Graph-Based API Auditing via Schema and Line Graph Frontiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current API security scanning methods face a tradeoff between scan coverage and efficiency, as thorough scans are time-consuming and incomplete scans may miss critical vulnerabilities.
Innovation Solution
A method for auditing graph-based APIs involves generating a schema graph and a line graph, determining frontiers, and creating a representative set of queries to efficiently test API fields, ensuring comprehensive security vulnerability detection without exhaustive testing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a security scan tests every possible call of an API, then scan coverage is improved, but the time required to perform the scan increases significantly
Solution Approach 1:
The patent segments the API call space into equivalence classes based on schema graph analysis. Instead of testing every individual API call, the system identifies representative calls from each equivalence class that cover the same security vulnerability patterns. This segmentation allows comprehensive coverage while reducing the total number of tests needed.
Solution Approach 2:
The patent applies partial action by testing a carefully selected subset of API calls rather than all possible calls. The schema graph analysis identifies critical paths and frontier nodes that represent the most important security boundaries, allowing the system to perform partial testing that achieves sufficient coverage without exhaustive enumeration of all API calls.
2Loss of time
If a security scan tests only a random sample of API calls, then scan time is reduced, but reliability of vulnerability detection decreases
Solution Approach 1:
The patent performs preliminary analysis by constructing a schema graph that models the API's data structure, relationships, and security boundaries before executing tests. This preliminary action identifies critical frontier nodes and equivalence classes, enabling the subsequent test selection to be targeted and reliable rather than random, ensuring high vulnerability detection reliability with reduced scan time.
Solution Approach 2:
The patent changes the selection parameter from random sampling to deterministic selection based on schema graph metrics. Instead of randomly choosing API calls to test, the system selects calls based on their position in the schema graph, particularly focusing on frontier nodes that represent security boundaries and equivalence classes that group similar security behaviors, thereby improving detection reliability.
3Adaptability or versatility
If the API structure is complex with many object types and fields, then functionality is improved, but the complexity of auditing increases
Solution Approach 1:
The patent extracts the essential auditing information from complex API structures by constructing a schema graph that captures only the critical elements: object types, their relationships, and frontier fields. This extraction separates the essential security-relevant structure from the full API complexity, making auditing manageable while preserving API functionality.
Solution Approach 2:
The schema graph acts as an intermediary between the complex API structure and the auditing process. Instead of directly analyzing the full API complexity, the system uses the schema graph as a simplified model that captures security-relevant relationships, making the auditing process tractable while the underlying complex API remains unchanged.
Data Source
AI summary
A method for auditing a graph-based API includes obtaining a structure describing object types of the API and fields of the object types. A schema graph of the structure is generated including nodes representing object types. The nodes are connected by directed edges representing field resolution between object types. A line graph is generated and includes a node in place of each edge of the schema graph and edges in place of nodes of the schema graph. Frontiers of the line graph are determined, a frontier being subgraph of the line graph such that (1) the subgraph is rooted at a line graph node that represents a field of the API that accepts at least one field argument and (2) the subgraph is a maximal subgraph of the line graph that is disjoint from other line graph nodes that represent fields that accept at least one field argument.