Patent ID: 8230477

Claim:
A method for the evaluation of security policies, the method further comprising the steps of: creating a static model of a program with a processor, wherein the static model comprises: an invocation graph (G=N, E), the invocation graph comprising a set of nodes (N) and a set of edges (E), the invocation graph being configured to visually represent programming methods as nodes, and the calling context that is associated with a respective programming method; and a points-to graph (G=N′, E′), the points-to graph being configured to model the dependencies that exist between program objects; determining an analysis domain for a plurality of sets of permission objects; determining a set of explicitly granted permissions for respective program methods; determining a set of permissions that have been granted to each subject object by traversing the points-to graph; determining a set of subject-granted permissions that respective subject-executed code receives as a result of being executed by a subject object; determining a set of permissions that are required by the program code; performing a policy evaluation operation upon each identified method node; and annotating the invocation graph with information that is determined from the policy evaluation operation.