# US 9,519,789 B2 · Identifying security vulnerabilities related to inter-process communications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,519,789 B2
- Document ID: US9519789B2
- Status: Granted
- Kind: B2
- Application number: 14/225,642
- Filed: 2014-03-26
- Published: 2014-10-16
- Granted: 2016-12-13
- Earliest claimed: 2013-04-10
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Roee Hay; Omri Weisman
- Web page: https://patentgrep.com/patent/US9519789B2

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Identifying security vulnerabilities related to inter-process communications by identifying within the instructions of a computer software application an object creation location configured to create an inter-process communications object, identifying within the instructions of the computer software application a location of an inter-process communications method, determining whether a path exists for an inter-process communications object created at the object creation location to propagate to the inter-process communications method, classifying with a classification selected from a plurality of predefined classifications, any of the inter-process communications object, the object creation location, and the location of the inter-process communications method, and reporting as a security vulnerability the classified inter-process communications object, object creation location, or location of the inter-process communications method if the path exists and if the classification is predefined to indicate that reporting is warranted.

## Claims

### Claim 1

A method for identifying security vulnerabilities related to inter-process communications, the method comprising:
identifying within the instructions of a computer software application an object creation location configured to create an inter-process communications object;
identifying within the instructions of the computer software application a location of an inter-process communications method;
determining whether a path exists for an inter-process communications object created at the object creation location to propagate to the inter-process communications method;
classifying with a classification selected from a plurality of predefined classifications, any of the inter-process communications object, the object creation location, and the location of the inter-process communications method; and
reporting as a security vulnerability the classified inter-process communications object, object creation location, or location of the inter-process communications method if the path exists and if the classification is predefined to indicate that reporting is warranted, wherein
the identifying and determining steps are performed using static analysis of the instructions of the computer software application,
the reporting comprises reporting a severity of the security vulnerability that is indicated by the classification, wherein the predefined classifications indicate different severities.

### Claim 2 (depends on 1)

The method of claim 1 wherein the classifying comprises classifying using one classification if the inter-process communications object is configured to specify target information that is tainted, and using a different classification if the inter-process communications object is configured to specify target information that is not tainted.

### Claim 3 (depends on 2)

The method of claim 2 and further comprising determining that the target information is tainted if it originates from an untrusted source.

### Claim 4 (depends on 2)

The method of claim 2 and further comprising determining that the target information is tainted if it is write-accessible to at least one other computer software application.

### Claim 5 (depends on 1)

The method of claim 1 wherein the classifying comprises classifying using one classification if the inter-process communications object is not configured to specify target information and is configured to include references to directives that are commonly known with respect to a given computer operating system, and using a different classification if the inter-process communications object is not configured to specify target information and is not configured to include references to directives that are commonly known with respect to the given computer operating system.

### Claim 6 (depends on 5)

The method of claim 5 and further comprising determining that the references to directives include any of a) a Google Android™ intent action having a value that is not a predefined Google Android™ intent action value, and b) an Google Android™ intent category having a value that is not a predefined Google Android™ intent category value.

### Claim 7 (depends on 1)

The method of claim 1 wherein the identifying, determining, classifying, and reporting steps are embodied in any of a) computer hardware, and b) computer software embodied in a non-transitory, computer-readable medium.