Collaborative Application Security via Threat Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Securing computer systems against unauthorized access, particularly when attackers use valid credentials to gain access and target multiple applications, is challenging due to the difficulty in detecting and managing such malicious activities across different applications.
Innovation Solution
A collaborative application security system that shares threat data among applications, using a centralized or decentralized approach, to detect and manage unauthorized access by creating honeytokens and threat detection points, and transferring malicious sessions to cloned application sessions to limit access and gather information for threat intelligence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If applications independently secure themselves without collaboration, then each application can maintain simple security mechanisms, but attackers can target multiple applications using the same stolen credentials without being detected across the system
Solution Approach 1:
The patent merges security functions across multiple applications by implementing a centralized threat data store that all applications access. When one application detects a threat (such as stolen credentials), this information is stored centrally and immediately shared with other applications, enabling coordinated security responses without requiring complex point-to-point communication between applications.
Solution Approach 2:
The threat data store serves multiple functions: storing detected threats, sharing intelligence across applications, and enabling coordinated responses. This universal data structure allows the system to handle various threat types (stolen credentials, malicious sessions) and support multiple security operations (detection, prevention, response) through a single centralized mechanism.
2Difficulty of detecting and measuring
If applications share threat data collaboratively to detect malicious activities across multiple applications, then security detection capability improves, but the complexity of managing shared threat data and coordination increases
Solution Approach 1:
The patent introduces a centralized threat data store as an intermediary that simplifies data sharing between applications. Instead of applications directly communicating with each other (which would create complex coordination requirements), they all interact with the centralized store, which handles data storage, retrieval, and distribution automatically.
Solution Approach 2:
The system creates copies of threat data across multiple applications through the centralized store. When one application detects a threat, the threat information is copied to the centralized store and automatically made available to all other applications, enabling rapid threat propagation without complex data synchronization protocols.
3Loss of information
If malicious sessions are transferred to cloned application sessions, then access to actual data is limited and attacker techniques can be gathered, but the system complexity increases due to session management overhead
Solution Approach 1:
The patent creates cloned application sessions that replicate the functionality of real sessions but are isolated from actual data. When a malicious session is detected, it is transferred to a clone that mimics the application behavior, allowing the attacker to continue their attack against the clone while the real data remains protected. The clone serves as a safe environment for gathering attacker techniques.
Solution Approach 2:
The cloned session acts as an intermediary between the malicious user and the real application data. Instead of directly blocking or terminating the malicious session (which might alert the attacker), the system introduces a clone as a mediator that absorbs the malicious activity while protecting the underlying data and systems.
Data Source
AI summary
Systems, methods, and computer media for collaboratively securing software applications are provided herein. Through a collaborative approach, the described examples allow detection and management of unauthorized users across applications and application suites. By communicating details regarding cyber-attacks among applications, threats to applications can be managed pre-emptively. For example, applications can use attacks on other applications to implement new honeytokens, threat detection points, and blacklisted usernames or other identifiers to limit data access in future attacks.