Call Stack Whitelisting for Runtime Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current zero-trust security policies for applications are lacking at the software call stack level, leaving applications vulnerable to unauthorized access and security threats.
Innovation Solution
Implementing security policies at the software call stack level by determining a whitelist of authorized call stacks using manual and machine learning techniques, and applying a classification scheme to classify call stacks as authorized or unauthorized during application runtime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If zero-trust security policies are applied at the application level using whitelisting, then security against network path attacks is improved, but security vulnerabilities at the software call stack level remain unaddressed
Solution Approach 1:
The patent segments the security protection scope from the application level down to the software call stack level. It introduces a call stack sensor that monitors individual call stacks within the application, creating finer-grained security zones. This segmentation allows the system to identify and block unauthorized call stacks while maintaining legitimate application functionality, thereby addressing call stack level vulnerabilities without compromising application-level security operations.
2Object-affected harmful factors
If security monitoring is implemented at the software call stack level, then the number of potential attack sources is reduced, but system complexity and overhead increase
Solution Approach 1:
The patent introduces a call stack sensor as an intermediary component between the application and the security system. This sensor automatically captures call stack information and submits it to the security system for analysis, eliminating the need for complex manual monitoring mechanisms. The intermediary handles the complexity of call stack analysis, allowing the main system to focus on decision-making and response actions, thereby reducing overall system complexity while maintaining effective monitoring.
Solution Approach 2:
The patent creates a copy of the call stack information through the call stack sensor without disrupting the original application execution. By capturing and analyzing call stack copies, the system can identify unauthorized access patterns while the application continues to run normally. This copying approach allows security monitoring to occur in parallel with application execution, minimizing overhead and complexity.
3Ease of manufacture
If manual processes are used to determine authorized call stacks, then implementation simplicity is maintained, but automation and scalability are limited
Solution Approach 1:
The patent implements preliminary action by automatically capturing and storing authorized call stack information during application installation or initial execution. The call stack sensor records legitimate call stacks and submits them to the security system for classification and whitelisting before actual security enforcement begins. This preliminary automation reduces the need for manual configuration while maintaining implementation simplicity, as the system proactively builds its authorization database without requiring complex manual processes.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
The present disclosure provides systems, methods, and computer-readable media for implementing security polices at software call stack level. In one example, a method includes generating a call stack classification scheme for an application, detecting a call stack during deployment of the application; using the call stack classification scheme during runtime of the application, classifying the detected call stack as one of an authorized call stack or an unauthorized call stack to yield a classification; and applying a security policy based on the classification.