Patent Application
20190361788
One or more embodiments disclosed within this specification relate to security analysis of computer programs.
Static program analysis enables complex properties of a program to be provided via over-approximation of the program's runtime behavior, which reduces the state space required for a proof. A real-world example of static program analysis in the field of security analysis is downgrader detection. A downgrader can be implemented as a sanitizer and/or as a validator used in security analysis. A sanitizer performs transformation on program code, while a validator typically merely performs validation.
When security analysis is performed, information flows sometimes are seeded by statements in the program that read as user inputs, which are known as sources. These statements are tracked. If there is a path from a source to a security-sensitive operation, known as a sink, which does not go through either sanitization or validation by a downgrader, then a vulnerability is reported.
One or more embodiments disclosed within this specification relate to analyzing a security specification.
A method includes identifying a downgrader in a computer program under test. The method also can include, performing, using a processor, testing on the downgrader in a first level of analysis. The method also can include, responsive to the downgrader not passing the testing performed in the first level of analysis, automatically synthesizing a counter example for the downgrader, creating a test unit for the downgrader using the counter example as an input parameter to the downgrader, and executing the test unit to perform testing on the downgrader in a second level of analysis. The method also can include, responsive to the downgrader passing the testing performed in the second level of analysis, presenting to a user a prompt that prompts the user to simplify a model of the downgrader.
A system includes a hardware processor configured to initiate executable operations. The executable operations include identifying a downgrader in a computer program under test. The executable operations also can include performing testing on the downgrader in a first level of analysis. The executable operations also can include, responsive to the downgrader not passing the testing performed in the first level of analysis, automatically synthesizing a counter example for the downgrader, creating a test unit for the downgrader using the counter example as an input parameter to the downgrader, and executing the test unit to perform testing on the downgrader in a second level of analysis. The executable operations also can include, responsive to the downgrader passing the testing performed in the second level of analysis, presenting to a user a prompt that prompts the user to simplify a model of the downgrader.
A computer program product includes a computer readable storage medium having program code stored thereon, wherein the computer-readable storage device is not a transitory, propagating signal per se, the program code executable by a data processing system to initiate operations. The operations include identifying a downgrader in a computer program under test. The operations also can include performing testing on the downgrader in a first level of analysis. The operations also can include, responsive to the downgrader not passing the testing performed in the first level of analysis, automatically synthesizing a counter example for the downgrader, creating a test unit for the downgrader using the counter example as an input parameter to the downgrader, and executing the test unit to perform testing on the downgrader in a second level of analysis. The operations also can include, responsive to the downgrader passing the testing performed in the second level of analysis, presenting to a user a prompt that prompts the user to simplify a model of the downgrader.
As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, method or computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer-readable medium(s) having computer-readable program code embodied, e.g., stored, thereon.
Any combination of one or more computer-readable medium(s) may be utilized. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk drive (HDD), a solid state drive (SSD), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
A computer-readable signal medium may include a propagated data signal with computer-readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium that is not a computer-readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.
Program code embodied on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber, cable, RF, etc., or any suitable combination of the foregoing. Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java™, Smalltalk, C++ or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
Aspects of the present invention are described below with reference to flowchart illustrations and/or block diagram of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagram, and combinations of blocks in the flowchart illustrations and/or block diagram, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer, other programmable data processing apparatus, or other devices create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer-readable medium produce an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.
The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
Several definitions that apply throughout this document will now be presented. As used herein, the term “user” means a human being (e.g., a software engineer, computer engineer, or web developer). As used herein, the term “downgrader” means one or more program code modules that perform validation and/or transformation of user inputs in a computer program. As used herein, the term “counter example” means a concrete string outside of a set of strings used to verify whether a method or function is a downgrader candidate. As used herein, the term “test unit” means a downgrader that is provided as an input a counter example.
In accordance with the embodiments disclosed herein, a downgrader can be interactively analyzed to determine whether the downgrader is properly designed to satisfy the downgrader's intended use. If a downgrader does not pass testing performed in a first level of analysis, a counter example can be synthesized, and a unit test can be created using the synthesized counter example as an input parameter to the downgrader. A user then can execute the test unit using the counter example as an input parameter to perform testing in a second level of analysis.
If the test unit passes testing performed in the second level of analysis, this may indicate to the user that the downgrader is overly complex for the purpose of the first level of analysis. Accordingly, the user can be prompted to simplify the downgrader model and the testing in the first level of analysis can again be performed on the simplified downgrader model. If the test unit does not pass the testing performed in the second level of analysis, such failure may indicate that a problem exists in the downgrader. The results of the second level of analysis can be provided to the user, and the user can indicate whether a problem does indeed exist in the downgrader. If the user indicates that a problem exists, the downgrader can be identified as being unsafe. If not, the user can be prompted to refine an input specification for the downgrader, and the first level of analysis can be performed on the refined downgrader model.
The memory elements 110 can include one or more physical memory devices such as, for example, local memory 120 and one or more bulk storage devices 125. Local memory 120 refers to random access memory or other non-persistent memory device(s) generally used during actual execution of the program code. The bulk storage device(s) 125 can be implemented as a hard drive or other persistent data storage device. The system 100 also can include one or more cache memories (not shown) that provide temporary storage of at least some program code in order to reduce the number of times program code must be retrieved from bulk storage device 125 during execution.
Input/output (I/O) devices such as a keyboard 130, a display 135 and a pointing device 140 optionally can be coupled to the system 100. The I/O devices can be coupled to the system 100 either directly or through intervening I/O controllers. One or more network adapters 145 also can be coupled to the system 100 to enable the system 100 to become coupled to other systems, computer systems, remote printers, and/or remote storage devices through intervening private or public networks. Modems, cable modems, and Ethernet cards are examples of different types of network adapters that can be used with the system 100.
As pictured in
The memory elements 110 also can store an interactive analysis application 160. The interactive analysis application 160, being implemented in the form of executable program code, can be executed by the system 100 to perform interactive analysis of the CPUT 150 to analyze one or more of the downgraders 155, as will be described herein. In this regard, the interactive analysis application 160 can present messages, prompts, and other relevant information to a user via the display 135 indicative of the results obtained by analyzing the downgraders 155, and prompt the user to perform various tasks related to the downgraders 155.
At step 204, a first level of analysis can be performed on the selected downgrader to determine whether the downgrader is considered safe. An example of implementation of the first level of analysis is described in the method 300 of
In one embodiment, to perform the first level of analysis, the processor can employ string analysis to seed statements into the CPUT that are interpreted (e.g., read) by the CPUT as user inputs. Such user inputs can be referred to as sources. The seeding of the statements into the CPUT can initiate an information flow, and this information flow can be tracked by the processor. If there is a path from the source to a security-sensitive operation, known as a sink, which does not go through validation and/or transformation by the selected downgrader, then a vulnerability can be reported, indicating that the downgrader potentially is unsafe. The statements seeded into the CPUT can be string values generated by the string analysis, for example using suitable algorithms that generate string values. Each string value can approximate a string value that potentially may be entered to the CPUT via a client, for example by client side user or malicious client side application.
In one embodiment, the statements seeded into the CPUT can be used to simultaneously perform steps 202, 204. In other words, the program flow initiated by the seeded statements can be tracked both to identify a downgrader that processes the seeded statements and to determine whether the downgrader properly validates and/or transforms the seeded statements as may be necessary to prevent a malicious attack.
Referring to decision box 206, if the identified downgrader passes testing performed in the first level analysis performed at step 204, at step 208 the identified downgrader can be identified as being safe. If, however, the identified downgrader does not pass the testing in the first level of analysis, the process can proceed to step 210.
At step 210, the interactive analysis application can synthesize a counter example for the identified downgrader. An example of counter example syntheses is described in the method 400 of
At step 214, the unit test can be executed to perform testing on the downgrader in a second level of analysis using the counter example as an input to the downgrader. For example, a user can be informed that the unit test has been created, and provided an option to execute the unit test. The execution of the unit test can be analyzed to determine whether execution of the unit test using the counter example identifies a real problem in the downgrader.
Referring to decision box 216, if the unit test passes the second level of analysis, the user can be prompted to simplify the downgrader model. At step 218, user inputs can be received to simplify the downgrader model. For example, if the downgrader includes the following line of code:
and the “complexRemove” function is a complex operation that cannot be modeled sufficiently accurately by a static analysis, the user can summarize the function by performing the following mapping:
Referring again to decision box 216, if the test unit does not pass the testing performed in the second level of analysis performed at step 214, at step 220 the results of the testing can be presented to the user and the user can be prompted to identify whether an actual problem exists in the downgrader model. In illustration, although the test unit does not pass the testing performed in the second level of analysis, such testing may be conservative and identify an issue as being a potential problem, but this issue may turn out not to actually be a problem. The user can evaluate the test results and make the determination whether the issue actually is a problem or not. At decision box 222, if the user indicates that an actual problem does indeed exist with the downgrader model, at step 224 the downgrader can be identified as being unsafe. The user then can be provided an opportunity to revise the downgrader model. If the user so chooses, after the downgrader model is revised, the user can repeat the process to analyze the revised downgrader.
If the user indicates that an actual problem does not exist, at step 226 the user can be prompted to refine an input specification for the downgrader model, and user inputs to refine the input specification can be received from the user. The process then can return to 204 and testing in the first level of analysis again can be performed using the simplified downgrader model. The first level of analysis can prove the correctness of the simplified downgrader model, or return to the user an improved counter example.
At step 302, a call graph cg can be rooted at a method (or function) M. At step 304, the instructions of the method M can be modeled within the call graph cg to generate a model for the string analysis (e.g., as a formula in monadic second-order logic). At step 306, a pattern p can be asserted in the call graph I with respect to return variables V (i.e., p(V)). At step 308, a string-analysis solver can be applied to the model to check whetherp(V) is true. One example of a suitable string-analysis solver is MONA, but the invention is not limited in this regard.
Referring to decision box 310, if the string-analysis solver runs successfully on p(V) (e.g., the string-analysis solver returns the value “true” for p(V)), at step 312 the method M can be declared a downgrader for the pattern p. In this regard, the downgrader can be considered to have passed the first level of analysis at step 206 of
At step 402, let R be a regular pattern asserting a security property of a method M. At step 404, a complement of R, Rc, can be encoded as a logical formula F(Rc). For example, if the regular pattern R is in the form of “{circumflex over ( )}(*script.*)” (i.e., all words not containing substring “script”), the complement Rc may take the form of “x_script_y”.
At step 406, the instructions of the method M can be encoded within the call graph cg as a logical formula F(M). At step 408, logical formulas F(M) and F(Rc) can be feed into the string-analysis solver. Referring to decision box 410, if the string-analysis solver runs successfully, at step 412 F(Rc) can be identified as being a valid counter example. If the string-analysis solver does not run successfully, at step 414 F(Rc) can be identified as not being a valid counter example. In this case, a prompt can be presented to the user indicating that a valid counter example was not generated, and the method 200 of
In one embodiment, the interactive analysis application can be implemented as IBM® Rational® AppScan® Source Edition (IBM, Rational and AppScan are trademarks of International Business Machines Corporation in the United States, other countries, or both).
Like numbers have been used to refer to the same items throughout this specification. The flowcharts and block diagram in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagram may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagram and/or flowchart illustrations, and combinations of blocks in the block diagram and/or flowchart illustrations, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention. The embodiment was chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 14468820 | Aug 2014 | US |
| Child | 16537575 | US | |
| Parent | 13448029 | Apr 2012 | US |
| Child | 14468820 | US | |
| Parent | 13313757 | Dec 2011 | US |
| Child | 13448029 | US |
