Managing security of source code

Patent metadata

Field	Value
Publication number	US-10089463-B1
Application number	US-201213626240-A
Country	US
Kind code	B1
Filing date	Sep 25, 2012
Priority date	Sep 25, 2012
Publication date	Oct 2, 2018
Grant date	Oct 2, 2018

Abstract

A method is used in managing security of source code. Source code characteristics are derived from a source code change. Based on the source code characteristics, risk information associated with the source code change is produced.

First claim

What is claimed is:

1. A computer-implemented method for use in managing security of source code, the computer-implemented method comprising:
receiving, from a user, an electronic request to submit a source code change;
performing an analysis of one or more prior source code changes associated with the user to determine the user's typical halstead complexity measure, typical cyclomatic complexity measure, typical afferent coupling measure, and typical efferent coupling measure, wherein said halstead measure describes a coding style of the user and is derived from a number of distinct operators, a number of distinct operands, a total number of operators, and a total number of operands in connection with the one or more prior source code changes, wherein the cyclomatic complexity measure relates to a number of linearly independent paths through a unit of a project, and wherein the afferent and efferent coupling measures relate respectively to a number of other classes that reference a class and a number of other classes referenced by a class;
determining a riskiness in connection with the received source code change by measuring a deviation in the received source code change from the said measures, wherein the riskiness indicates whether the user is genuine or fraudulent; and
based on the riskiness in connection with the received source code change, controlling submission of the source code change to a source code repository such that the source code change will be submitted if the riskiness indicates that the user is genuine and will be rejected if the riskiness indicates that the user is fraudulent.

2. The method of claim 1 , wherein the source code change originates from a developer workstation and is submitted to a source code repository.

3. The method of claim 1 , wherein the riskiness is used to help provide an intrusion-resilient source code repository.

4. The method of claim 1 , wherein determining the riskiness is based on profiling a user's coding style based on textual clues.

5. The method of claim 1 , wherein determining the riskiness is based on measuring the deviation in the change from a user's normal coding style.

6. The method of claim 1 , wherein determining the riskiness is based on measuring the deviation in the change from file types that a user typically edits.

7. The method of claim 1 , wherein determining the riskiness is based on measuring the deviation in the change from a user's typical comment style.

8. The method of claim 1 , wherein determining the riskiness is based on measuring the deviation in the change from a user's typical writing errors.

9. The method of claim 1 , wherein determining the riskiness is based on measuring the deviation in the change from a user's typical naming conventions.

10. A system for use in managing security of source code, the system comprising:
memory; and
processing circuitry coupled to the memory, the memory storing instructions which, when executed by the processing circuitry, cause the processing circuitry to:
receive, from a user, an electronic request to submit a source code change;
perform an analysis of one or more prior source code changes associated with the user to determine the user's typical halstead complexity measure, typical cyclomatic complexity measure, typical afferent coupling measure, and typical efferent coupling measure, wherein said halstead measure describes a coding style of the user and is derived from a number of distinct operators, a number of distinct operands, a total number of operators, and a total number of operands in connection with the one or more prior source code changes, wherein the cyclomatic complexity measure relates to a number of linearly independent paths through a unit of a project, and wherein the afferent and efferent coupling measures relate respectively to a number of other classes that reference a class and a number of other classes referenced by a class;
determine a riskiness in connection with the received source code change by measuring a deviation in the received source code change from the said measures, wherein the riskiness indicates whether the user is genuine or fraudulent; and
based on the riskiness in connection with the received source code change, control submission of the source code change to a source code repository such that the source code change will be submitted if the riskiness indicates that the user is genuine and will be rejected if the riskiness indicates that the user is fraudulent.

11. The system of claim 10 , wherein the source code change originates from a developer workstation and is submitted to a source code repository.

12. The system of claim 10 , wherein the riskiness is used to help provide an intrusion-resilient source code repository.

Assignees

• Katz Aaron T
• Bailey Daniel V
• Amar Yavir
• Emc Ip Holding Co Llc

Inventors

• Katz Aaron T
• Bailey Daniel V
• Amar Yavir

Classifications

• G06F21/60

  Protecting data · CPC title

• G06F21/125

  by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code · CPC title

• H04L29/06877

  Electricity · mapped topic

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title