Mitigating security risks via code movement

Abstract

A method includes performing on a computing system a source-to-sink reachability analysis of code of an application. The reachability analysis is performed using a static analysis of the code and determines flows from sources of information to sinks that use the information. The method includes determining scopes for corresponding security sensitive operations using the determined flows, each of the security sensitive operations corresponding to statements in the code and one or more flows. A scope for a security sensitive operation includes a block of statements in the code that correspond to a set of one or more flows ending at a sink. The method includes, for each of one or more selected scopes, moving statements in a corresponding block of statements that are independent of a security sensitive operation in the block to code before or after the block. Apparatus and program products are also disclosed.

1 . A method, comprising:
 performing on a computing system a source-to-sink reachability analysis of code of an application, wherein the source-to-sink reachability analysis is performed using a static analysis of the code and determines flows from sources of information to sinks that use the information;   determining scopes for corresponding security sensitive operations using the determined flows, each of the security sensitive operations corresponding to statements in the code and one or more flows, wherein a scope for a security sensitive operation comprises a block of statements in the code that correspond to a set of one or more flows ending at a sink; and   for each of one or more selected scopes, moving statements in a corresponding block of statements that are independent of a security sensitive operation in the block to a section of code before or after the block.   
     
     
         2 . The method of  claim 1 , further comprising, prior to moving statements, performing a dependence analysis to determine statements in the block that are dependent on other statements in the block, wherein moving statements uses output of the dependence analysis in order to determine the statements in the corresponding block of statements that are independent of the security sensitive operation in the block to a section of code before or after the block. 
     
     
         3 . The method of  claim 2 , wherein a statement s is dependent on statement s′ in response to statement s reading a memory location written by the statement s′, or the statement s writing a memory location accessed by the statement s′. 
     
     
         4 . The method of  claim 2 , wherein the source-to-sink reachability analysis is performed before the dependence analysis. 
     
     
         5 . The method of  claim 2 , wherein the source-to-sink reachability analysis is performed after the dependence analysis. 
     
     
         6 . The method of  claim 2 , wherein performing a dependence analysis further comprises determining relationships between a plurality of atomic statements, wherein the atomic statements correspond to statements in the block. 
     
     
         7 . The method of  claim 2 , further comprising, prior to moving statements and using output of the dependence analysis, finding candidate statements in a block of statements for movement, and wherein moving statements further comprises moving the candidate statements that are independent of the security sensitive operations in the block to a section of code before or after the blocks. 
     
     
         8 . The method of  claim 7 , wherein finding candidate statements in a block of statements for movement further comprises finding, using results of the dependence analysis, candidate statements that do not transitively depend on statements in a corresponding security sensitive operation. 
     
     
         9 . The method of  claim 1 , further comprising presenting on a display indication of the statements to be moved before or after the block and where the statements would be moved in the code, allowing the changes to be accepted or rejected by a user, and performing the moving the statements in response to a user accepting the changes. 
     
     
         10 . The method of  claim 1 , further comprising outputting code comprising statements that were moved statements and statements that were not moved. 
     
     
         11 - 25 . (canceled)