API Call Rule-Based Control for Security Vulnerability Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in preventing API abuse, which can trigger security vulnerabilities due to the flexibility and openness of API calls, leading to anomalies and vulnerabilities in devices.
Innovation Solution
An API call method that determines rules corresponding to an API from a rule set based on a command number, using a hash table and linked list structure, to allow or prohibit API calls, thereby preventing abuse and security vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If API calls are allowed to be flexible and open for information interaction, then adaptability and versatility are improved, but security vulnerabilities and API abuse increase
Solution Approach 1:
The patent introduces a rule-based intermediary layer between the API call interface and the device driver. This intermediary checks API calls against predefined rules (such as calling sequence requirements) before allowing execution, thereby mediating between the need for flexible API access and the need to prevent security vulnerabilities. The rule set acts as a mediator that enables legitimate flexible access while blocking potentially harmful calls.
2Reliability
If security checks are added to API calls to prevent abuse, then security is improved, but device complexity increases
Solution Approach 1:
The patent segments the security checking function into a separate rule-based module independent of the device driver. The security rules are stored in a rule set that can be independently configured and updated without modifying the driver code. This segmentation allows security checks to be added without increasing the complexity of the core driver system, as the rule engine operates as a separate layer.
Solution Approach 2:
The patent changes the parameter representation of API call states using a status bitmap, where different bit positions represent different calling states. This parameter transformation allows complex security rules to be evaluated through simple bitwise operations, reducing the computational complexity of security checks while maintaining comprehensive security coverage.
3Reliability
If rule-based control is implemented for API calls, then API abuse is decreased, but processing time increases
Solution Approach 1:
The patent transforms the API call state tracking into a status bitmap parameter, enabling efficient bitwise operations for rule evaluation. Instead of complex conditional checks, the system uses bitwise AND operations between the status bitmap and rule-defined bit patterns to determine whether API calls should be allowed. This parameter transformation significantly reduces processing time while maintaining comprehensive abuse prevention.
Data Source
AI summary
Various example embodiments of the inventive concepts provide an Application Programming Interface (API) call method, an API call apparatus, an electronic device, and/or a non-transitory computer readable storage medium. The API call method includes determining, using processing circuitry of an electronic device, one or more rules corresponding to an API from a rule set in response to an API call request from an operating system (OS) of the electronic device associated with the API, the API including an Input/Output Control (ioctl) interface, determining, using the processing circuitry, whether to allow the API call request based on the one or more rules, and executing, using the processing circuitry, a call of the API corresponding to the API call request based on results of the determining.