Patent ID: 8397300

Claim:
A system for detecting security vulnerabilities in computer software, the system comprising: a cryptographic API identifier configured to identify at least one cryptographic API among the source code instructions of a computer software application; a path-to-source tracer configured to trace at least one information flow path among said source code instructions between said cryptographic API and at least one source procedure that directly or indirectly provides data that are input to said cryptographic API, wherein at least one cryptographically-sensitive information carrier lies along said information flow path; a path-to-sink tracer configured to trace at least one information flow path among said source code instructions from said cryptographically-sensitive information carrier to at least one sink procedure; and a security vulnerability identifier configured to provide a notification that said information flow path between said cryptographically-sensitive information carrier and said sink procedure represents security vulnerability if said information flow path between said cryptographically-sensitive information carrier and said sink procedure does not pass through a cryptographic API, wherein said cryptographic API identifier, path-to-source tracer, path-to-sink tracer, and security vulnerability identifier are implemented in either of a) computer hardware configured to perform the functions of said cryptographic API identifier, path-to-source tracer, path-to-sink tracer, and security vulnerability identifier, and b) computer software embodied in a non-transitory, tangible, computer-readable storage medium.