TESTING WEB SERVICES THAT ARE ACCESSIBLE VIA SERVICE ORIENTED ARCHITECTURE (SOA) INTERCEPTORS

• US 20120198555A1
• Filed: 01/28/2011
• Published: 08/02/2012
• Est. Priority Date: 01/28/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: TRIPP, Omer, BESKROVNY, Evgeny
• Granted Patent: US 8,949,991 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

Systems, methods, and computer program products are disclosed for testing web service-related elements, where the instructions of a web service-related element are statically analyzed to identify a characteristic of an output of the web service-related element, and where it is determined from a received response to a web service request that the web service request was processed by the web service-related element if at least a portion of the response matches the characteristic of the output of the web service-related element.

Claims

1. A method for testing web service-related elements, the method comprising:

statically analyzing instructions of a web service-related element to identify a characteristic of an output of the web service-related element;

receiving a response to a web service request; and

determining that the web service request was processed by the web service-related element if at least a portion of the response matches the characteristic of the output of the web service-related element.

2. The method according to claim 1 wherein statically analyzing comprises statically analyzing a web service-exposed application programming interface (API).

3. The method according to claim 1 wherein statically analyzing comprises statically analyzing a web service-exposed application programming interface (API) that contains logic embodying a core function of a business application.

4. The method according to claim 1 wherein statically analyzing comprises statically analyzing a Service Oriented Architecture (SOA) interceptor.

5. The method according to claim 1 wherein statically analyzing comprises statically analyzing a web service-exposed application programming interface (API) and a Service Oriented Architecture (SOA) interceptor.

6. The method according to claim 1 wherein statically analyzing comprises statically analyzing a web service-exposed application programming interface (API) and a plurality of Service Oriented Architecture (SOA) interceptors,

wherein the SOA interceptors are layered with respect to each other, and

wherein the web service API is accessible to the web service request via the SOA interceptor layers.

7. The method according to claim 6 and further comprising sending the web service request to the web service API via the SOA interceptor layers.

8. The method according to claim 1 wherein statically analyzing comprises identifying a characteristic of an output of the web service-related element.

9. The method according to claim 8 wherein statically analyzing comprises identifying either of a return value and an exception value of the web service-related element.

10. The method according to claim 1 and further comprising:

synthesizing an attack on the web service-related element using an output characteristic of the web service-related element; and

presenting the attack in the form of the web service request.

11. The method according to claim 1 wherein statically analyzing comprises statically analyzing instructions of a plurality of web service-related elements to identify characteristics of outputs of the web service-related elements and input conditions that result in the outputs, wherein at least two of the web service-related elements have the same output, and further comprising:

synthesizing an attack on a target one of the web service-related elements using an output characteristic of the target web service-related element and an input condition that result in the output; and

presenting the attack in the form of the web service request.

12. A system for testing web service-related elements, the system comprising:

a static analyzer configured to statically analyze instructions of a web service-related element to identify a characteristic of an output of the web service-related element; and

a black-box tester configured to

receive a response to a web service request, and

determine that the web service request was processed by the web service-related element if at least a portion of the response matches the characteristic of the output of the web service-related element.

13. The system according to claim 12 wherein the static analyzer is configured to statically analyze a web service-exposed application programming interface (API).

14. The system according to claim 12 wherein the static analyzer is configured to statically analyze a web service-exposed application programming interface (API) that contains logic embodying a core function of a business application.

15. The system according to claim 12 wherein the static analyzer is configured to statically analyze a Service Oriented Architecture (SOA) interceptor.

16. The system according to claim 12 wherein the static analyzer is configured to statically analyze a web service-exposed application programming interface (API) and a Service Oriented Architecture (SOA) interceptor.

17. The system according to claim 12 wherein the static analyzer is configured to statically analyze a web service-exposed application programming interface (API) and a plurality of Service Oriented Architecture (SOA) interceptors,

wherein the SOA interceptors are layered with respect to each other, and

wherein the web service API is accessible to the web service request via the SOA interceptor layers.

18. The system according to claim 17 wherein the black-box tester is configured to send the web service request to the web service API via the SOA interceptor layers.

19. The system according to claim 12 wherein the static analyzer is configured to identify a characteristic of an output of the web service-related element.

20. The system according to claim 19 wherein the static analyzer is configured to identify either of a return value and an exception value of the web service-related element.

21. The system according to claim 12 wherein the black-box tester is configured to

synthesize an attack on the web service-related element using an output characteristic of the web service-related element, and

present the attack in the form of the web service request.

22. The system according to claim 12 wherein the static analyzer is configured to statically analyze instructions of a plurality of web service-related elements to identify characteristics of outputs of the web service-related elements and input conditions that result in the outputs, wherein at least two of the web service-related elements have the same output, and wherein the black-box tester is configured to

synthesize an attack on a target one of the web service-related elements using an output characteristic of the target web service-related element and an input condition that result in the output, and

present the attack in the form of the web service request.

23. A computer program product for testing web service-related elements, the computer program product comprising:

a computer-readable storage medium; and

computer-readable program code embodied in the computer-readable storage medium, wherein the computer-readable program code is configured to

statically analyze instructions of a web service-related element to identify a characteristic of an output of the web service-related element,

receive a response to a web service request, and

determine that the web service request was processed by the web service-related element if at least a portion of the response matches the characteristic of the output of the web service-related element.

24. The computer program product according to claim 23 wherein the computer-readable program code is configured to statically analyze a web service-exposed application programming interface (API) and a plurality of Service Oriented Architecture (SOA) interceptors,

wherein the SOA interceptors are layered with respect to each other, and

wherein the web service API is accessible to the web service request via the SOA interceptor layers.

25. The computer program product according to claim 23 wherein the computer-readable program code is configured to

synthesize an attack on the web service-related element using an output characteristic of the web service-related element, and

present the attack in the form of the web service request.