Entry Point Finder for Unnecessary Privilege Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computer systems, particularly enterprise resource planning (ERP) systems, face challenges in managing security and identifying vulnerabilities due to complex software structures and the introduction of patches which can create new vulnerabilities, making it difficult to predict and address security threats efficiently.
Innovation Solution
The Entry Point Finder (EPF) system analyzes business-critical application computer systems by extracting software objects, identifying relationships, and creating a graph database to visualize and analyze these relationships, facilitating the detection of entry points that could be exploited, assessing the impact of patches, checking for unnecessary privileges, and generating rules for detecting security vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional manual security analysis methods are used to identify vulnerabilities and entry points in complex computer systems, then thorough security assessment can be achieved, but the time and effort required becomes excessively long and impractical
Solution Approach 1:
The patent replaces manual mechanical security analysis with an automated computer-based Entry Point Finder system that uses graph database technology to automatically extract software objects, build system models, and identify entry points and vulnerabilities, thereby eliminating the time-consuming manual process while maintaining detection accuracy
Solution Approach 2:
The patent introduces a graph database as an intermediary structure that models the computer system's software objects and their relationships. This intermediary enables automated analysis by representing the system in a format that can be efficiently queried and analyzed by the EPF algorithm, bridging the gap between raw system data and security insights
2Reliability
If comprehensive security analysis of all software objects and relationships is performed to ensure thorough vulnerability detection, then security coverage is improved, but the system complexity and computational resources required increase significantly
Solution Approach 1:
The patent extracts only the essential software objects and their relationships from the complex computer system to build a simplified graph database model. By selectively extracting relevant entities (software objects, interfaces, data structures) and their connections, the system achieves comprehensive security coverage without being overwhelmed by the full complexity of the original system
Solution Approach 2:
The patent segments the complex security analysis problem into distinct computational stages: extracting software objects, building the graph database model, executing the EPF algorithm to identify entry points, and generating security reports. This segmentation allows each stage to be handled independently with appropriate algorithms and data structures, reducing overall system complexity
3Measurement precision
If detailed graphical representation and analysis of all software object relationships is created to identify entry points, then detection precision is improved, but the time and computational resources required for processing increase
Solution Approach 1:
The patent replaces manual graphical analysis with an automated algorithm that processes the graph database structure to identify entry points. The system automatically traverses the graph, applies detection rules, and generates results without requiring manual interpretation of graphical representations, thereby maintaining high detection precision while dramatically improving processing efficiency
Data Source
AI summary
A computer-based method is disclosed for checking a target computer system for unnecessary privileges. The method includes receiving, at a computer-based privileges checking system, a listing of all privileges available the target computer system; receiving, at the computer-based privileges checking system, information about end-user activities on the target computer system over a specified period of time; for each respective one of the end-user activities, querying a computer-based entry point finder for any privileges that were checked at the target system for that activity; and removing the privileges that were checked at the target system for the end-user activities from the listing of all privileges available at the target system to produce a listing of unnecessary privileges at the target system.