Cloud-Native Call Graph Risk Assessment for User-Specific Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Assessing security vulnerabilities in cloud-native applications is challenging due to their distributed nature, complex integration with external API services, and the difficulty in tracing data flow, making it hard to understand and control data movement and potential risks.
Innovation Solution
Constructing a distributed call graph of cloud-native applications using existing tracing techniques and augmenting it with vulnerability data, allowing for risk assessment and policy enforcement based on user profiles and transaction-specific analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If distributed tracing techniques are used to map application components, then security analysis capability is improved, but system complexity increases
Solution Approach 1:
The system segments the distributed application into individual components and services, mapping their interactions through a call graph. Each component is analyzed separately for vulnerabilities, allowing precise security assessment without requiring analysis of the entire complex system at once. This segmentation enables security personnel to focus on specific high-risk components identified through the call graph.
Solution Approach 2:
The patent introduces an intermediary security analysis system that sits between the distributed application components and the security personnel. This intermediary automatically constructs call graphs, identifies vulnerable components, and presents analyzed security information, reducing the complexity burden on both the application infrastructure and the security analysts.
2Measurement precision
If dynamic testing is performed on application components, then vulnerability detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary dynamic testing and vulnerability assessment on application components during development and deployment phases, before the application goes into production. Call graphs are constructed in advance, and vulnerable components are identified beforehand, allowing security personnel to prepare mitigation strategies without waiting for production incidents.
Solution Approach 2:
The patent applies different testing depths and methods to different components based on their risk profiles. High-risk components identified through initial static analysis undergo more rigorous dynamic testing, while low-risk components receive minimal testing. This localized quality approach maintains high vulnerability detection accuracy for critical components while reducing overall processing time.
3Measurement precision
If granular risk assessment is implemented for each call path, then security control precision is improved, but computational overhead increases
Solution Approach 1:
The system implements granular risk assessment selectively based on component characteristics and call path importance. Critical components and high-traffic call paths receive detailed risk assessment, while less important components use simplified assessment models. This local quality approach maintains high security control precision for vulnerable areas while reducing computational overhead in less critical areas.
Solution Approach 2:
The patent dynamically adjusts assessment parameters such as testing depth, sample size, and analysis granularity based on component risk levels, traffic patterns, and resource availability. For low-risk components, the system uses coarser-grained assessment with fewer parameters, reducing computational overhead while maintaining adequate security control.
Data Source
AI summary
According to some embodiments, a method is performed by a distributed cloud-native application. The method comprises receiving a request from a user to perform an operation. The user is associated with a risk profile. The method further comprises determining a call path through the distributed cloud-native application to perform the operation and classifying a risk level associated with the determined call path based on a distributed call graph. The distributed call graph comprises a risk value for each call path through the distributed cloud-native application and each call path comprises one or more distributed cloud-native application components. The risk value is based on a weakness rating associated with each component in the call path. The method further comprises determining the risk level associated with the determined call path is acceptable based on the risk profile associated with the user and performing the operation.