Runtime protection of web services

• US 10,257,218 B2
• Filed: 01/23/2018
• Issued: 04/09/2019
• Est. Priority Date: 06/18/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Tripp, Omer, Wurth, Emmanuel
• Primary Examiner(s): Le, Khoi V
• Application Number:
  US15/877,421
• Publication Number:
  US 20180159892A1
• Time in Patent Office: 441 Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Protecting a runtime Web service application. A web service application is instrumented to log its operation and allow recreation of its execution trace. Trace point vulnerabilities are identified using one or more data payloads. Candidate trace point operations associated with the trace point vulnerabilities are identified. Supplementary candidate operations are computed based on the existing trace point operations and the one or more data payloads. The Web service application is further instrumented with the one or more supplementary candidate operations.

Claims

1. A system for protecting a runtime Web service application, the system comprising:

a trace instrumenter for enabling a Web service application to log its operation and to create an execution trace;

a vulnerability detector for identifying a trace point vulnerability using one or more data payloads;

a taint analyzer for identifying a candidate trace point operation associated with the trace point vulnerability;

a string analyzer for computing a supplementary candidate operation based on the existing trace point operation and the trace point vulnerability;

a defensive instrumenter for instrumenting the Web service application with the supplementary candidate operation;

a memory configured to store an application and an instrumented version of the application;

a processor in communication with the memory, wherein the memory stores processor executable program instructions, that when executed, configure the processor to perform functions of the trace instrumenter, the vulnerability detector, the taint analyzer, the string analyzer, and the defensive instrumenter, and wherein each data payload comprises an example set of data, and wherein the identifying the candidate trace point operation associated with the trace point vulnerability is performed by checking data flow through the application and the instrumented version of the application using one of the one or more data payloads and specifying a security rule to define the data flow, and wherein the candidate trace point operation is an operation for which a payload value has been rejected by a validator or has been sanitized by a sanitizer, and wherein the trace point vulnerability is reported, and wherein the vulnerability detector performs further vulnerabilities testing after the application has been further instrumented with one or more supplementary candidate operations;

wherein the vulnerability detector for identifying a trace point vulnerability using one or more data payloads such that the system infers a security specification according to the trace point vulnerability; and

wherein the string analyzer for computing a supplementary candidate operation based on the existing trace point operation and the trace point vulnerability such that the system acts automatically to satisfy the security specification by supplying the supplementary candidate operation.