that correspond to the sensitive data are automatically transformed into secure program elements that can be retained in the untrusted portion of the code base. Cryptographic techniques are used to minimize a potential size of the trusted portion of the code base. Source files for the trusted portion and the untrusted portion are generated.
Claims20
In a computing environment, a method performed at least in part on at least one processor, comprising, partitioning a code base into a trusted portion and an untrusted portion, including, identifying program elements that correspond to sensitive data within the code base using annotation information, automatically transforming the program elements into secure program elements, and separating the code base into the untrusted portion comprising the secure program elements and the trusted portion.
In a computing environment, a system, comprising, an automated partitioning mechanism configured to separate a code base into trusted code and untrusted code, and designate secure program elements that reference sensitive data as the untrusted code, wherein the automated partitioning mechanism further comprises a cryptographic module configured to encrypt the sensitive data and further configured to generate the secure program elements from an intermediate representation of the code base.
One or more computer-readable media having computer-executable instructions, which when executed perform steps, comprising:
- producing an intermediate representation for an annotated program;
- performing taint propagation on the annotated program to identify one or more portions of the annotated program that reference sensitive data;
- securing the one or more portions of the annotated program using at least one of a confidentiality technique and an authentication technique;
- and
- partitioning the annotated program into trusted code and untrusted code comprising the one or more portions.
Dependencies are inferred from the claim text.