Manifest File Rule Generation for Automated Security Violation Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for reviewing metadata in applications, particularly manifest files, have not reliably identified all potential security issues, especially in mobile computing devices, leading to flawed configurations that can compromise security.
Innovation Solution
An automated system evaluates manifest files by accessing software development kit (SDK) and online documentation to generate configuration rules, identifying violations, and generating reports with suggested fixes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual review of metadata is used, then flexibility and adaptability are maintained, but security reliability and effectiveness are compromised
Solution Approach 1:
The patent replaces manual metadata review processes with an automated computer system that evaluates manifest files against configuration rules. The system automatically accesses metadata, generates rules based on SDK documentation, determines violations, and transmits results, eliminating the need for manual inspection while improving security reliability.
Solution Approach 2:
The system enables self-service by automatically generating configuration rules from SDK documentation and online resources without requiring manual intervention. The automated evaluation process serves itself by extracting requirements from documentation, creating rules, and executing evaluations independently, improving both reliability and reducing operational complexity.
2Reliability
If automated evaluation system is implemented, then security effectiveness is improved, but initial system complexity increases
Solution Approach 1:
The system performs preliminary actions by pre-accessing and storing SDK documentation and online resources before actual evaluation occurs. Configuration rules are generated in advance based on stored documentation, allowing rapid evaluation without requiring complex real-time rule generation, thus reducing operational complexity while maintaining security effectiveness.
Solution Approach 2:
The patent introduces an intermediary layer of configuration rules that mediates between the complex SDK documentation and the evaluation process. These rules serve as simplified intermediaries that capture essential security requirements, allowing the system to evaluate metadata effectively without directly processing complex documentation during evaluation, thereby reducing system complexity.
3Measurement precision
If comprehensive metadata evaluation is performed, then identification of security issues is improved, but processing time increases
Solution Approach 1:
The system segments the evaluation process into distinct phases: accessing metadata, generating configuration rules from SDK documentation, determining violations, and transmitting results. This segmentation allows each phase to be optimized independently and enables parallel processing of rule generation and metadata evaluation, improving identification accuracy while reducing overall processing time.
Solution Approach 2:
The system performs preliminary rule generation from SDK documentation before actual metadata evaluation. By pre-processing and storing configuration rules, the system eliminates time-consuming rule generation during evaluation, allowing rapid and accurate identification of security issues without increasing processing time.
Data Source
AI summary
The present disclosure provides computer-implemented methods, systems, and devices for automatically evaluating metadata associated with an application. A computing system accesses metadata for a respective application; wherein the respective application is associated with an operating system. The computing system accesses data describing requirements for the operating system. The computing system automatically generates one or more configuration rules for the metadata based on the documentation for the operating system. The computing system determines that the metadata violates one or more configuration rules based on the one or more configuration rules. The computing system transmits data describing one or more violations of the configuration rules for display.