Partial Execution Stub for Web App Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Securing the execution of web applications in non-native environments is challenging due to vulnerabilities in existing security schemes, particularly in mobile devices with limited resources, where attackers can analyze control flow and modify underlying code, and non-native applications lack direct access to hardware security resources.
Innovation Solution
The implementation of a Partial Execution Stub (PES) function that communicates with a trusted module to verify execution information, replacing sensitive functions with partial execution dependencies managed by the trusted module, and using symbolic Partial Execution Flow Maps to secure web applications by interlacing application code with trusted module interactions, ensuring only partial execution logic is visible within the non-native environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security schemes are used in web applications, then implementation is simple, but security against vulnerabilities and attacks is inadequate
Solution Approach 1:
The patent introduces a security module as an intermediary component that mediates between the web application and the execution environment. This security module intercepts function calls, verifies execution contexts, and enforces security policies, thereby providing robust security without requiring complex changes to the entire system architecture.
Solution Approach 2:
The patent segments the execution environment into distinct components: the web application, the security module, and the execution environment. This segmentation allows the security module to operate independently, managing security concerns without affecting the core application logic, thus improving security while maintaining manageable system complexity.
2Adaptability or versatility
If web applications are executed in non-native environments with limited resources, then device compatibility is improved, but security protection is weakened
Solution Approach 1:
The security module implements self-service mechanisms by automatically verifying execution contexts, detecting tampering attempts, and enforcing security policies without requiring external intervention. This automation ensures consistent security protection across diverse devices with limited resources, maintaining both adaptability and reliability.
Solution Approach 2:
The patent dynamically adjusts security verification parameters based on the execution environment's capabilities. By changing verification depth, caching strategies, and validation frequency according to device resources, the system maintains strong security protection while adapting to constrained environments.
3Ease of operation
If control flow information is made visible for debugging purposes, then ease of operation is improved, but vulnerability to analysis and attacks increases
Solution Approach 1:
The security module implements partial visibility of control flow information by providing debugging capabilities for legitimate operations while withholding critical security-relevant information from potential attackers. This selective disclosure maintains debugging functionality without exposing the full attack surface.
Solution Approach 2:
The system implements feedback mechanisms that monitor access to control flow information and adjust visibility dynamically. When suspicious activity is detected, the security module reduces information disclosure, thereby maintaining ease of operation for legitimate users while minimizing vulnerability to attacks.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
Methods and nodes for securing execution of a web application by determining that a call dependency from a first to a second function needs to be protected, adding a Partial Execution Stub (PES) function comprising code to establish a communication connection with a trusted module. Methods and nodes for secured execution of a web application by invoking a function of the web application, invoking a Partial Execution Stub (PES) function during execution of the function of the web application, sending, from the PES function, a message call with current execution information to a trusted module and receiving, a verification result from the trusted module.