System and method for producing secure data management software

• US 10,747,871 B2
• Filed: 06/21/2018
• Issued: 08/18/2020
• Est. Priority Date: 06/21/2018
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Abadi, Aharon, Abadi, Moria, Melamed, Roie, Shribman, Aidan
• Primary Examiner(s): Rahman, Shawnchoy
• Application Number:
  US16/013,949
• Publication Number:
  US 20190392133A1
• Time in Patent Office: 789 Days
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors

Abstract

A system for producing secure data management software, comprising at least one hardware processor adapted to: receive a plurality of data patterns, each comprising at least one data field identifier selected from a set of protected data field identifiers of at least one data repository, at least one output target, and an access instruction; identify in a plurality of computer instructions of the data management software one or more forbidden output instructions by matching one or more reaching definitions of some of the plurality of computer instructions with one or more of the plurality of data patterns; and remove the one or more forbidden output instructions from the plurality of computer instructions.

Claims

1. A system for producing secure data management software, comprising at least one hardware processor adapted to:

receive a plurality of data patterns, each comprising at least one data field identifier selected from a set of protected data field identifiers of at least one data repository, at least one output target, and an access instruction;

identify in a plurality of computer instructions of the data management software one or more forbidden output instructions by matching one or more reaching definitions of some of the plurality of computer instructions with one or more of the plurality of data patterns; and

remove the one or more forbidden output instructions from the plurality of computer instructions.

2. The system of claim 1, wherein identifying the one or more forbidden output instructions comprises:

identifying in the plurality of computer instructions one or more output instructions each having an instruction output target;

identifying in the plurality of computer instructions one or more protected variables having a value assigned by reading a protected data field from the at least one data repository;

applying data-flow analysis to the plurality of computer instructions to identify at least one reaching definition of at least one of the one or more output instructions, each identified reaching definition comprising at least one of the one or more protected variables;

identifying at least one suspect output instruction in the at least one of the one or more output instructions having at least one reaching definition comprising at least one of the one or more protected variables, wherein the at least one suspect output instruction has a first instruction output target and the at least one suspect output instruction'"'"'s at least one reaching definition has a first protected variable;

identifying a first protected data field read to assign a value to the first protected variable; and

identifying in the plurality of data patterns at least one data pattern having an output target matching the first instruction output target according to a target matching test and a data field identifier matching the first protected data field according to a variable matching test;

wherein the at least one data pattern'"'"'s access instruction forbids access from the first output target to the first protected data field.

3. The system of claim 1, wherein the at least one hardware processor is further adapted to write the plurality of computer instructions remaining after removing the one or more forbidden output instructions to a digital storage connected to the at least one hardware processor.

4. The system of claim 1, wherein the plurality of computer instructions are in a human readable programming language.

5. The system of claim 4, wherein the at least one hardware processor is further adapted to compile the plurality of computer instructions remaining after removing the one or more forbidden output instructions to produce compiled code comprising a plurality of machine language computer instructions or a plurality of intermediate language computer instructions.

6. The system of claim 5, wherein the at least one hardware processor is further adapted to install the compiled code on at least one other hardware processor of a data management system.

7. The system of claim 6, wherein the at least one other hardware processor executes at least one virtual machine.

8. The system of claim 6, wherein the at least one other hardware processor is connected to the at least one data repository via at least one other data communication network.

9. The system of claim 1, wherein the at least one hardware processor is further adapted to install the plurality of computer instructions remaining after removing the one or more forbidden output instructions on at least one other hardware processor of a data management system.

10. The system of claim 9, wherein the at least one other hardware processor executes at least one virtual machine.

11. The system of claim 9, wherein the at least one other hardware processor is connected to the at least one data repository via at least one other data communication network.

12. The system of claim 1, wherein the at least one target is a member of a group consisting of:

a file name value, a file name template value comprising at least one variable file name element, a network address value, a network address template value comprising at least one variable network address element, and a display device identifier.

13. The system of claim 1, wherein the at least one data field identifier is a member of a group consisting of:

an attribute identifier in a relational database table, a key identifier, a column identifier, a document name value, and a document name template value comprising at least on variable document name element.

14. The system of claim 1, wherein the set of protected data field identifiers comprises at least one data field identifier identifying at least one type of protected health information according to Health Insurance Portability and Accountability Act of 1996 (HIPAA) security regulations.

15. The system of claim 1, wherein the set of protected data field identifiers comprises at least one identifier identifying at least one of a group consisting of:

a patient name, an address, a Social Security number, a passport number, a national identification number, an electronic mail address, a telephone number, a fingerprint, a photographic image, a medical record, a bank account identifier, and an amount of money.

16. The system of claim 1, wherein the at least one data repository comprises a database.

17. The system of claim 1, wherein the at least one hardware processor receives the plurality of data patterns via a data communication network interface connected to the at least one hardware processor or by reading the plurality of data patterns from a digital storage connected to the at least one hardware processor.

18. A computer implemented method producing secure data management software, comprising:

receiving a plurality of data patterns, each comprising at least one data field identifier selected from a set of protected data field identifiers of at least one data repository, at least one output target, and an access instruction;

identifying in a plurality of computer instructions of the data management software one or more forbidden output instructions by matching one or more reaching definitions of some of the plurality of computer instructions with one or more of the plurality of data patterns; and

removing the one or more forbidden output instructions from the plurality of computer instructions.

19. A software program product for producing secure data management software, comprising:

a non-transitory computer readable storage medium;

first program instructions for receiving a plurality of data patterns, each comprising at least one data field identifier selected from a set of protected data field identifiers of at least one data repository, at least one output target, and an access instruction;

second program instructions for identifying in a plurality of computer instructions of the data management software one or more forbidden output instructions by matching one or more reaching definitions of some of the plurality of computer instructions with one or more of the plurality of data patterns; and

third program instructions for removing the one or more forbidden output instructions from the plurality of computer instructions;

wherein the first, second, and third program instructions are executed by at least one computerized processor from the non-transitory computer readable storage medium.