API Authorization Modeling for BOLA and BFLA Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing API services face challenges in properly implementing authentication and authorization functionality, leading to vulnerabilities such as Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA), which are difficult to detect and mitigate due to the absence of comprehensive tools for object modeling and automated testing.
Innovation Solution
A mechanism is introduced to dynamically craft application models, including access control lists, by tracing client-server traffic, identifying objects and functions, and iteratively testing API services to identify and mitigate BOLA/BFLA issues, applicable to both green and brown field deployments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If authentication and authorization functionality is implemented in ad-hoc fashion, then service development speed is improved, but security reliability deteriorates
Solution Approach 1:
The patent applies preliminary action by automatically generating authentication and authorization code templates before the actual service implementation. The system creates pre-vetted code snippets that ensure security best practices are built-in from the start, eliminating the need for ad-hoc implementation while maintaining development speed. The template generation occurs prior to service deployment, ensuring security reliability is established beforehand.
Solution Approach 2:
The patent uses copying by replicating proven authentication and authorization patterns through reusable templates. Instead of writing security code from scratch each time, the system copies and adapts verified code patterns that have been previously tested and approved. This allows rapid service development while maintaining security reliability through the reuse of proven implementations.
2Reliability
If comprehensive authentication and authorization testing is performed, then security reliability is improved, but testing time increases
Solution Approach 1:
The patent applies preliminary action by performing authentication and authorization testing during the template generation phase before service deployment. The system automatically tests the generated code templates against security vulnerability patterns, ensuring they meet security requirements beforehand. This shifts testing from a post-deployment activity to a pre-generation activity, reducing overall testing time while maintaining comprehensive security coverage.
Solution Approach 2:
The patent implements self-service by enabling the system to automatically generate, test, and validate authentication and authorization code templates without requiring manual intervention. The testing framework autonomously executes security tests against generated templates, identifying and reporting vulnerabilities automatically. This self-service approach eliminates time-consuming manual testing while ensuring comprehensive security reliability.
3Measurement precision
If manual security testing is performed, then detection precision is improved, but device complexity increases
Solution Approach 1:
The patent applies self-service by implementing an automated testing system that independently performs security vulnerability detection without requiring complex manual test configurations. The system automatically generates test cases based on service specifications, executes them against the implemented code, and analyzes results to detect authentication and authorization vulnerabilities. This automation reduces the complexity burden on operators while maintaining high detection precision.
Solution Approach 2:
The patent replaces mechanical manual testing processes with automated computer-based testing mechanisms. Instead of requiring manual analysis of security code, the system uses automated scripts and frameworks that systematically evaluate authentication and authorization implementations for vulnerabilities. This substitution of manual mechanical testing with automated digital testing reduces operational complexity while improving detection precision through consistent, repeatable testing procedures.
Data Source
AI summary
In one embodiment, an illustrative method may comprise: monitoring, by a process, a behavior of an application between one or more client devices and an application programming interface service; establishing, by the process, an application model of objects and functions within the application based on the behavior; and determining, by the process, an authorization logic of the application for the objects and functions based on the application model. In one embodiment, the illustrative method further comprises: testing one or more authorization approaches against the application to determine one or more discrepancies within the authorization logic indicative of faulty authorizations; and mitigating the one or more discrepancies.