专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US08656496B2 Global variable security analysis 失效
标题翻译：全局变量安全性分析
公开(公告)号：US08656496B2
公开(公告)日：2014-02-18
申请号：US12951435
申请日：2010-11-22
申请人： Shay Artzi , Ryan Berg , John Peyton , Marco Pistoia , Manu Sridharan , Takaaki Tateishi , Omer Tripp , Robert Wiener
发明人： Shay Artzi , Ryan Berg , John Peyton , Marco Pistoia , Manu Sridharan , Takaaki Tateishi , Omer Tripp , Robert Wiener
IPC分类号： G06F11/07 , G06F9/455
CPC分类号： G06F21/577 , G06F21/00 , G06F2221/034
摘要： A method includes determining selected global variables in a program for which flow of the selected global variables through the program is to be tracked. The selected global variables are less than all the global variables in the program. The method includes using a static analysis performed on the program, tracking flow through the program for the selected global variables. In response to one or more of the selected global variables being used in security-sensitive operations in the flow, use is analyzed of each one of the selected global variables in a corresponding security-sensitive operation. In response to a determination the use may be a potential security violation, the potential security violation is reported. Apparatus and computer program products are also disclosed.
摘要翻译：一种方法包括确定在所述程序中选择的全局变量，通过所述程序，所选择的全局变量的流程将被跟踪。所选的全局变量小于程序中的所有全局变量。该方法包括使用对程序执行的静态分析，跟踪所选择的全局变量的程序流程。响应于在流中的安全敏感操作中使用的一个或多个所选择的全局变量，在相应的安全敏感操作中对所选择的全局变量中的每一个进行分析。为了回应确定，使用可能是潜在的安全违规，报告潜在的安全违规。还公开了装置和计算机程序产品。

2. 发明申请

US20120131670A1 Global Variable Security Analysis 失效
标题翻译：全局变量安全分析
公开(公告)号：US20120131670A1
公开(公告)日：2012-05-24
申请号：US12951435
申请日：2010-11-22
申请人： Shay Artzi , Ryan Berg , John Peyton , Marco Pistoia , Manu Sridharan , Takaaki Tateishi , Omer Tripp , Robert Wiener
发明人： Shay Artzi , Ryan Berg , John Peyton , Marco Pistoia , Manu Sridharan , Takaaki Tateishi , Omer Tripp , Robert Wiener
IPC分类号： G06F21/00
CPC分类号： G06F21/577 , G06F21/00 , G06F2221/034
摘要： A method includes determining selected global variables in a program for which flow of the selected global variables through the program is to be tracked. The selected global variables are less than all the global variables in the program. The method includes using a static analysis performed on the program, tracking flow through the program for the selected global variables. In response to one or more of the selected global variables being used in security-sensitive operations in the flow, use is analyzed of each one of the selected global variables in a corresponding security-sensitive operation. In response to a determination the use may be a potential security violation, the potential security violation is reported. Apparatus and computer program products are also disclosed.
摘要翻译：一种方法包括确定在所述程序中选择的全局变量，通过所述程序，所选择的全局变量的流程将被跟踪。所选的全局变量小于程序中的所有全局变量。该方法包括使用对程序执行的静态分析，跟踪所选择的全局变量的程序流程。响应于在流中的安全敏感操作中使用的一个或多个所选择的全局变量，在相应的安全敏感操作中对所选择的全局变量中的每一个进行分析。为了回应确定，使用可能是潜在的安全违规，报告潜在的安全违规。还公开了装置和计算机程序产品。

3. 发明授权

US08365281B2 Determining whether method of computer program is a validator 失效
标题翻译：确定计算机程序的方法是否为验证程序
公开(公告)号：US08365281B2
公开(公告)日：2013-01-29
申请号：US12950432
申请日：2010-11-19
申请人： Takaaki Tateishi , Marco Pistoia , Omer Tripp , Ryan Berg , Robert Wiener
发明人： Takaaki Tateishi , Marco Pistoia , Omer Tripp , Ryan Berg , Robert Wiener
IPC分类号： G06F11/00 , G06F11/30 , H04L29/06 , H04L9/32
CPC分类号： G06F21/50 , G06F21/563
摘要： An illegal pattern and a computer program having a method are received. The method has one or more return statements, and a number of basic blocks. The method is normalized so that each return statement of the target method relating to the illegal pattern returns a constant Boolean value. A first path condition and a second path condition for one or more corresponding paths is determined such that one or more corresponding basic blocks return a constant Boolean value of true for the first path condition and a constant Boolean value of false for the second path condition. An unsatisfiability of each path condition is determined using a monadic second-order logic (M2L) technique. Where the unsatisfiability of either path condition is false, the method is reported as not being a validator. Where the unsatisfiability of either path condition is true, the method is reported as being a validator.
摘要翻译：接收到具有方法的非法模式和计算机程序。该方法具有一个或多个返回语句和一些基本块。该方法被归一化，使得与非法模式相关的目标方法的每个返回语句返回一个常量布尔值。确定用于一个或多个对应路径的第一路径条件和第二路径条件，使得一个或多个对应的基本块返回针对第一路径条件的常数布尔值为true，对于第二路径条件返回常量布尔值为假。使用一元二阶逻辑（M2L）技术确定每个路径条件的不满足性。如果任一路径条件的不满足性为假，则将该方法报告为不是验证器。如果任一路径条件的不满足性为真，则将该方法报告为验证器。

4. 发明申请

US20120131669A1 Determining whether method of computer program is a validator 失效
标题翻译：确定计算机程序的方法是否为验证程序
公开(公告)号：US20120131669A1
公开(公告)日：2012-05-24
申请号：US12950432
申请日：2010-11-19
申请人： Takaaki Tateishi , Marco Pistoia , Omer Tripp , Ryan Berg , Robert Wiener
发明人： Takaaki Tateishi , Marco Pistoia , Omer Tripp , Ryan Berg , Robert Wiener
IPC分类号： G06F21/00
CPC分类号： G06F21/50 , G06F21/563
摘要： An illegal pattern and a computer program having a method are received. The method has one or more return statements, and a number of basic blocks. The method is normalized so that each return statement of the target method relating to the illegal pattern returns a constant Boolean value. A first path condition and a second path condition for one or more corresponding paths is determined such that one or more corresponding basic blocks return a constant Boolean value of true for the first path condition and a constant Boolean value of false for the second path condition. An unsatisfiability of each path condition is determined using a monadic second-order logic (M2L) technique. Where the unsatisfiability of either path condition is false, the method is reported as not being a validator. Where the unsatisfiability of either path condition is true, the method is reported as being a validator.
摘要翻译：接收到具有方法的非法模式和计算机程序。该方法具有一个或多个返回语句和一些基本块。该方法被归一化，使得与非法模式相关的目标方法的每个返回语句返回一个常量布尔值。确定用于一个或多个对应路径的第一路径条件和第二路径条件，使得一个或多个对应的基本块返回针对第一路径条件的常数布尔值为true，对于第二路径条件返回常量布尔值为假。使用一元二阶逻辑（M2L）技术确定每个路径条件的不满足性。如果任一路径条件的不满足性为假，则将该方法报告为不是验证器。如果任一路径条件的不满足性为真，则将该方法报告为验证器。

5. 发明申请

US20120297372A1 Static Analysis Of Validator Routines 失效
标题翻译：验证程序的静态分析
公开(公告)号：US20120297372A1
公开(公告)日：2012-11-22
申请号：US13109170
申请日：2011-05-17
申请人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F9/44
CPC分类号： G06F11/3612 , G06F8/436 , G06F11/3604
摘要： A method includes accessing a validator routine having an input string and one or more return points, each return point returning a return value having two possible values; finding the return points in the validator routine; for each of the return points, performing a backwards traversal from a return point through a code section and determining constraints on the input string based at least on one or both of the two possible return values for the return point; using the determined constraints for the input string, determining whether all of the return values returned from the one or more return points meet validation constraints; and outputting one or more indications of whether all of the returned values returned from the return points meet the validation constraints for the one or both of the two possible return values. Apparatus and computer program products are also disclosed.
摘要翻译：一种方法包括访问具有输入字符串和一个或多个返回点的验证器程序，每个返回点返回具有两个可能值的返回值; 找到验证程序的返回点; 对于每个返回点，通过代码部分从返回点执行向后遍历，并且基于返回点的两个可能返回值中的至少一个或两个来确定对输入字符串的约束; 使用确定的输入字符串的约束，确定从一个或多个返回点返回的所有返回值是否满足验证约束; 并且输出一个或多个指示是否从返回点返回的所有返回值是否满足两个可能返回值中的一个或两个的验证约束。还公开了装置和计算机程序产品。

6. 发明授权

US08726246B2 Static analysis of validator routines 失效
标题翻译：验证程序的静态分析
公开(公告)号：US08726246B2
公开(公告)日：2014-05-13
申请号：US13109170
申请日：2011-05-17
申请人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F9/44
CPC分类号： G06F11/3612 , G06F8/436 , G06F11/3604
摘要： A method includes accessing a validator routine having an input string and one or more return points, each return point returning a return value having two possible values; finding the return points in the validator routine; for each of the return points, performing a backwards traversal from a return point through a code section and determining constraints on the input string based at least on one or both of the two possible return values for the return point; using the determined constraints for the input string, determining whether all of the return values returned from the one or more return points meet validation constraints; and outputting one or more indications of whether all of the returned values returned from the return points meet the validation constraints for the one or both of the two possible return values. Apparatus and computer program products are also disclosed.
摘要翻译：一种方法包括访问具有输入字符串和一个或多个返回点的验证器程序，每个返回点返回具有两个可能值的返回值; 找到验证程序的返回点; 对于每个返回点，通过代码部分从返回点执行向后遍历，并且基于返回点的两个可能返回值中的至少一个或两个来确定对输入字符串的约束; 使用确定的输入字符串的约束，确定从一个或多个返回点返回的所有返回值是否满足验证约束; 并且输出一个或多个指示是否从返回点返回的所有返回值是否满足两个可能返回值中的一个或两个的验证约束。还公开了装置和计算机程序产品。

7. 发明授权

US08572747B2 Policy-driven detection and verification of methods such as sanitizers and validators 失效
标题翻译：政策驱动的检测和验证方法，如消毒剂和验证器
公开(公告)号：US08572747B2
公开(公告)日：2013-10-29
申请号：US12950049
申请日：2010-11-19
申请人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F9/455
CPC分类号： G06F8/75 , G06F21/577
摘要： A method includes performing a static analysis on a program having sources and sinks to track string flow from the sources to the sinks. The static analysis includes, for string variables in the program that begin at sources, computing grammar of all possible string values for each of the string variables and, for methods in the program operating on any of the string variables, computing grammar of string variables returned by the methods. The static analysis also includes, in response to one of the string variables reaching a sink that performs a security-sensitive operation, comparing current grammar of the one string variable with a policy corresponding to the security-sensitive operation, and performing a reporting operation based on the comparing. Apparatus and computer program products are also disclosed.
摘要翻译：一种方法包括对具有源和汇的程序执行静态分析以跟踪从源到汇的字符串流。静态分析包括对于从源头开始的程序中的字符串变量，计算每个字符串变量的所有可能的字符串值的语法，对于在任何字符串变量上运行的程序中的方法，返回的字符串变量的计算语法通过方法。静态分析还响应于到达执行安全敏感操作的汇点之一的字符串变量之一，将一个字符串变量的当前语法与对应于安全敏感操作的策略进行比较，并且基于在比较上。还公开了装置和计算机程序产品。

8. 发明申请

US20120131668A1 Policy-Driven Detection And Verification Of Methods Such As Sanitizers And Validators 失效
标题翻译：政策驱动的检测和验证方法如消毒剂和验证器
公开(公告)号：US20120131668A1
公开(公告)日：2012-05-24
申请号：US12950049
申请日：2010-11-19
申请人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F21/00 , G06F9/44
CPC分类号： G06F8/75 , G06F21/577
摘要： A method includes performing a static analysis on a program having sources and sinks to track string flow from the sources to the sinks. The static analysis includes, for string variables in the program that begin at sources, computing grammar of all possible string values for each of the string variables and, for methods in the program operating on any of the string variables, computing grammar of string variables returned by the methods. The static analysis also includes, in response to one of the string variables reaching a sink that performs a security-sensitive operation, comparing current grammar of the one string variable with a policy corresponding to the security-sensitive operation, and performing a reporting operation based on the comparing. Apparatus and computer program products are also disclosed.
摘要翻译：一种方法包括对具有源和汇的程序执行静态分析以跟踪从源到汇的字符串流。静态分析包括对于从源头开始的程序中的字符串变量，计算每个字符串变量的所有可能的字符串值的语法，对于在任何字符串变量上运行的程序中的方法，返回的字符串变量的计算语法通过方法。静态分析还响应于到达执行安全敏感操作的汇点之一的字符串变量之一，将一个字符串变量的当前语法与对应于安全敏感操作的策略进行比较，并且基于在比较上。还公开了装置和计算机程序产品。

9. 发明申请

US20130091079A1 USING A HEURISTICALLY-GENERATED POLICY TO DYNAMICALLY SELECT STRING ANALYSIS ALGORITHMS FOR CLIENT QUERIES 有权
标题翻译：使用全景生成策略动态选择客户端查询的分析算法
公开(公告)号：US20130091079A1
公开(公告)日：2013-04-11
申请号：US13412121
申请日：2012-03-05
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F15/18
CPC分类号： G06N5/00
摘要： A method for dynamically selecting string analysis algorithms can begin with the training of the dynamic string analysis handler of a string analysis module to effectively handle a subset of string queries having contextual metadata received from a client application in an instructional environment. The effectiveness of the training module can be based upon feedback from the client application. Upon completion of the training, a string analysis algorithm selection policy can be synthesized. The string analysis algorithm selection policy can correlate a context of a string query in the subset to the usage of a string analysis algorithm. When in the operational environment, the dynamic string analysis handler can dynamically handle string queries having contextual metadata received from the client application in accordance with the string analysis algorithm selection policy. The string analysis algorithm to be used for a string query can be dynamically and independently determined.
摘要翻译：用于动态选择字符串分析算法的方法可以开始于字符串分析模块的动态字符串分析处理程序的训练，以有效地处理在教学环境中从客户端应用程序接收的具有上下文元数据的字符串查询的子集。培训模块的有效性可以基于客户端应用程序的反馈。完成培训后，可以合成字符串分析算法选择策略。字符串分析算法选择策略可以将子集中的字符串查询的上下文与字符串分析算法的使用相关联。在操作环境中，动态字符串分析处理程序可以根据字符串分析算法选择策略来动态地处理具有从客户端应用程序接收的上下文元数据的字符串查询。用于字符串查询的字符串分析算法可以动态和独立地确定。

10. 发明申请

US20120159619A1 Formal Analysis of the Quality and Conformance of Information Flow Downgraders 有权
标题翻译：信息流降级的质量和一致性的正式分析
公开(公告)号：US20120159619A1
公开(公告)日：2012-06-21
申请号：US12968646
申请日：2010-12-15
申请人： Ryan J. Berg , Marco Pistoia , Takaaki Tateishi , Stephen D. Teilhet , Omer Tripp
发明人： Ryan J. Berg , Marco Pistoia , Takaaki Tateishi , Stephen D. Teilhet , Omer Tripp
IPC分类号： G06F21/00 , G06F9/44
CPC分类号： G06F21/50 , G06F21/577
摘要： Mechanisms for evaluating downgrader code in application code with regard to one or more security guidelines are provided. Downgrader code in application code is identified, where the downgrader code is a portion of code in the application code that operates on an information flow of the application code to ensure confidentiality of information input to the downgrader code, in the output of the downgrader code. Processes of the downgrader code are evaluated against security guidelines to determine if the processes violate the security guidelines. A notification is generated in response to the evaluation indicating that the processes of the downgrader code violate the security guidelines. The notification is output to a computing device for consideration.
摘要翻译：提供了关于一个或多个安全指南的应用程序代码评估降级代码的机制。识别应用代码中的降级代码，其中降级代码是应用代码中的代码的一部分，其在应用代码的信息流上操作，以确保降级代码的输出中输入降级代码的信息的机密性。根据安全准则评估降级代码的过程，以确定进程是否违反安全性准则。产生响应于评估的通知，指示降级代码的处理违反安全准则。该通知被输出到计算设备以供考虑。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式