# US 2019/0171846 A1 · System and method for code-based protection of sensitive data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0171846 A1 - Document ID: US20190171846A1 - Status: Published application - Kind: A1 - Application number: 16/209,419 - Filed: 2018-12-04 - Published: 2019-06-06 - Earliest claimed: 2017-12-04 - Assignees: ShiftLeft Inc. - Applicants: ShiftLeft Inc - Inventors: Chetan Conikee; Markus Lottmann; Fabian Yamaguchi; Vlad A Ionescu - Web page: https://patentgrep.com/patent/US20190171846A1 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 40/216: using statistical methods - G06F 40/30: Semantic analysis - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for monitoring and protecting sensitive data that includes identifying sensitive data and statically tracking sensitive data using data flow analysis across a code base, monitoring flow of the data during application runtime, and responding to vulnerabilities according to a sensitive data characterization of the data. Identifying sensitive data includes processing a semantic description of the data in the application code and characterizing the sensitive data. Monitoring flow of the data includes: identifying and characterizing sensitive data through data usage, updating the characterization for the sensitive data through data usage, and enforcing security measures on the data according to the sensitive data characterization of the data. ## Claims ### Claim 1 A method for monitoring and protecting sensitive data comprising: identifying sensitive data comprising: processing a semantic description of data in an application code, and characterizing the sensitive data; monitoring flow of the sensitive data during application runtime comprising: identifying and characterizing sensitive data through data usage, updating the characterization for the sensitive data through data usage, and enforcing security measures on the data according to the sensitive data characterization; and responding to vulnerabilities of the data, comprising responding according to the sensitive data characterization of the data. ### Claim 2 (depends on 1) The method of claim 1, further comprises of generating an application specific code profile comprising of a data flow graph wherein monitoring flow of the data is monitored in part with the code profile. ### Claim 3 (depends on 1) The method of claim 1, wherein identifying sensitive data further comprises of searching a security code policy. ### Claim 4 (depends on 3) The method of claim 3, wherein processing a semantic description of data in an application code comprises comparing application code semantic data to language within a security code policy. ### Claim 5 (depends on 1) The method of claim 1, wherein identifying sensitive data comprises identifying sensitive data within the application code. ### Claim 6 (depends on 1) The method of claim 1, wherein identifying sensitive data comprises identifying sensitive data by determining and monitoring the flow of data through the application code prior to application execution. ### Claim 7 (depends on 1) The method of claim 1, wherein processing a semantic description of data in the application code comprises determining sensitive data from variable names. ### Claim 8 (depends on 1) The method of claim 1, wherein processing a semantic description of data in the application code comprises determining sensitive data from the application code documentation. ### Claim 9 (depends on 1) The method of claim 1, wherein characterizing sensitive data comprises determining the type of sensitive data. ### Claim 10 (depends on 9) The method of claim 9, wherein characterizing sensitive data comprises generating a sensitive data score for the sensitive data. ### Claim 11 (depends on 1) The method of claim 1, wherein monitoring flow of the data during application runtime further comprises of monitoring the data interaction with external sources. ### Claim 12 (depends on 11) The method of claim 11, wherein monitoring flow of the data during application runtime further comprises of monitoring flow of the data within external applications. ### Claim 13 (depends on 1) The method of claim 1, wherein identifying sensitive data comprises applying a machine learning classification model and thereby identifying at least one sensitive data in the application code. ### Claim 14 (depends on 1) The method of claim 1, wherein enforcing security measures on the data comprises of preventing insecure usage of the sensitive data. ### Claim 15 (depends on 1) The method of claim 1, further comprising setting a security parameter and increasing or decreasing the level of security enforcement in accordance with the security parameter. ### Claim 16 (depends on 1) The method of claim 1, wherein responding to vulnerabilities of the data comprises generating a security report. ### Claim 17 (depends on 1) The method of claim 1, wherein responding to vulnerabilities of the data comprises sending warning messages. ### Claim 18 (depends on 17) The method of claim 17, wherein responding to vulnerabilities of the data further comprises updating the code dictionary. ### Claim 19 A system for identifying and monitoring sensitive data comprising: sensitive data policy, comprising of lists of words and phrases pertaining to sensitive data; a code semantics engine, wherein the code semantics engine is configured to identify sensitive data within an application code with aid of the sensitive data policy; a code profile, wherein the code profile is an application specific analysis of at least a subset of the application code, comprising: a code object graph that maps the application code in a functional manner; a runtime enforcement agent, wherein the runtime enforcement agent is configured to monitor sensitive data utilization during runtime, enforce security measures on the sensitive data, and report sensitive data utilization; and a user interface that reports at least the sensitive data utilization. ### Claim 20 (depends on 19) The system of claim 19, wherein the code property graph comprises: an asymmetric tree graph that characterizes the structure and syntax of the application code; a data flow of graph that characterizes the flow of data interactions of the application code; and a control flow graph that characterizes the functional executions of the application code.