Abstract:
The Secure Coding Framework (“SCF”) is a class library that wraps and replaces cyber-vulnerable primitives and operators of the underlying programming language used by the developer with secure classes and methods of its class library. The SCF is able to detect and thwart cyber attacks in a policy-based manner.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims priority to and the benefit of U.S. Provisional Application No. 62/159,250 filed on May 9, 2015. 
     
    
     REFERENCE TO COMPUTER PROGRAM LISTING IN APPENDIX A 
       [0002]    Listing #1(a)—the SecureInteger class 
         [0003]    Listing #1(b)—the SecureFloat class 
         [0004]    Listing #1(c)—the SecureByte class 
         [0005]    Listing #2—the SecureIntegerArray class 
         [0006]    Listing #3—the SecureIntegerRange class 
         [0007]    Listing #4—the SecureString class 
         [0008]    Listing #5—the SecureDimension class 
         [0009]    Listing #6—the SecureMultiDimension class 
         [0010]    Listing #7—the SecureCodingException class 
         [0011]    Listing #8—the SecureExceptionLogger class 
         [0012]    Listing #9—the SecureExceptionManager class 
         [0013]    Listing #10—the SecureExceptionTypes class 
         [0014]    Listing #11—the SecureRangeChecking class 
         [0015]    Listing #12—the SecurityPolicy class 
         [0016]    Listing #13—the SecureArrayIndex class 
         [0017]    Listing #14—the SecureArrayIndexRange class 
       BACKGROUND OF THE INVENTION 
       [0018]    The secure coding framework (SCF) is a software development tool that enables the construction of secure code. It is a response to the growing crisis in cybersecurity breaches, many of which prey on weaknesses in application code running on servers. The approach of SCF is rather unique in that it builds software that is self-protecting. It does not need protection from its boundaries. It is protected from within. It can detect attacks and react in a policy-driven fashion to thwart those attacks. 
         [0019]    The current method of developing secure code is to write functional code, pass it through one or more static and/or dynamic analysis tools to identify all instances of cyber vulnerabilities, and then remedy the offending code in accordance with a secure coding standard. Most such standards would be based on the Software Engineering Institute (SEI) Secure Coding Standard. 
         [0020]    The innovative approach, using SCF, is to replace the vulnerable aspects of the underlying programming language with a secure classes and methods as proxies. The secure proxies are constructed with built-in remedies to vulnerabilities from the SEI Secure Coding Standard. The SEI Secure Coding Standard presently supports C, C++, Java and Perl. For those languages that are not supported by the SEI, implementation would need to follow a parallel logic and provide language agnostic remedies to vulnerabilities identified in the Common Weakness Enumeration (CWE) and Open Web Application Security Project (OWASP). It should be noted that SCF does not support the C programming language as it is not object-oriented. Only the classes and methods of the SCF use vulnerable primitives and operators and they do so in a secure manner. Application developers do not use primitives and operators, but rather they use the secure classes and methods of SCF as proxies. SCF does not just remove instances of vulnerabilities from code, but it eliminates entire classes of vulnerabilities from code. By using SCF, it is nearly impossible to introduce covered cyber vulnerabilities into the source code. 
       SUMMARY OF THE INVENTION 
       [0021]    The SCF is a software framework that enforces CLaSP technology. The CLaSP technology transforms vulnerable object-oriented programming languages into a programming platform for developing secure software. The SCF supports the construction of secure code from the ground up. To the greatest extent possible, the solutions that are built-in to the design and implementation of this software are aligned with language-specific remedies for vulnerabilities documented in the Software Engineering Institute (SEI) Secure Coding Standards. 
     
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING 
         [0022]      FIG. 1  illustrates the template to follow for construction of the Secure&lt;Primitive&gt;classes. 
           [0023]      FIG. 2  illustrates the template to follow for construction of the Secure&lt;Primitive&gt;Array classes. 
           [0024]      FIG. 3  illustrates the template to follow for construction of the Secure&lt;Primitive&gt;Range classes. 
           [0025]      FIG. 4  illustrates the template to follow for construction of the SecureString classes. 
           [0026]      FIG. 5  illustrates the template to follow for construction of the SecureDimension class. 
           [0027]      FIG. 6  illustrates the template to follow for construction of the SecureMultiDimension class. 
           [0028]      FIG. 7  illustrates the template to follow for construction of the SecureCodingException class. 
           [0029]      FIG. 8  illustrates the template to follow for construction of the SecureExceptionLogger class. 
           [0030]      FIG. 9  illustrates the template to follow for construction of the SecureExceptionManager class. 
           [0031]      FIG. 10  illustrates the template to follow for construction of the SecureRangeChecking class. 
           [0032]      FIG. 11  illustrates the template to follow for construction of the SecureArrayIndex class. 
           [0033]      FIG. 12  illustrates the template to follow for construction of the SecureArrayIndexRange class. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0034]    For the purposes of promoting an understanding of the principles of the invention, reference will now be made to the embodiments illustrated in the drawings and specific language will be used to describe the same. It will nevertheless, be understood that no limitation of the scope of the invention is thereby intended. Any such alterations and further applications of the principles of the invention as illustrated herein are contemplated as would normally occur to one skilled in the art to which the invention relates. 
         [0035]    In  FIG. 1 , a template is provided for guidance in the implementation of the secure classes that serve as a proxy for the primitives of the underlying programming language. The template applies to each and every primitive of the programming language. If, for example, the Java programming language was selected as the underlying programming language, then the template must be used to create one class for each primitive of Java including: (a) char; (b) byte; (c) short; (d) int; (e) long; (f) float; and (g) double. The result would be construction of the following secure classes: (a) SecureCharacter; (b) SecureByte; (c) SecureShort; (d) SecureInteger; (e) SecureLong; (f) SecureFloat; and (g) SecureDouble. It should be appreciated that the disclosure of the Java programming language is for illustrative purposes only and that the invention is applicable to all programming languages and would vary per programming language. 
         [0036]    Each of the newly constructed secure classes would follow the template in accordance with the elements of  FIG. 1 . As stated above, the list of primitives will vary from language to language. The intent of this patent is to create a language agnostic approach to the construction of the SCF. 
       Secure &lt;Primitive&gt; 
       [0037]    The template of  FIG. 1  shows that the Secure&lt;Primitive&gt; class  100  contains attributes and methods including: (a) value attribute  110 ; (b) range attribute  120 ; (c) constructors and initialize methods  130 ; (d) access methods  140 ; (e) mathematical operator methods  150 ; (f) relational operator methods  160 ; (g) bit operator methods  170 ; and (h) type conversion methods. This class is used to securely replace primitives of the underlying programming language. The presence of this class and compliance with its specification (or its functional equivalent) is a primary component of the SCF. Primary components serve as proxies for primitives. 
         [0000]    The presence of this class and compliance with its specification (or its functional equivalent) is a mandatory requirement of the SCF. 
         [0038]    The attributes  110  include: (a) a primitive value; and (b) a range expressed as an instance of the Secure&lt;Primitive&gt;Range class. The attributes  110  must be private. By making the attributes  110  private, the SCF uses the concept of data hiding to protect data values from corruption. By design, these data values can only be set using methods of the class. 
         [0039]    The constructors  120  provide declarations and initializations of attributes  110 . Constructors must always be public. Constructors are expected to leverage the initialization methods  130  in their implementations. 
         [0040]    The initialization methods  130  provide default and/or user-defined settings for attributes  110 . Initialization methods are generally public. These methods are also used by the constructors  120 . 
         [0041]    The access methods  140  must provide getters and setters for attributes  110 . The access methods  140  must be public. The setters must perform range checking before assignments to the primitive value of attributes  110 . Exception handlers must be triggered when an attempt to assign values outside of the valid range are detected. However, constructors may not trigger exceptions. 
         [0042]    The mathematical operator methods  150  must be provided for each and every mathematical operator of the underlying programming language. The mathematical operator methods  150  must be public. 
         [0043]    The relational operator methods  160  must be provided for each and every relational operator of the underlying programming language with the exception of the Boolean operator. Since the Boolean operator has only two values, it is considered to be secure. It does not need a secure proxy. The relational operator methods  160  must be public. 
         [0044]    The bit operator methods  170  must be provide for each and every bit operator of the underlying programming language. The bit operator methods  170  must be public. While bit operator methods  170  are applicable to integer primitives, they are not applicable to floating point primitives. 
         [0045]    The type conversion methods  180  must be provided for typecasting to each and every Secure&lt;Primitive&gt; where such type conversions are valid. The decision is as to whether or not a typecast is valid left to the implementer. A good rule of thumb to follow is that widening typecasts are valid and narrowing typecast are not valid. The type conversion methods  180  must be public. 
         [0046]    Refer to Program Listing #1(a), #1(b) and #1(c) for an example of how this Secure&lt;Primitive&gt;class  100  might be implemented. 
       Secure &lt;Primitive&gt; Array 
       [0047]    The template illustrated in  FIG. 2  shows that the Secure&lt;Primitive&gt;Array class  200  contains attributes and methods including: (a) attributes  210 ; (b) constructors  220 ; (c) initialization methods  230 ; and (d) access methods  240 . This class is used to securely replace primitive arrays of the underlying programming language. The presence of this classes and compliance with its specification (or its functional equivalent) is mandatory and a primary requirement of the SCF. 
         [0048]    The attributes  210  includes: (a) primitive array; (c) range expressed as an instance of Secure&lt;Primitive&gt;Range; and (c) a dimension expressed as an instance of the SecureMultiDimension class. The attributes  210  must all be private. 
         [0049]    The constructors  220  provide declarations and initializations of attributes  210 . Constructors  220  must always be public. Constructors  220  are expected to leverage the initialization methods  230  in their implementations. 
         [0050]    The initialization methods  230  provide default and/or user-defined settings for attributes  210 . Initialization methods  230  are generally public. The initialization methods  230  are also used by the constructors  220 . 
         [0051]    The access methods  240  must provide getters and setters for attributes  210 . The access methods  240  must be public. The setters must perform range checking before assignments to the array value attribute  210 . Exception handlers must be triggered when an attempt to assign values outside of the valid range are detected. However, constructors may not trigger exceptions. 
         [0052]    Refer to Program Listing #2 for an example of how this Secure&lt;Primitive&gt;Array class  200  might be implemented. 
       Secure &lt;Primitive&gt; Range 
       [0053]    The template illustrated in  FIG. 3  shows that the Secure&lt;Primitive&gt;Range class  300  contains attributes and methods including: (a) attributes  310 ; (b) constructors  320 ; (c) initialization methods  330 ; (d) access methods  340 ; and (e) validity check  350 . This class is used to securely represent the valid range of numbers that can be assigned to Secure&lt;Primitives&gt; and indexed elements of Secure&lt;Primitive&gt; Arrays. The presence of this class and compliance with its specification (or its functional equivalent) is mandatory but a secondary component of the SCF. Secondary components provide functional support for primary components. 
         [0054]    The attributes  310  include a: (a) primitive user-defined minimum value; and (b) primitive user-defined maximum value: (c) language-specific minimum primitive value; and (d) language-specific maximum primitive value. Items (c) and (d) are constants. The values for these constants represent the lowest and highest number that can be represented in the primitive of the underlying programming language. Therefore these constant values are language dependent. 
         [0055]    The constructors  320  provide declarations and initializations of attributes  310 . Constructors  320  must always be public. Constructors  320  are expected to leverage the initialization methods  330  in their implementations. 
         [0056]    The initialization methods  330  provide default and/or user-defined settings for attributes  310 . Initialization methods  330  are generally public. The initialization methods  330  are also used by the constructors  320 . 
         [0057]    The access methods  340  must provide getters and setters for the range attributes  310 . The access methods  340  must be public. The setters must perform range checking before assignments to the range attribute  310 . Exception handlers must be triggered when an attempt to assign values outside of the valid range are detected. However, constructors may not trigger exceptions. 
         [0058]    The validity check method  350  determines whether or not the user-defined range attributes are valid. Refer to Sequence Listing #3 for an example of how this Secure&lt;Primitive&gt;Range class  300  might be implemented. 
       Secure String 
       [0059]    The template illustrated in  FIG. 4  shows that the SecureString class  400  contains attributes and methods including: (a) attributes  410 ; (b) constructors  420 ; (c) initialization methods  430 ; (d) access methods  440 ; (e) whitelisting methods  450 ; and (f) blacklisting methods  460 . This class is used to securely represent strings for specified and well known purposes. For example some strings are used as pathnames or filenames, URL, XML, HTTP, LDAP, SQL statements, etc. The presence of this class and compliance with its specification (or its functional equivalent) is mandatory and a primary component of the SCF. Primary components are proxies for the String class of standard libraries or a primitive character array. 
         [0060]    The attributes  410  include: (a) character array (or string); (b) array (or string) size; (c) type of string; (d) the active rule (whitelist or blacklist); (e) character list; and (f) character sequence list. 
         [0061]    The constructors  420  provide declarations and initializations of attributes  410 . Constructors  420  must always be public. Constructors  420  are expected to leverage the initialization methods  430  in their implementations. 
         [0062]    The initialization methods  430  provide default and/or user-defined settings for attributes  410 . Initialization methods  430  are generally public. The initialization methods  430  are also used by the constructors  420 . 
         [0063]    The access methods  440  must provide getters and setters for attributes  410 . The access methods  440  must be public. 
         [0064]    The whitelisting methods  450  include: (a) whitelist character; and (b) whitelist character sequence. The whitelist is a listing of allowable characters or character sequences in the string. 
         [0065]    The blacklisting methods  460  include: (a) blacklist character; and (b) backlist character sequence. The blacklist is a listing of disallowed characters or character sequences in the string. 
         [0066]    Refer to Program Listing #4 for an example of how this SecureString class  400  might be implemented. 
       Secure Dimension 
       [0067]    The template illustrated in  FIG. 5  shows that the SecureDimension class  500  contains attributes and methods including: (a) attributes  510 ; (b) constructors  520 ; (c) initialization methods  530 ; (d) access methods  540 ; (e) increment method  550 ; and (f) decrement method  560 . This class is used to securely represent the dimensional aspect of a single dimensional numeric array. The presence of this class and compliance with its specification (or its functional equivalent) is mandatory but a secondary component of the SCF. Secondary components provide functional support for primary components. 
         [0068]    The attributes  510  includes: (a) primitive size; and (b) index in the form of an instance of the SecureArrayIndex class. 
         [0069]    The constructors  520  provide declarations and initializations of attributes  510 . Constructors must always be public. Constructors are expected to leverage the initialization methods in their implementations. 
         [0070]    The initialization methods  530  provide default and/or user-defined settings for attributes  510 . Initialization methods  530  are generally public. The initialization methods  530  are also used by the constructors  520 . 
         [0071]    The access methods  540  must provide getters and setters for attributes  510 . The access methods  540  must be public. 
         [0072]    The increment method  550  increases the index by 1. The index must be within the boundary of the array. 
         [0073]    The decrement method  560  decreases the index by 1. The index must be within the boundary of the array. 
         [0074]    Refer to Program Listing #5 for an example of how this SecureDimension class  500  might be implemented. 
       Secure Multi Dimension 
       [0075]    The template illustrated in  FIG. 6  shows that the SecureMultiDimension class  600  contains attributes and methods including: (a) attributes  610 ; (b) constructors  620 ; (c) initialization methods  630 ; and (d) access methods  640 . This class is used to securely represent the dimensional aspect of a multi-dimensional numeric array. The presence of this class and compliance with its specification (or its functional equivalent) is mandatory but a secondary component of the SCF. Secondary components provide functional support for primary components. 
         [0076]    The attributes  610  include: (a) primitive size; (b) primitive number of dimensions; and (c) an array of dimensions expressed as an array of SecureDimension instances; and (d) primitive maximum number of dimensions. Attribute (d) is a constant. 
         [0077]    The constructors  620  provide declarations and initializations of attributes  610 . Constructors must always be public. Constructors  620  are expected to leverage the initialization methods  630  in their implementations. 
         [0078]    The initialization methods  630  provide default and/or user-defined settings for attributes  610 . Initialization methods are generally public. The initialization methods  630  are also used by the constructors  620 . 
         [0079]    The access methods  640  must provide getters and setters for attributes  610 . The access methods  640  must be public. 
         [0080]    Refer to Program Listing #6 for an example of how this SecureMultiDimension class  600  might be implemented. 
       Secure Coding Exception 
       [0081]    The template illustrated in  FIG. 7  shows that the SecureCodingException class  700  contains attributes and methods including: (a) attributes  710 ; (b) constructors  720 ; (c) initialization methods  730 ; and (d) access methods  740 . This class is used to securely represent exceptions for specified exception types. For an example some exceptions might indicate an integer overflow or integer underflow, while others might indicate loss of sign, magnitude or precision in floating point operations, etc. The presence of this class and compliance with its specification (or its functional equivalent) is mandatory but a secondary component of the SCF. Secondary components provide functional support for primary components. 
         [0082]    The attributes  710  include primitive immutable constant values for each exception type used in the SCF. 
         [0083]    The constructors  720  provide declarations and initializations of attributes  710 . Constructors must always be public. Constructors  720  are expected to leverage the initialization methods  730  in their implementations. 
         [0084]    The initialization methods  730  provide default and/or user-defined settings for attributes  710 . Initialization methods are generally public. The initialization methods  730  are also used by the constructors  720 . 
         [0085]    The access methods  740  must provide getters and setters for attributes  710 . The access methods  740  must be public. 
         [0086]    Refer to Program Listing #7 for an example of how this SecureCodingException class  700  might be implemented. 
       Secure Exception Logger 
       [0087]    The template illustrated in  FIG. 8  shows that the SecureExceptionLogger class  800  contains attributes and methods including: (a) attributes  810 ; (b) constructors  820 ; (c) initialization methods  830 ; (d) access methods  840 ; (e) streaming methods  850 ; and (f) logging methods  860 . This class is used to log exceptions. The presence of this class and compliance with its specification (or its functional equivalent) is not a mandatory requirement of the SCF but is highly recommended. This logging capability provides a consistent approach to recording malicious attacks upon the software application. The presence of this class and compliance with its specification (or its functional equivalent) is mandatory but a secondary component of the SCF. Secondary components provide functional support for primary components. 
         [0088]    The attributes  810  include: (a) a filename expressed as a character array (or an instance of a String class; (b) file stream; and (c) print steam. 
         [0089]    The constructors  820  provide declarations and initializations of attributes  810 . Constructors  820  must always be public. Constructors  820  are expected to leverage the initialization methods  830  in their implementations. 
         [0090]    The initialization methods  830  provide default and/or user-defined settings for attributes  810 . Initialization methods  830  are generally public. The initialization methods  830  are also used by the constructors  820 . 
         [0091]    The access methods  840  must provide getters and setters for attributes  810 . The access methods  840  must be public. 
         [0092]    The streaming methods  850  must provide file streaming and print streaming redirection in support of logging exceptions. 
         [0093]    The logging methods  860  must provide a general capability to log exceptions. 
         [0094]    Refer to Sequence Listing #8 for an example of how this SecureExceptionLogger class  800  might be implemented. 
       Secure Exception Manager 
       [0095]    The template illustrated in  FIG. 9  shows that the SecureExceptionManager class  900  contains attributes and methods including: (a) attributes  910 ; (b) constructors  920 ; (c) initialization methods  930 ; and (d) access methods  940 . This class is used to manage exceptions in accordance with a security policy. The presence of this class and compliance with its specification (or its functional equivalent) is mandatory but a secondary component of the SCF. Secondary components provide functional support for primary components. 
         [0096]    The attributes  910  are left to the discretion of the designer. Exception handling will vary greatly from one implementation to another. 
         [0097]    The constructors  920  provide declarations and initializations of attributes  910 . Constructors  920  must always be public. Constructors  920  are expected to leverage the initialization methods  930  in their implementations. 
         [0098]    The initialization methods  930  provide default and/or user-defined settings for attributes  910 . Initialization methods are generally public. The initialization methods  930  are also used by the constructors  920 . 
         [0099]    The access methods  940  must provide getters and setters for attributes  910 . The access methods  940  must be public. 
       Secure Range Checking 
       [0100]    The template illustrated in  FIG. 10  shows that the SecureRangeChecking class  1000  contains attributes and methods including: (a) attributes  1010 ; (b) constructors  1020 ; (c) initialization methods  1030 ; and (d) access methods  1040 . This class is used to perform range checking required by numeric and string classes. The presence of this class and compliance with its specification (or its functional equivalent) is mandatory but a secondary component of the SCF. Secondary components provide functional support for primary components. 
         [0101]    The attributes  1010  includes an enabled value expressed as Boolean. The status of the enabled value is either true or false. The attribute  1010  is private. 
         [0102]    The constructors  1020  provide declarations and initializations of attributes  1010 . Constructors must always be public. Constructors are expected to leverage the initialization methods in their implementations. 
         [0103]    The initialization methods  1030  provide default and/or user-defined settings for attributes  1010 . Initialization methods  1030  are generally public. The initialization methods  1030  are also used by the constructors  1020 . 
         [0104]    The access methods  1040  must provide getters and setters for attributes  1010 . The access methods  1040  must be public. 
         [0105]    The enable method  1050  toggles range checking on. The enable method  1050  must be public. 
         [0106]    The disable method  1060  toggles range checking off. The disable method  1060  must be public. 
         [0107]    Refer to Program Listing #10 for an example of how this SecureRangeChecking class  1000  might be implemented. 
       Secure Array Index 
       [0108]    The template illustrated in  FIG. 11  shows that the SecureArrayIndex class  1100  contains attributes and methods including: (a) attributes  1110 ; (b) constructors  1120 ; (c) initialization methods  1130 ; (d) access methods  1140 ; (e) increment method  1150 ; and (f) decrement method  1160 . This class is used to represent indexes of secure arrays for both numeric and character strings. The presence of this class and compliance with its specification (or its functional equivalent) is mandatory but a secondary component of the SCF. Secondary components provide functional support for primary components. 
         [0109]    The attributes  1110  include (a) primitive index; and (b) range expressed as an instance of a SecureArrayIndexRange class. 
         [0110]    The constructors  1120  provide declarations and initializations of attributes  1110 . Constructors must always be public. Constructors are expected to leverage the initialization methods in their implementations. 
         [0111]    The initialization methods  1130  provide default and/or user-defined settings for attributes  1110 . Initialization methods are generally public. These methods are also used by the constructors  1120 . 
         [0112]    The access methods  1140  must provide getters and setters for attributes  1110 . The access methods  1140  must be public. 
         [0113]    The increment method  1150  increases the index by 1. The increment method must be public. 
         [0114]    The decrement method  1160  decreases the index by 1. The decrement method must be public. 
         [0115]    Refer to Program Listing #11 for an example of how this SecureArrayIndex class  1100  might be implemented. 
       Secure Array Index Range 
       [0116]    The template illustrated in  FIG. 12  shows that the SecureArrayIndexRange class  1200  contains attributes and methods including: (a) attributes  1210 ; (b) constructors  1220 ; (c) initialization methods  1230 ; (d) access methods  1240 ; and (e) validation method  1150 . This class provides for the definition of a valid range for the SecureArrayIndex class. The presence of this class and compliance with its specification (or its functional equivalent) is mandatory but a secondary component of the SCF. Secondary components provide functional support for primary components. 
         [0117]    The attributes  1210  include: (a) primitive user-defined minimum value; (b) primitive user-defined maximum value; (c) primitive language-specific maximum value; and (d) primitive language-specific minimum value. The attributes (a) and (b) must be private. The attributes (c) and (d) must be immutable constants. 
         [0118]    The constructors  1220  provide declarations and initializations of attributes  1210 . Constructors must always be public. Constructors are expected to leverage the initialization methods in their implementations. 
         [0119]    The initialization methods  1230  provide default and/or user-defined settings for attributes  1210 . Initialization methods are generally public. These methods are also used by the constructors  1220 . 
         [0120]    The access methods  1240  must provide getters and setters for attributes  1410 . The access methods  1440  must be public. 
         [0121]    The validation method  1250  determines the validity of an assignment to an index with the specified range. The validation method  1250  must be public. 
         [0122]    Refer to Program Listing #12 for an example of how this SecureArrayIndexRange class  1200  might be implemented. 
         [0123]    Although the various embodiments illustrated in the drawings have been described as having particular features and/or combinations of components, other embodiments are possible having a combination f any features and/or components from any of the embodiments discussed above. As used in this specification, the singular forms “a”, “an”, and “the” include plural referents unless the context clearly indicates otherwise. 
         [0124]    While the invention has been illustrated and described in detail in the drawings and foregoing description, the same is to be considered as illustrative and not restrictive in character, it being understood that all changes and modifications that come within the spirit of the invention are desired to be protected.