System, method, and apparatus for modular, string-sensitive, access rights analysis with demand-driven precision
AssigneeInternational Business Machines Corporation
InventorsJulian Timothy Dolby, Emmanuel Geay, Marco Pistoia, Barbara G. Ryder, Takaaki Tateishi
Life of this patent
Estimating the term…
Abstract
A static analysis for identification of permission-requirements on stack-inspection authorization systems is provided. The analysis employs functional modularity for improved scalability. To enhance precision, the analysis utilizes program slicing to detect the origin of each parameter passed to a security-sensitive function. Furthermore, since strings are essential when defining permissions, the analysis integrates a sophisticated string analysis that models string computations.
Claims24
A method for automatic identification and evaluation of access-control policies using a computing system, the method comprising:
- using static analysis to configure an access-control policy for a program running on a computing platform and comprising a plurality of components, each component comprising methods and classes;
- and
- using a combination of string analysis and a demand-driven-precision permission-tracking algorithm to reduce the number of permissions in the access-control policy generated by the static analysis that are not actually needed.
A non-transitory computer-readable medium containing a computer-readable code that when read by a computer causes the computer to perform a method for automatic identification and evaluation of access-control policies, the method comprising:
- using static analysis to configure an access-control policy for a program running on a computing platform and comprising a plurality of components, each component comprising methods and classes;
- using a combination of string analysis and a demand-driven-precision permission-tracking algorithm to reduce the number of permissions in the access control policy generated by the static analysis that are not actually needed;
- and
- using the permissions in the access-control policy to perform security-sensitive operations within the computing system.
Dependencies are inferred from the claim text.