Fujitsu Corporation

Amazon Technologies, Inc.

Oksana Tkachuk

Sreeranga P Rajan

Indradeep Ghosh

Neha Rungta

Pauline Virginie Bolignano

Mukul Ranjan Prasad

John Byron Cook

Michael Tautschnig

Todd Granger MacDermid

Meng Li

Niloofar Razavi

Zhixing Xu

Praveen Murthy

Juan Rodriguez Hortala

Sean Maher

Vishal Gori

Claudia Cauli

Saeed Nejati

Techniques are described for analyzing privilege escalation risks within the accounts, roles, and policies that comprise an organization's cloud provider environment. Privilege escalation refers broadly to scenarios in which a principal (e.g., a person or application) is able to gain access to resources or actions in a cloud provider environment that exceed a level intended for that principal. In the context of cloud provider environments, for example, such privilege escalation risks can result from the misconfiguration of policies and permissions attached to identities (e.g., users, groups of users, or roles) within an organization's environment. A multi-layer reasoning framework is used to build an ontology model of an organization's identities and relations among the identities, including defined access relationships, permission mutation relationships, and credential mutation relationships. The framework is further used to query the ontology model to identify particular identities associated with one or more specific types of privilege escalation risks.

Analyzing privilege escalation risks using a multi-layer reasoning framework

Techniques are described for a domain-specific language and associated framework for implementing analyses of security, operational, or functional properties involving computing resources. The specification language enables users to readily define the semantics of a set of cross-resource relations of interest using a human-readable language. For example, the language enables users to express properties over computing resources based on a user-defined set of cross-resource relations. The specification language is human-readable, allowing users to easily add new cross-resource relations or to modify existing relations and properties, thereby enabling users to readily modify existing analyses or to create new ones entirely. The specification language is also machine-readable such that a compiler and other tools can automatically generate an ontology model based on local resource configurations, augment the graph with the cross-resource relations defined in the specifications, and perform graph reachability analyses based on defined properties of interest.

Specification language for generating graph reachability-based analyses for cloud-based system resources

This disclosure describes techniques for automating a system-level security review of a network-based service. The techniques may include generating and utilizing a machine-readable threat model to identify system-level security threats to the network-based service. The network-based service may be scanned upon being provisioned in a service-provider network, and the machine-readable threat model may be generated based on results of the scan. The machine-readable threat model may represent components of the network-based service, system-level security constraints configured to identify system-level security threats to the service, and mitigations to remedy violations to the system-level security constraints. The network-based service may be continuously, or periodically, scanned to identify changes in the network-based service. The techniques further include updating the machine-readable threat model to account for the detected changes to the network-based service, and analyzing the updated machine-readable threat model to determine whether the changes to the network-based service violate a system-level security constraint.

Automated threat modeling using machine-readable threat models

In some embodiments, a system is provided, and computer-executable instructions cause the system to: obtain a file with instructions for provisioning resources of a service by referencing types of compute resources and including instructions for generating a customized resource of a first type; determine that the file references a first type of compute resources; retrieve threat modeling information associated with the first type of resource, including information identifying a first potential threat; generate a graph with nodes representing the first type of resource, the customized resource, and the first potential threat, and an edge connecting the first node and the second node with a predicate indicative of the relationship them; generate an ontology statement that relate the customized resource and first type of resource; and provide a plurality of ontology statements representing the graph to a reasoner to perform at least a portion of a security review without user intervention.

Automatically generating a machine-readable threat model using a template associated with an application or service

In accordance with a particular embodiment of the present invention, a method for generating a database model may include analyzing database configuration data for a database. The method may further include analyzing one or more database application programming interfaces for accessing the database. The method may also include generating one or more stubs based on the analyses, the one or more stubs configured to, when executed, model the database as if the database were populated with data.

System and a method for generating database model for analysis of applications

In particular embodiments, an environment for modular software analysis is generated for a software module under analysis. Irrelevancy analysis is performed on the software module to determine that, for each input datum to the software module, whether the input datum is relevant or irrelevant with respect to branch coverage of the module code. A default concrete value is assigned to each irrelevant input datum. A set of concrete values is calculated for each relevant input datum using symbolic execution. The environment is enhanced such that default concrete values are passed to the software module for the irrelevant input data and sets of concrete values generated using symbolic execution are passed to the software module for the relevant input data. The enhanced environment enables module analysis with as much as 100% branch coverage of the module code.

Environment data refinement based on static analysis and symbolic execution

In one embodiment, a method includes statically analyzing a validation toolkit environment. The method may also include, identifying a plurality of computational threads that do not share data structures with each other based on analysis of the validation toolkit environment. The method may additionally include calculating computational requirements of the computational threads. The method may further include distributing the threads among a plurality of resources such that the aggregate computational requirements of the computational threads are approximately evenly balanced among the plurality of resources.

Systems and methods for distributing validation computations

In one embodiment, a method includes accessing an event-driven application input by a user, the event-driven application comprising source code, one or more use cases input by the user for the event-driven application, and one or more functional requirements input by the user for the event-driven application; parsing the use cases and the functional requirements according to the predefined syntax to construct one or more validation modules for validating the event-driven application without any modification to the source code of the event-driven application for validation purposes; formally validating the event-driven application using the validation modules without relying on assertions inserted into the source code of the event-driven application for validation purposes; and if the formal validation finds one or more defects in the event-driven application, generating output for communication to the user identifying the defects.

Providing software validation as a service

In one embodiment, a method includes automated extraction of the Page Transition Graph (PTG) model for model-based analysis of web applications. Specifically, the method includes accessing one or more JAVASERVER PAGES (JSP) files, one or more Extensible Markup Language (XML) configuration files, and one or more class files of a web application; parsing the JSP files and extracting data in the JSP files that encode user or server events supported by the event-driven application; parsing the XML configuration files and extracting data in the XML configuration files that encode definitions used by the event-driven application when deployed; parsing the class files and extracting data in the class files that encode one or more actions or one or more forms used by the event-driven application when deployed; storing the extracted data as an abstract syntax tree (AST); populating a page transition graph (PTG) of the event-driven application based on the AST; and checking the extracted PTG for navigation errors such as unreachable pages, ghost pages and undefined transitions.

Method and system to extract a navigation model for analysis of a web application

In one embodiment, a method includes specifying an application-specific navigation model of an event-driven application; analyzing the navigation model with respect to one or more navigation requirements of the event-driven application to determine whether the event-driven application satisfies the navigation requirements; generating one or more drivers for the event-driven application based on the navigation model; and traversing the navigation model with the application-independent event drivers to analyze the event-driven application with respect to one or more business-logic requirements of the event-driven application to determine whether the event-driven application satisfies the business-logic requirements.

Generating a driver for analysis of an event-driven application

A method for detecting software defects includes selecting from a target program comprising a plurality of modules a first module for evaluation and isolating the first module. The method also includes iteratively performing the following steps until the first module has been reduced such that a validation program is able to determine whether the first module contains a defect: generating an environment surrounding the first module, the generated environment preserving at least one external constraint on the first module; reducing the size of the first module; and reducing the number of program states associated with the first module.

Growing community of inventors

Palo Alto, CA, United States of America

Oksana Tkachuk