Protected Proxy for Dynamic API Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing API scanning technologies expose vulnerabilities and can crash websites or services during scans, and users lack the expertise to interpret complex security scanner output, making it difficult to identify and mitigate potential threats effectively.
Innovation Solution
A protected proxy design for a dynamic API scanning service that abstracts security scanning techniques and configurations, providing a user-friendly interface for scanning endpoints, and employs a redirect service to mirror requests without forwarding the original, ensuring endpoint security and simplifying output data interpretation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If API scanners directly scan endpoints, then vulnerability detection capability is improved, but the scanned services may crash or be exposed to harmful attack traffic
Solution Approach 1:
The patent introduces a proxy service as an intermediary between the API scanner and the scanned endpoint. The proxy receives scan requests from the scanner, sanitizes and controls them, then forwards to the target endpoint. This mediator protects the endpoint from harmful attack traffic while enabling vulnerability detection, directly resolving the contradiction between scanning capability and service stability.
Solution Approach 2:
The system segments the scanning function into separate components: a dedicated proxy service that handles scan request sanitization and control, and the actual scanning logic that operates on sanitized requests. This segmentation allows the scanner to detect vulnerabilities while the proxy isolates potential harmful effects from the scanned services.
2Ease of operation
If security scanning configurations and techniques are exposed to users, then user control over scanning is improved, but user complexity and difficulty in interpreting results increases
Solution Approach 1:
The patent extracts the complex security scanning configurations and techniques from the user interface. Users interact with a simplified interface that presents only necessary parameters, while the system internally handles the complex scanning logic, sanitization rules, and vulnerability detection algorithms. This extraction maintains ease of operation while preserving scanning effectiveness.
Solution Approach 2:
The system creates an abstracted view of the scanning process where users interact with simplified representations of scan results rather than raw technical data. The proxy service translates complex scanning outputs into user-friendly formats, maintaining the full scanning capability while presenting simplified information to users.
3Measurement precision
If original scan requests are forwarded to the target endpoint, then scanning accuracy is improved, but security protection and request control is reduced
Solution Approach 1:
The proxy service performs preliminary action by sanitizing and validating scan requests before they reach the target endpoint. It pre-processes the requests to remove or modify potentially harmful elements, ensuring that only safe and accurate scan requests are forwarded. This preliminary action maintains scan accuracy while protecting the endpoint from malicious traffic.
Solution Approach 2:
The proxy acts as an intermediary that receives original scan requests from the scanner, applies sanitization and control logic, then forwards modified requests to the endpoint. This mediator ensures that the endpoint receives controlled, sanitized requests that maintain scanning accuracy while eliminating security risks.
Data Source
AI summary
Described herein are systems and methods that provide a mechanism to proxy and protect HyperText Transport Protocol/Transport Layer Security (HTTP/TLS) redirection attempts. This technique mirrors an intended target request with a new request, never forwarding the original request from the scanner. This action provides protection to the end target as only key elements of the HTTP request are used while crafting a new HTTP request.