Patent ID: 8006233
Filing Date: 2011-08-23
Classification: G06F

Abstract:
1. A method for verifying privileged and subject-executed code within a program, the method further comprising the steps of: constructing a static model of a program, wherein the static model comprises: identifying checkPermission nodes that are comprised within the invocation graph, wherein for each identified checkPermission node a permission set of the permission allocation sites that could flow to a Permission parameter of a method that is represented by the node with the context that is represented by the node is determined; performing a fixed-point iteration, wherein each determined permission set is propagated backwards across the nodes of the static model until a privilege-asserting code node is reached; associating each node of the invocation graph with a set of Permission allocation sites, the set of Permission allocation sites representing an over-approximation of all the Permissions that will be required at run time to execute the method represented by the node; analyzing each identified privilege-asserting code node and subject-executing code node to determine the Permission allocation site set that is associated with each privilege-asserting code node and subject-executing code node; determining the cardinality of a Permission allocation-site set that is associated with each privilege-asserting code node and subject-executing code node; and analyzing the resultant Permission allocation cardinality data.