Aspect-Oriented Security Injection for Function-Level Web Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional web applications rely on web firewall technologies that have coarse protection granularity and are easily bypassed by attackers, leading to inadequate security protection capabilities.
Innovation Solution
An aspect-oriented technology based security protection system with a cloud management and control platform and a self-protection module that injects detection rules into specific functions of an application, enabling real-time, function-level protection without requiring feature detection, and generates security logs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web firewall technologies are used for security protection, then the system can provide basic security detection, but the protection granularity is coarse and detection rules are easily bypassed
Solution Approach 1:
The patent segments the security protection mechanism from the network layer to the application layer by injecting detection rules into specific functions of the to-be-protected application. This segmentation enables function-level protection granularity, allowing security detection at the level of individual application functions rather than coarse network request filtering.
Solution Approach 2:
The patent introduces an aspect-oriented security base as an intermediary component that sits between the cloud management platform and the application functions. This intermediary receives security policies from the cloud platform and injects detection rules into application functions, enabling fine-grained security protection without directly modifying application code while achieving precise control over security detection.
2Reliability
If web firewall technologies perform feature matching on request data, then the system can detect security threats, but the detection can be bypassed by attackers and requires continuous feature detection
Solution Approach 1:
The patent applies preliminary action by pre-injecting detection rules into application functions before security threats occur. The detection rules are embedded within the application's own execution flow, enabling automatic security detection as part of the normal function execution rather than requiring separate feature matching operations.
Solution Approach 2:
The patent implements self-service security protection where the application's own functions execute the detection rules. When application functions are called, they automatically execute the injected detection rules, making the security detection an intrinsic part of the application's self-execution rather than an external filtering mechanism.
3Manufacturing precision
If detection rules are injected into application functions, then the system achieves function-level real-time protection, but the system complexity increases
Solution Approach 1:
The patent extracts the security detection logic from the application code itself by using aspect-oriented programming. The detection rules are taken out as separate injectable components that can be dynamically inserted into application functions without modifying the original application source code, thereby achieving fine-grained protection while maintaining application integrity and reducing system complexity.
Solution Approach 2:
The patent changes the parameter of security policy delivery from static configuration to dynamic injection. The cloud management platform formulates security policies and injects them into the aspect-oriented security base, which then dynamically inserts detection rules into application functions at runtime, enabling flexible and precise security control without hardcoding complex detection mechanisms.
Data Source
Figure 1~2
Figure 3
AI summary
Embodiments of this specification provide aspect-oriented technology based security protection systems, including a cloud management and control platform and a self-protection module. The self-protection module is installed in an aspect-oriented security base of a server for a to-be-protected application. The cloud management and control platform is configured to formulate a security policy, and send the security policy to the server, where the security policy includes injection point information of the to-be-protected application and a detection rule. The aspect-oriented security base is configured to send the security policy to the self-protection module when obtaining, by listening, the security policy sent by the cloud management and control platform. The self-protection module is configured to parse the security policy to obtain the injection point information and the detection rule; inject the detection rule into a corresponding injection point in the to-be-protected application based on the injection point information so that the detection rule is executed when a function corresponding to the injection point is called; and determine, based on an execution result, whether to execute a corresponding event action, and generate a security protection log. The embodiments of this specification can improve a security protection capability.