Apparatus and method for developing secure software
A computer readable medium includes executable instructions to analyze program instructions for security vulnerabilities. The executable instructions convert diverse program instruction formats to a common format. A system model is derived from the common format. A static analysis is performed on the system model to identify security vulnerabilities. Security vulnerabilities are then reported.
1. A computer readable medium including stored executable instructions to analyze program instructions for security vulnerabilities, comprising instructions executing to:
convert diverse program instruction formats of a set of software applications executing on different platforms to a common format, wherein said executable instructions to convert include executable instructions to break down expressions of said diverse program instruction formats into a single set of equivalent sequences of simpler statements to support analysis of said diverse program instruction formats;
derive a system model from said common format, wherein said model characterizes program interactions between said diverse program instruction formats;
perform a static analysis on said system model to identify security vulnerabilities, wherein said static analysis includes analyzing said system model without executing said system model; and
report said security vulnerabilities.
2. The computer readable medium of claim 1 wherein said executable instructions to convert include executable instructions to convert different source or executable code formats executing on different platforms to said common format.
3. The computer readable medium of claim 1 wherein said executable instructions to convert include executable instructions to convert different machine instruction formats to said common format.
4. The computer readable medium of claim 1 wherein said executable instructions to convert include executable instructions to convert different program configuration file formats to said common format.
5. The computer readable medium of claim 1 wherein said executable instructions to convert include executable instructions to convert a program instruction expression into an equivalent sequence of simpler statements defined in said common format.
6. The computer readable medium of claim 5 wherein said executable instructions to convert include executable instructions to convert said program instruction expression into an equivalent sequence of simpler statements that includes a temporary variable.
7. The computer readable medium of claim 1 wherein said executable instruction to derive include executable instructions to derive a system model characterizing multiple inter-operative applications.
8. The computer readable medium of claim 1 wherein said executable instructions to perform include executable instructions to identify locations where input is taken from outside the program instruction formats.
9. The computer readable medium of claim 8 wherein said executable instructions to perform include executable instructions to trace the processing of said input throughout said diverse program instruction formats.
10. The computer readable medium of claim 1 wherein said executable instructions to perform include executable instructions to identify at least one of the following security vulnerabilities: stack buffer overflow, heap buffer overflow, format string attack, SQL injection, an ordering problem, and protocol misuse.
11. The computer readable medium of claim 1 wherein said executable instructions to perform a static analysis include executable instructions to perform a static analysis selected from a static data flow analysis, a lexical analysis, a semantic analysis, and a program control flow analysis.
12. The computer readable medium of claim 1 wherein said executable instructions to report include executable instructions to report a vulnerability, a vulnerability entry point, and a vulnerability processing path.
13. The computer readable medium of claim 1 wherein said executable instructions to report include executable instructions to report said security vulnerabilities to a security test module and a security monitoring module.
14. A method of analyzing stored program instructions for security vulnerabilities, comprising:
converting diverse program instruction formats of a set of software applications executing on different platforms to a common format, wherein converting includes breaking down expressions of said diverse program instruction formats into a single set of equivalent sequences of simpler statements to support analysis of said diverse program instruction formats;
deriving a system model from said common format, wherein said system model characterizes program interactions between said diverse program instruction formats;
performing a static analysis on said system model to identify security vulnerabilities, wherein said static analysis includes analyzing said system model without executing said system model; and
reporting said security vulnerabilities.
15. The method of claim 14 wherein converting includes converting different source or executable code formats executing on different platforms to said common format.
16. The method of claim 14 wherein converting includes converting different machine instruction formats to said common format.
17. The method of claim 14 wherein converting includes converting different program configuration file formats to said common format.
18. The method of claim 14 wherein converting includes converting a program instruction expression into an equivalent sequence of simpler statements defined in said common format.
19. The method of claim 14 wherein deriving includes deriving a system model characterizing multiple inter-operative applications.
20. The method of claim 14 wherein performing a static analysis includes performing a static analysis selected from a static data flow analysis, a lexical analysis, a semantic analysis, and a program control flow analysis.