Encrypted Object Reference API Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current API protection solutions are vulnerable to attackers masquerading as legitimate users, expensive, and introduce latency, failing to effectively prevent Broken Object Level Authorization (BOLA) attacks.
Innovation Solution
A system and method that secures communication between a server and a client by analyzing API payloads, encrypting and decrypting server and client references using a predefined cryptographic function, and blocking API calls if the decrypted client reference does not match the authenticated reference, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If machine learning and AI are used to establish traffic baseline and detect deviations, then API protection capability is improved, but system cost increases and setup complexity increases
Solution Approach 1:
The patent replaces expensive machine learning/AI systems with a simple cryptographic approach using encrypted object references. Each client receives encrypted references that are discarded after use, providing strong security without the high cost and complexity of ML systems. The encryption/decryption mechanism is computationally efficient and easy to implement.
Solution Approach 2:
The patent extracts the core security function from complex ML systems, isolating only the essential cryptographic verification step. By removing the unnecessary complexity of traffic baseline establishment and deviation detection, the system achieves the same protection goal with minimal setup requirements.
2Reliability
If machine learning and AI are used to establish traffic baseline and detect deviations, then API protection capability is improved, but system cost increases
Solution Approach 1:
The patent uses inexpensive cryptographic primitives (encryption/decryption) instead of expensive ML infrastructure. The encrypted object references are simple data structures that can be generated and verified with minimal computational resources, dramatically reducing system cost while maintaining strong security against BOLA attacks.
3Reliability
If machine learning and AI are used to establish traffic baseline and detect deviations, then API protection capability is improved, but latency is introduced
Solution Approach 1:
The patent performs encryption of object references in advance during the authentication phase. The encrypted references are then directly usable in subsequent API calls without requiring real-time analysis. This preliminary preparation eliminates the latency that would otherwise be introduced by ML-based traffic analysis during API execution.
Solution Approach 2:
The cryptographic verification process is computationally lightweight compared to ML inference, requiring minimal processing time. The simple encryption/decryption operations complete almost instantaneously, avoiding the significant latency introduced by complex ML models while maintaining effective BOLA attack prevention.
4Reliability
If encrypted object references are provided to each client, then security against BOLA attacks is improved, but device complexity increases
Solution Approach 1:
The patent uses a universal cryptographic approach that can be implemented across all clients and servers with a single standardized protocol. The encryption/decryption mechanism serves multiple purposes: authenticating clients, preventing BOLA attacks, and enabling secure object reference transmission. This multi-functionality reduces the need for separate security mechanisms, simplifying overall system design.
Data Source
AI summary
Systems and methods of securing communication between a server and a client device, including: analyzing an application programming interface (API) payload from the server to identify server's object references, retrieving an authenticated client reference, encrypting at least one pair of server's object reference and client reference based on a predefined cryptographic function, analyzing a payload of an API call from the client device to identify the at least one encrypted pair, decrypting the at least one encrypted pair identified from the API call, to receive at least one pair of server's object reference and client reference, and blocking the API call if the decrypted client reference does not match the retrieved authenticated client reference.