Patent Document ID: 9317682
Application ID: 13707607

Base Claim:
1. A system for preventing security flaws in computer source code, the system comprising: one or more processors and a non-transitory memory having instructions such that when the instructions are executed, the one or more processors perform operations of: implementing a security information flow library embedded in a host programming language; typechecking, with a host programming language typechecker algorithm, at least one security policy written in the host programming language; typechecking, with the host programming language typechecker algorithm, at least one untrusted module written in a restricted subset of the host programming language; wherein the at least one untrusted module cannot access confidential data in the host programming language; wherein typechecking of the at least one untrusted module enforces the at least one security policy with the security information flow library; and wherein confidentiality and integrity are encoded separately into the security information flow library; and incrementally adding information flow security to an existing computer program by implementing at least one security policy to direct information flow between untrusted modules.

---

Claim 2:
2. The system as set forth in claim 1 , wherein the one or more processors further perform an operation of typechecking at least one trusted module, wherein the at least one trusted module comprises labeled values comprising high confidentiality values and high integrity values, and wherein the at least one untrusted module comprises unlabeled values comprising low confidentiality values and low integrity values.