Method for ensuring at least one application associated with an application protection agent, the corresponding computer program product, and the devices

Description

1 / 22 “METHOD FOR ENSURING AT LEAST ONE APPLICATION ASSOCIATED WITH AN APPLICATION PROTECTION AGENT, THE CORRESPONDING COMPUTER PROGRAM PRODUCT AND THE DEVICES” 1. FIELD OF DISSEMINATION

[0001] The field of dissemination is that of running applications on electronic devices, such as servers.

[0002] More specifically, disclosure refers to a method for securing such applications.

[0003] Disclosure may be of interest in any area where such applications are subject to threats. This is the case, for example, with applications running in an environment communicating with the internet (web applications). 2. Technological Background

[0004] Security controls for applications, for example, web applications, are nowadays mostly reactive, such as updating vulnerable libraries and applying patches to operating systems when vulnerabilities are discovered. There may be a time lag between when a vulnerability is discovered and when it is patched, depending on the vulnerability disclosure process followed and the vendor's response. Public disclosure of a Zero-Day vulnerability without prior communication with the vendor can have a significant impact on publicly exposed services and applications.

[0005] This reactive approach leaves engineers always one step behind criminals, making Zero Day detection even more difficult. For example, certain vulnerabilities are kept secret and are for sale on the dark web. Criminals with financial backing (sponsored by governments or ransomware gangs) can exploit these vulnerabilities, often for extended periods of time without detection. Petition 870250089306, dated 10 / 01 / 2025, p. 8 / 44 2 / 22 to be noticed.

[0006] Furthermore, most applications are unable to protect themselves, so the people who deploy them in production often rely on external controls—again, controls that are reactive, such as Web Application Firewalls (WAFs). While coding languages ​​offer secure ways to perform certain actions, such as sanitizing user input or performing secure deserialization, these controls are not mandatory, so developers often ignore them, leaving their applications vulnerable to a broad subset of the Open Web Application Security Project's (OWASP) top 10 vulnerabilities. Additionally, external controls like WAFs can sometimes be circumvented using different techniques, such as encoding the payload differently or wrapping the attack payload in special characters.

[0007] The problems highlighted above can be mitigated using Runtime Application Self-Protection (RASP) techniques. However, RASP is difficult to implement and operate. RASP is not a plug-and-play technology; it requires a complete validation cycle with existing applications to ensure that functionality and performance are not negatively affected. Furthermore, such RASP solutions require a deep understanding of the threats.

[0008] Therefore, there is a need for a solution to improve application security, even when such applications are associated with a protection agent, for example, of the RASP type. 3. SUMMARY

[0009] A particular aspect of the present disclosure relates to a method for securing at least one application operating on a first server communicatively connected to a second server. A RASP-type application protection agent is associated with the application on the first server. A second security agent is Petition 870250089306, dated 10 / 01 / 2025, page 9 / 44 3 / 22 implemented on the second server. According to this method, a first security agent implemented on the first server executes: - to receive, from the application protection agent, at least one initial indication that a threat has been detected in the application by the application protection agent; and - send at least one initial piece of information to the second security agent.

[0010] Thus, this disclosure proposes a new and inventive solution to improve the security of applications, even when such applications are associated with a protection agent, for example, of the RASP type.

[0011] More specifically, the implementation of the first security agent on the server where the application is deployed allows it to receive (for example, through polling by the application protection agent) information indicating that a threat has been detected by the application protection agent in the application. This information can be sent to the second security agent so that further actions can be taken to protect the application.

[0012] In some modes, the first security agent performs: receiving, from the application protection agent, at least one second piece of information representative of an operating state of the application and / or an operating state of the application protection agent.

[0013] For example, the operating status indicates that the application and / or the application protection agent are still active (or alive).

[0014] In some modes, the receipt, by the application protection agent, of at least one second piece of information is executed in response to the sending, to the application protection agent, of a request for at least one second piece of information. Petition 870250089306, dated 10 / 01 / 2025, page 10 / 44 4 / 22

[0015] In some modes, the sending of a request to the application protection agent for at least one second piece of information is performed periodically.

[0016] In some modalities, the mechanism for sending the request and receiving the corresponding at least one second piece of information is carried out through a polling scheme.

[0017] In some modes, the first security agent performs: sending at least one second piece of information to the second security agent.

[0018] Thus, the second security agent has knowledge of the second piece of information, for example, for additional actions to be taken to protect the application.

[0019] In some modes, the first security agent performs: - to receive safety instructions from the second security officer; and - Send security rules to the application protection agent.

[0020] At least one initial piece of information indicates that a threat has been detected in the application by the application protection agent based on security rules.

[0021] Thus, the security rules to be used by the application protection agent can be updated quickly in a proactive manner (e.g., at any time) or reactively (e.g., after a threat has been detected by the application protection agent in the application).

[0022] According to this method, the second security agent deployed on the second server executes, for at least one application: - to receive, from the first security agent, at least one Petition 870250089306, dated 10 / 01 / 2025, page 11 / 44 5 / 22 initial indication that a threat has been detected in the application by the application protection agent; and - Send an alert to a network protection agent on the first server or to an operating system running the application, indicating that a threat has been detected in the application.

[0023] For example, the network protection agent is a gateway of Application Programming Interface (API) or a firewall.

[0024] In some modes, the second security agent performs: receiving, from the first security agent, at least one second piece of information representative of an operating state of the application and / or an operating state of the application protection agent.

[0025] Thus, the second security agent can decide what actions to take to protect the application, based on more information about the application and / or the application's protection agent.

[0026] In some modes, the second security agent performs: analyzing at least one first piece of information and / or at least one second piece of information, providing a decision information indicative of a decision about the reality of the threat in the application. Sending an alert information is executed when the decision information indicates that it has been decided that the threat in the application is real.

[0027] Thus, a false alarm can be avoided based on this analysis. For example, the analysis implements a forensic analysis of the first piece of information and / or the second piece of information.

[0028] In some modes, the second security agent performs: sending security rules to the first security agent. At least one initial piece of information is indicative of a threat. Petition 870250089306, dated 10 / 01 / 2025, page 12 / 44 Error 6 / 22 was detected in the application by the application's protection agent based on security rules.

[0029] Another aspect of the present disclosure relates to a computer program product comprising program code instructions for implementing the above-mentioned method to secure at least one application associated with an application protection agent (in any of the different embodiments discussed above), when the program is run on a computer or processor.

[0030] Another aspect of this disclosure relates to an electronic device comprising means configured to perform all or part of the steps of the aforementioned method to secure at least one application associated with an application protection agent, as performed by the first security agent (in any of the different embodiments discussed above). Thus, the attributes and advantages of this device are the same as those of the corresponding steps of the aforementioned method. Therefore, they are not detailed further.

[0031] Another aspect of this disclosure relates to an electronic device comprising means configured to implement all or part of the steps of the aforementioned method to secure at least one application associated with an application protection agent, as executed by the second security agent (in any of the different embodiments discussed above). Thus, the attributes and advantages of this device are the same as those of the corresponding steps of the aforementioned method. Therefore, they are not detailed further.

[0032] Another aspect of this disclosure relates to a server comprising an electronic device as discussed above (in any of the different embodiments discussed above). Petition 870250089306, dated 10 / 01 / 2025, page 13 / 44 7 / 22 4. LIST OF FIGURES

[0033] Other attributes and advantages of the modalities should be observed in the following description, given by way of indicative and not exhaustive examples, and in the attached drawings, of which: Figure 1 illustrates a plurality of first servers implementing an application, an application protection agent, and a first security agent, with the first servers communicatively connected to a second server implementing a second security agent, according to an embodiment of the present disclosure; Figure 2 illustrates an example of the building blocks of an electronic device that allow the steps of the method in Figure 4 to be executed by the first servers in Figure 1, according to an embodiment of the present disclosure; Figure 3 illustrates an example of the building blocks of an electronic device that allow the steps of the method in Figure 4 to be executed by the second server in Figure 1, according to an embodiment of the present disclosure; Figure 4 illustrates a flowchart of a method for ensuring at least one application associated with an application protection agent, according to an embodiment of this disclosure. 5. DETAILED DESCRIPTION

[0034] In all figures in this document, the same numerical reference signs designate similar elements and stages.

[0035] Referring now to Figure 1, we illustrate a plurality of first servers 150_1, 150_2, ..., 150_n implementing an application 150app, the first servers 150_1, 150_2, ..., 150_n being communicatively connected to a second server 110, according to an embodiment of the present disclosure. Petition 870250089306, dated 10 / 01 / 2025, page 14 / 44 8 / 22

[0036] More specifically, the first servers 150_1, 150_2, ..., 150_n are communicatively connected to the second server 110 via a wired communication link, for example, an xDSL communication link that implements an internet protocol, passing through a central network 120. However, in other embodiments, the first servers 150_1, 150_2, ..., 150_n are communicatively connected to a second server 110 via a wireless communication link, for example, based on a cellular protocol (e.g., a 3GPP 2G, 3G, 4G or 5G protocol), a WiFi protocol or a WiMAX protocol.

[0037] Returning to Figure 1, a terminal device 100 (for example, a smartphone or a tablet) is communicatively connected to one or more of the first servers 150_1, 150_2, ..., 150_n to access an application 150app (for example, a web application) running on a respective first server 150_1 or 150_2 or ... or 150_n. In this embodiment, communication between the terminal device 100 and the central network 120 passes through a base station 130 belonging to a wireless communication link, for example, based on a cellular protocol (for example, a 3GPP 2G, 3G, 4G or 5G protocol), a Wi-Fi protocol or a WiMAX protocol. However, in other modes, this communication between the terminal equipment 100 and the central network 120 passes through a wired communication link, for example, an xDSL communication link that implements an internet protocol.

[0038] Returning to Figure 1, intentionally or not, this terminal equipment 100 can infect the application 150app running on a respective first server 150_1 or 150_2 or ... or 150_n. To protect the application 150app from such a threat (for example, one of the threats identified by the Open Worldwide Application Security Project, OWASP), a RASP-type application protection agent 150app is Petition 870250089306, dated 10 / 01 / 2025, page 15 / 44 9 / 22 associated with application 150apa on the respective first server 150_1 or 150_2 or ... or 150_n.

[0039] However, as discussed above in relation to section In a technological context, this RASP is difficult to implement and operate. To enhance the security of application 150app, the first servers 150_1, 150_2, ..., 150_n implement a first security agent 150sa1, and the second server 110 implements a second security agent 110sa2, according to this disclosure. In fact, as detailed below in relation to Figure 4, the implementation of the first security agent 150sa1 on the first servers 150_1, 150_2, ..., 150_n, where an application 150app is implemented, allows the receipt (for example, through polling of the respective application protection agents 150apa) of information indicating that a threat has been detected in a respective application 150app. This information can be sent to the second security agent 110sa2 so that additional actions can be taken to protect said application 150app, thus improving the security of said application 150app.

[0040] More specifically, to improve the security of an application 150app, the first security agent 150sa1 executes some steps of the method to secure at least one application associated with an application protection agent, as detailed below in relation to Figure 4 (in the various embodiments disclosed below in relation to Figure 4). For this purpose, a first electronic device 150ed comprises means configured to execute the first security agent 150sa1 and, in particular, to execute all or part of the steps of the method to secure at least one application associated with an application protection agent, as detailed below in relation to Figure 4 (in the various embodiments disclosed below in relation to Figure 4), as executed by the first agent. Petition 870250089306, dated 10 / 01 / 2025, page 16 / 44 10 / 22 security 150sa1. More specifically, in some embodiments, the first electronic device 150ed comprises (Figure 2): - a non-volatile memory 203 (for example, a read-only memory (ROM), a hard disk, a flash memory, etc.); - volatile memory 201 (for example, random access memory or RAM) and a processor 202.

[0041] Non-volatile memory 203 is a computer-readable non-transient carrier medium. It stores executable program code instructions, which are executed by the processor 202 to enable the implementation of some steps of the method described below (method to ensure at least one application associated with an application protection agent) in the various modalities disclosed below in relation to Figure 4.

[0042] After initialization, the aforementioned program code instructions are transferred from non-volatile memory 203 to volatile memory 201 to be executed by processor 202. Volatile memory 201 also includes registers to store the variables and parameters necessary for this execution.

[0043] The steps of the method to ensure at least one application is associated with an application protection agent can be implemented equally well: - by executing a set of program code instructions performed by a reprogrammable computing machine, such as a PC-type device, a DSP (digital signal processor), or a microcontroller. These program code instructions may be stored on a computer-readable, non-transient carrier medium that is either detachable (e.g., a CD-ROM, a DVD-ROM, a USB key) or non-detachable; or - by a dedicated machine or component, such as an FPGA (Field Programmable Gate Array), an ASIC (Automatic Computerized Circuit). Petition 870250089306, dated 10 / 01 / 2025, page 17 / 44 11 / 22 Integrated Application-Specific) or any dedicated hardware component.

[0044] In other words, disclosure is not limited to a purely software-based implementation, in the form of computer program instructions, but can also be implemented in hardware or in any form that combines a hardware component and a software component.

[0045] In some forms, the first electronic device 150ed is implemented on one or more of the first servers 150_1, 150_2, .„, 150_n.

[0046] Returning to Figure 1, to enhance the security of application 150app, the second security agent 110sa2 executes some steps of the method to secure at least one application associated with an application protection agent, as detailed below in relation to Figure 4 (in the various embodiments disclosed below in relation to Figure 4). For this purpose, a second electronic device 150ed comprises means configured to execute the second security agent 110sa2 and, in particular, to execute all or part of the steps of the method to secure at least one application associated with an application protection agent, as detailed below in relation to Figure 4 (in the various embodiments disclosed below in relation to Figure 4), as executed by the second security agent 110sa2. More particularly, in some embodiments, the second electronic device 110ed comprises (Figure 3): - a non-volatile memory 303 (for example, a read-only memory (ROM), a hard disk, a flash memory, etc.); - volatile memory 301 (for example, random access memory or RAM) and a processor 302.

[0047] Non-volatile memory 303 is a computer-readable non-transient carrier medium. It stores code instructions. Petition 870250089306, dated 10 / 01 / 2025, page 18 / 44 12 / 22 executable programs, which are executed by processor 302 to allow the implementation of some steps of the method described below (method to ensure at least one application associated with an application protection agent) in the various modalities disclosed below in relation to Figure 4.

[0048] After initialization, the aforementioned program code instructions are transferred from non-volatile memory 303 to volatile memory 301 to be executed by processor 302. Volatile memory 301 also includes registers to store the variables and parameters necessary for this execution.

[0049] The steps of the method to ensure at least one application is associated with an application protection agent can also be implemented in the following ways: - by executing a set of program code instructions performed by a reprogrammable computing machine, such as a PC-type device, a DSP (digital signal processor), or a microcontroller. These program code instructions may be stored on a computer-readable, non-transient carrier medium that is either detachable (e.g., a CD-ROM, a DVD-ROM, a USB key) or non-detachable; or - by a dedicated machine or component, such as an FPGA (Field Programmable Gate Array), an ASIC (Application-Specific Integrated Circuit), or any dedicated hardware component.

[0050] In other words, disclosure is not limited to a purely software-based implementation in the form of computer program instructions, but can also be implemented in hardware or in any format that combines a hardware component and a software component.

[0051] In some forms, the second electronic device Petition 870250089306, dated 10 / 01 / 2025, page 19 / 44 13 / 22 110ed is implemented on the second server, 110.

[0052] In some modes, only a first server 150_1 or 150_2 or ... or 150_n is connected to the second server 110 that implements the second security agent 110sa2. In some embodiments, a plurality of first servers 150_1 or 150_2 or ... or 150_n are connected to the second server 110 that implements the second security agent 110sa2. In other words, in the present description, depending on the embodiment considered, the index n in the numeric references can be any natural integer, for example, n = 1, 2, 3, etc.

[0053] Referring now to Figure 4, we describe the steps of a method for securing at least one 150app application associated with a 150apa application protection agent, according to an embodiment of the present disclosure and taking as an illustrative example the configuration discussed above in relation to Figure 1.

[0054] More specifically, in an S400 step, the second security agent 110sa2 deployed on the second server 110 sends security rules to one or more of the first security agents 150sa1 deployed on the first servers 150_1, 150_2, ..., 150_n. Conversely, during the S400 step, one or more of the first security agents 150sa1 deployed on the first servers 150_1, 150_2, ..., 150_n receive the security rules sent by the second security agent 110sa2. For example: - In step S400_1, the first security agent 150sa1 deployed on the first server 150_1 receives the security rules sent by the second security agent 110sa2; - In step S400_2, the first security agent 150sa1 deployed on the first server 150_2 receives the security rules sent by the second security agent 110sa2; Petition 870250089306, dated 10 / 01 / 2025, page 20 / 44 14 / 22 - ...; and - In the S400_n stage, the first security agent 150sa1, deployed on the first server 150_n, receives the security rules sent by the second security agent 110sa2.

[0055] These security rules allow the first security agent 150sa1 to proactively schedule or update the application protection agent 150apa associated with the application 150app on the respective first server 150_1 or 150_2 or ... or 150_n. More generally, the S400 step can be executed proactively (e.g., at any time) or reactively (e.g., after a threat is detected. This may be the case, for example, after the execution of the S480 step detailed below).

[0056] In an S410 step, the first security agents Servers 150sa1 that received security rules during the S400 step send these security rules to the application protection agent 150apa deployed on the respective first server 150_1, 150_2, ., 150_n. For example: - In step S410_1, the first 150sa1 security agents deployed on the first 150_1 server send the security rules to the 150apa application protection agent associated with the 150apa application on the first 150_1 server; - In step S410_2, the first security agent 150sa1 deployed on the first server 150_2 sends the security rules to the application protection agent 150apa associated with the application 150apa on the first server 150_2; - .; and - In the S410_n step, the first security agent 150sa1 deployed on the first server 150_n sends the security rules to the application protection agent 150apa associated with the application 150apa on the first server 150_n. Petition 870250089306, dated 10 / 01 / 2025, page 21 / 44 15 / 22

[0057] In an S420 step, endpoint 100 is the origin of an attack targeting at least one application 150apa deployed on a respective first server 150_1 or 150_2 or ... or 150_n (for example, an attack corresponding to one of the threats identified by OWASP). For example: - In stage S420_1, terminal equipment 100 is the origin of an attack targeting application 150apa, deployed on the first server 150_1; - In stage S420_2, terminal equipment 100 is the origin of an attack targeting application 150apa, deployed on the first server 150_2; - .; and - In the S420_n stage, terminal equipment 100 is the origin of an attack targeting application 150apa, deployed on the first server 150_n.

[0058] In an S430 step, at least one first security agent 150sa1 deployed on a respective first server 150_1 or 150_2 or... or 150_n, where an application 150app is subject to an attack, receives, from the respective application protection agent 150apa, at least one first piece of information indicating that a threat has been detected in the application 150app by the application protection agent 150apa. For example: - In step S430_1, the first security agent 150sa1 deployed on the first server 150_1 receives, from the application protection agent 150apa deployed on the first server 150_1, at least one initial indication that a threat has been detected in the application 150app running on the first server 150_1 by said application protection agent 150apa; - In step S430_2, the first security agent 150sa1 deployed on the first server 150_2 receives, from the agent of Petition 870250089306, dated 10 / 01 / 2025, page 22 / 44 16 / 22 Application protection 150apa implemented on the first server 150_2, at least one initial indication that a threat was detected in the application 150app running on the first server 150_2 by said application protection agent 150apa; - ...; and - In step S430_n, the first security agent 150sa1 deployed on the first server 150_n receives, from the application protection agent 150apa deployed on the first server 150_n, at least one initial indication that a threat has been detected in the application 150app running on the first server 150_n by said application protection agent 150apa.

[0059] For example, the first piece of information is representative of the fact that a threat was detected in the respective 150app application by the 150apa application protection agent based on the security rules that were loaded during the detailed S400 step above.

[0060] In an S440 step, the at least one first security agent 150sa1 that received at least one first piece of information during the S430 step sends the respective at least one first piece of information to the second security agent 110sa2. Conversely, during the S440 step, the second security agent 110sa2 receives the respective at least one first piece of information from the at least one first security agent 150sa1 that received at least one first piece of information during the S430 step. For example: - In step S440_1, the second security agent 110sa2 receives from the first security agent 150sa1, deployed on the first server 150_1, at least one initial indication that a threat has been detected in the application 150app running on the first server 150_1; - In step S440_2, the second security agent 110sa2 receives from the first security agent 150sa1 deployed in Petition 870250089306, dated 10 / 01 / 2025, page 23 / 44 17 / 22 first server 150_2, at least one initial indication that a threat was detected in the 150app application running on the first server 150_2; - ...; and - In step S440_n, the second security agent 110sa2 receives from the first security agent 150sa1, deployed on the first server 150_n, at least one initial indication that a threat has been detected in the application 150app running on the first server 150_n.

[0061] In an S450 step, at least one first security agent 150sa1 deployed on a respective first server 150_1, 150_2, ., 150_n receives, from the respective application protection agent 150apa, at least one second piece of information representative of an operating state of the respective application 150app and / or an operating state of the respective application protection agent 150apa. For example: - In step S450_1, the first security agent 150sa1 deployed on the first servers 150_1 receives, from the application protection agent 150apa deployed on the first server 150_1, at least one second piece of information representing an operational state of the application 150app running on the first server 150_1 and / or an operational state of said application protection agent 150apa; - In step S450_2, the first security agent 150sa1 deployed on the first server 150_2 receives, from the application protection agent 150apa deployed on the first server 150_2, at least one second piece of information representing an operating state of the application 150app running on the first server 150_2 and / or an operating state of said application protection agent 150apa; Petition 870250089306, dated 10 / 01 / 2025, page 24 / 44 18 / 22 - ...; and - In step S450_n, the first security agent 150sa1 deployed on the first server 150_n receives, from the application protection agent 150apa deployed on the first server 150_n, at least one second piece of information representing an operating state of the application 150app running on the first server 150_n and / or an operating state of said application protection agent 150apa.

[0062] For example, the operating status indicates that the respective application 150app and / or the respective application protection agent 150apa are still active (or in operation).

[0063] In some embodiments, the S450 step (and therefore the S450_1, S450_2, ..., S450_n steps) is executed in response to the sending, by the first security agent 150sa1 to the respective application protection agent 150apa, of a request for the respective at least one second piece of information.

[0064] In some embodiments, the sending, to the respective application protection agent 150apa, of a request for the respective at least one second piece of information is performed periodically. For example, the mechanism for sending the request and receiving the respective second piece of information sent by the respective application protection agent 150apa is carried out by means of a polling scheme.

[0065] Returning to Figure 4, in step S460, the at least first security agent 150sa1 that received the respective at least one second piece of information during step S430 sends the respective at least one second piece of information to the second security agent 110sa2. On the other hand, during step S460, the second security agent 110sa2 receives, from the at least first security agent 150sa1 that received the respective at least one second piece of information. Petition 870250089306, dated 10 / 01 / 2025, page 25 / 44 19 / 22 information during step S430, the respective at least one second piece of information. For example: - In step S460_1, the second security agent 110sa2 receives, from the first security agent 150sa1 deployed on the first server 150_1, at least one second piece of information representing an operating state of the application 150app running on the first server 150_1 and / or an operating state of the application protection agent 150apa deployed on the first server 150_1; - In step S460_2, the second security agent 110sa2 receives, from the first security agent 150sa1 deployed on the first server 150_2, at least one second piece of information representing an operating state of the application 150app running on the first server 150_2 and / or an operating state of the application protection agent 150apa deployed on the first server 150_2; - ...; and - In step S460_n, the second security agent 110sa2 receives from the first security agent 150sa1, deployed on the first server 150_n, at least one second piece of information representing an operating state of the application 150app running on the first server 150_n and / or an operating state of the application protection agent 150apa deployed on the first server 150_n.

[0066] Thus, the second security agent 110sa2 can decide the actions to be taken to protect the application 150app based on more information about the application(s) 150app and / or the application protection agent(s) 150apa.

[0067] In an S470 step, the second security agent 110sa2 analyzes at least one initial piece of information received during Petition 870250089306, dated 10 / 01 / 2025, page 26 / 44 20 / 22 the execution of step S440 (and therefore steps S440_1, S440_2, ..., S440_n) and at least one second piece of information received during the execution of step S460 (and therefore steps S460_1, S460_2, ..., S460_n). The execution of step S470 provides decision information indicative of a decision about the reality of the threat detected in relation to a given application 150app running on a respective first server 150_1 or 150_2 or ... or 150_n.

[0068] Thus, false alarms can be avoided based on this analysis. For example, the analysis implements a forensic analysis of at least one first piece of information and / or at least one second piece of information.

[0069] However, in some modes, during step S470, the second security agent 110sa2 analyzes only at least one initial piece of information received during the execution of step S440 (and therefore steps S440_1, S440_2, ..., S440_n). In such modes, steps S450 (and therefore steps S450_1, S450_2, ..., S450_n) and S460 (and therefore steps S460_1, S460_2, ..., S460_n) are not necessarily executed.

[0070] In some modes, during step S470, the second security agent 110sa2 analyzes only at least one second piece of information received during the execution of step S460 (and therefore steps S460_1, S460_2, ..., S460_n). In such modes, steps S430 (and therefore steps S430_1, S430_2, ..., S430_n) and S440 (and therefore steps S440_1, S440_2, ..., S440_n) are not necessarily executed.

[0071] In an S480 step, the second security agent 110sa2 sends, to at least one first server 150_1 or 150_2 or ... or 150_n for which it was decided during the S470 step that there is a threat associated with an application 150app running on said first server: Petition 870250089306, dated 10 / 01 / 2025, page 27 / 44 21 / 22 - to a network protection agent (for example, the network protection agent is an API gateway or a firewall) of the aforementioned first server 150_1 or 150_2 or ... or 150_n; or - to an operating system that runs the 150app application on the aforementioned first server 150_1 or 150_2 or ... or 150_n, an alert indicating that a threat has been detected in the respective 150app application. This allows the network protection agent or operating system to implement additional protection mechanisms or trigger them automatically (for example, based on automated Security Orchestration and Response (SOAR) capabilities in an API).

[0072] In some modes, step S470 is not executed. In such modes, during the S480 step, the second security agent 110sa2 sends at least one alert message in response to receiving at least one first message (S440 step (and therefore steps S440_1, S440_2, ..., S440_n)) and / or at least one second message (S460 step (and therefore steps S460_1, S460_2, ..., S460_n)). In these modes, the S480 step is executed in response to: - to the execution of step S440 (and therefore steps S440_1, S440_2, ..., S440_n), that is, when the second security agent 110sa2 receives at least one initial piece of information sent by the first security agent 150sa1 deployed on a respective first server 150_1 or 150_2 or ... or 150_n; and / or - to the execution of step S460 (and therefore steps S460_1, S460_2, ..., S460_n), that is, when the second security agent 110sa2 receives at least one second piece of information sent by the first security agent 150sa1 deployed on a respective first server 150_1 or 150_2 or ... or 150_n.

[0073] More specifically, the second security agent Petition 870250089306, dated 10 / 01 / 2025, page 28 / 44 22 / 22 110sa2 sends at least one alert message to a network protection agent or to an operating system running on a respective first server 150_1 or 150_2 or ... or 150_n that implements a first security agent 150sa1 that sent at least one first message (during step S440) and / or at least one second message (during step S460).

[0074] In some modes, the S400 step is executed in response to the execution of the S480 step. In such modes, the security rules are updated in the 150apa application protection agent reactively, that is, after a threat is detected.

[0075] In some embodiments, the same 150app application runs on a plurality of first servers 150_1, 150_2, ..., 150_n. In this case, when a threat is detected by the second security agent 110sa2, the solution can be deployed simultaneously on all or part of the first servers of the plurality of first servers 150_1, 150_2, ..., 150_n, even if only part of the first security agent 150sa1 has sent the first information and / or the second information to the second security agent 110sa2. This improves the overall protection process associated with a 150app application of a given type running on different servers. Petition 870250089306, dated 10 / 01 / 2025, p. 29 / 44

Claims

1 / 5 CLAIMS 1. A method for securing at least one application (150app) operating on a first server (150_1, 150_2, 150c) communicatively connected to a second server (110), an application protection agent (150apa) of a runtime application self-protection type, hereinafter RASP, associated with the application on the first server, a second security agent (110sa2) implemented on the second server, characterized in that a first security agent (150sa1) implemented on the first server performs: - receiving (S430), from the application protection agent, at least one initial information indicating that a threat has been detected in the application by the application protection agent; and - sending (S440), to the second security agent, at least one initial information.

2. Method, according to claim 1, characterized in that the first security agent performs: - receiving (S450), from the application protection agent, at least one second piece of information representative of an operating state of the application and / or an operating state of the application protection agent.

3. Method, according to claim 2, characterized in that the said receipt, by the application protection agent, of at least one second piece of information is executed in response to the sending, to the application protection agent, of a request for said at least one second piece of information.

4. Method, according to claim 3, characterized in that the sending, to the application protection agent, of a request for said at least one second piece of information is executed periodically. Petition 870250089306, dated 10 / 01 / 2025, p. 30 / 44 2 / 5 5. A method according to claim 3 or 4, characterized in that the mechanism for sending the request and receiving at least one second corresponding piece of information is carried out by means of a polling scheme.

6. Method, according to any one of claims 2 to 5, characterized in that the first security agent performs: - sending (S460), to the second security agent, at least one second piece of information.

7. A method, according to any one of claims 1 to 6, characterized in that the first security agent performs: - receiving (S400) security rules from the second security agent; and - sending (S410) security rules to the application protection agent, wherein at least one piece of first information is indicative that a threat has been detected in the application by the application protection agent based on the security rules.

8. Method for securing at least one application (150app) operating on a first server (150_1, 150_2, 150c) communicatively connected to a second server (110), an application protection agent (150apa) of a runtime application self-protection type, hereinafter RASP, associated with the application on the first server, a first security agent (150sa1) implemented on the first server, characterized in that a second security agent (110sa2) implemented on the second server executes for said at least one application: - receive (S440), from the first security agent, by Petition 870250089306, of 01 / 10 / 2025, p.31 / 44 3 / 5 minus an initial indication that a threat has been detected in the application by the application protection agent; and - send (S480), to a network protection agent of the first server or to an operating system that runs the application, an alert indicating that a threat has been detected in the application.

9. Method, according to claim 8, characterized in that the second security agent performs: - receiving (S460), from the first security agent, at least one second piece of information representative of an operating state of the application and / or an operating state of the application protection agent.

10. Method, according to claim 8 or 9, characterized in that the second security agent performs: - analyzing (S470) at least one first piece of information and / or at least one second piece of information, providing a decision information indicative of a decision about the reality of the threat in the application, and in that the said sending of an alert information is executed when the decision information is indicative that it has been decided that the threat in the application is real.

11. A method, according to any one of claims 8 to 10, characterized in that the second security agent performs: - sending (S400) security rules to the first security agent, and in which at least one initial piece of information is indicative that a threat has been detected in the application by the application's protection agent based on the security rules.

12. Computer program product, characterized by Petition 870250089306, dated 10 / 01 / 2025, page 32 / 44 4 / 5, in that it comprises program code instructions to implement a method, as defined in any of claims 1 to 11, when said program is executed on a computer or processor.

13. Device (100ed) for securing at least one application (150app) operating on a first server (150_1, 150_2, 150c) communicatively connected to a second server (110), an application protection agent (150apa) of a runtime application self-protection type, hereinafter RASP, associated with the application on the first server, a second security agent (110sa2) implemented on the second server, characterized in that it comprises a processor (202) or a dedicated computing machine configured to execute, when implemented on the first server: - receiving, from the application protection agent, at least one initial information indicating that a threat has been detected in the application by the application protection agent; and - sending, to the second security agent, at least one initial information.

14. Device (150ed) for securing at least one application (150app) operating on a first server (150_1, 150_2, 150c) communicatively connected to a second server (110), an application protection agent (150apa) of a runtime application self-protection type, hereinafter RASP, associated with the application on the first server, a first security agent (150sa1) implemented on the first server, characterized in that it comprises a processor (302) or a dedicated computing machine configured to run, for said at least one application, when implemented on the second server: Petition 870250089306, dated 10 / 01 / 2025, p.33 / 44 5 / 5 - receive, from the first security agent, at least one initial indication that a threat has been detected in the application by the application protection agent; and - send, to a network protection agent of the first server or to an operating system that runs the application, an alert indicating that a threat has been detected in the application.

15. Server, characterized by the fact that it comprises a device, as defined in claim 13 or 14. Petition 870250089306, dated 10 / 01 / 2025, pp. 34 / 44

Images