US 12,105,809 B2
Non-intrusive method of detecting security flaws of a computer program
Bertrand Bonnefoy-Claudet, Paris (FR); Etienne Millon, Paris (FR); Nathan Rebours, Paris (FR); and Graham Steel, Paris (FR)
Assigned to Cryptosense SAS, Paris (FR)
Filed by Cryptosense SAS, Paris (FR)
Filed on Jul. 31, 2023, as Appl. No. 18/228,634.
Application 18/228,634 is a continuation of application No. 16/620,819, granted, now 11,768,944, previously published as PCT/FR2018/051162, filed on May 11, 2018.
Claims priority of application No. 1755151 (FR), filed on Jun. 9, 2017.
Prior Publication US 2023/0376610 A1, Nov. 23, 2023
Int. Cl. G06F 21/57 (2013.01); G06F 8/61 (2018.01); G06F 11/36 (2006.01); G06F 21/54 (2013.01)
CPC G06F 21/577 (2013.01) [G06F 11/3612 (2013.01); G06F 21/54 (2013.01); G06F 8/61 (2013.01); G06F 2221/033 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A non-intrusive method for detecting security flaws in a computer program, the method comprising:
replacing at least one original cryptographic function of a computer system with at least one instrumentalized cryptographic function;
installing and executing an executable and non-instrumentalized version of the program in the computer system, the computer system comprising the at least one instrumentalized cryptographic function able to be called by the program to manipulate at least one cryptographic object, the at least one cryptographic function not included in the executable and non-instrumentalized version of the program, the at least one cryptographic function having been instrumentalized before execution of the executable and non-instrumentalized version of the program to allow recording of modalities of calls to the at least one cryptographic function from the executable and non-instrumentalized version of the program;
in a course of execution of the program and without instrumentalizing the program during execution of the program, recording in a tracing file modalities of calls to the cryptographic function, wherein recording in the tracing file comprises obtaining at least a portion of an execution stack when the cryptographic function is called by the program, and wherein recording in the tracing file further comprises recording the modalities of calls to cryptographic-management and usage functions of the cryptographic function in the tracing file; and
after the execution of the program, analyzing the tracing file and creating a data structure of states taken by the at least one cryptographic object manipulated in the course of the execution of the program responsive to the analyzing the tracing file, and analyzing the data structure to detect calls to the at least one cryptographic function that are liable to form a security flaw.