Input Validation via Mathematical Expression Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing input validation systems face challenges in validating user inputs locally with up-to-date algorithms without exposing themselves to remote code execution vulnerabilities, particularly when validation algorithms change frequently.
Innovation Solution
The method employs mathematical expressions stored as text strings within a validation package, which are used to scan and validate input strings, preventing the distribution of executable code and thus mitigating remote code execution risks. This involves a scan controller to locate hit strings, a validation controller to evaluate mathematical expressions, and an application that processes input strings to generate validation results and obfuscate sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If validation algorithms are updated periodically, then validation effectiveness is improved, but remote code execution vulnerability risk increases
Solution Approach 1:
The patent extracts the harmful executable code component from the validation algorithm distribution process. Instead of distributing executable validation algorithms that could contain vulnerabilities, the system distributes only data-driven validation rules (regex patterns, validation logic) that are incapable of executing arbitrary code. This separation eliminates the remote code execution vulnerability while preserving validation effectiveness through continuous updates of the data-driven rules.
Solution Approach 2:
The patent introduces a compiler intermediary that translates high-level validation algorithms into safe, data-driven representations. The compiler acts as a mediator between the validation algorithm source and the execution environment, converting potentially harmful executable code into safe validation rules that can be updated periodically without introducing remote code execution vulnerabilities.
2Loss of time
If validation is performed locally without web service access, then latency is reduced, but ability to update validation algorithms becomes limited
Solution Approach 1:
The patent applies preliminary action by pre-compiling validation algorithms into data-driven validation rules that can be distributed and stored locally. The compilation process occurs in advance, producing portable validation rule sets that can be deployed to local systems without requiring web service access during execution. This enables both low-latency local validation and periodic updates through redistribution of updated rule sets.
Solution Approach 2:
The patent introduces dynamics by making the local validation system updateable through redistribution of data-driven validation rules. While the local execution environment remains static for performance, the validation rules themselves are dynamic and can be updated by redistributing new rule sets from validation algorithm sources, combining local speed with update capability.
3Adaptability or versatility
If executable validation code is distributed, then validation functionality is complete, but security exposure increases
Solution Approach 1:
The patent substitutes the mechanical execution model with a data-driven validation model. Instead of distributing executable code that mechanically performs validation operations, the system distributes data structures (regex patterns, validation rules) that describe validation logic. The execution engine on the client side interprets these data structures, achieving complete validation functionality while eliminating security exposure associated with distributing executable validation code.
Data Source
AI summary
A method implements input validation using mathematical expressions. The method includes receiving an input string, scanning the input string to locate a hit string matching a hit expression from a validation package, and converting the hit string to a list of values corresponding to characters from the hit string. The method further includes validating the hit string by evaluating a validation expression from the validation package using the list of values to generate a validation result and returning the validation result.