Secret-Server Hook Intercepts Application Calls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Storing secret information in plain text within configuration files or registries on computer systems makes it vulnerable to unauthorized access, requiring labor-intensive modifications to application code to secure it using external secret servers.
Innovation Solution
A secret-server hook is inserted into applications at start-up to intercept calls for secret information, redirecting them to a secret server for retrieval and caching, replacing plain text information with blank placeholders in local storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If secret information is stored in plain text in configuration files or registries, then administrators can easily modify settings, but the secret information becomes vulnerable to unauthorized access by other users
Solution Approach 1:
The patent extracts secret information from local configuration files and registries, storing it externally in a secret server. This allows the application to reference secret placeholders in local config files while the actual secret values are retrieved from the external secret server, thereby protecting secrets from unauthorized local access while maintaining ease of configuration management.
Solution Approach 2:
The patent introduces a secret server as an intermediary between the application and secret information. The secret server acts as a mediator that provides secret values to applications through controlled interfaces, replacing direct local storage access. This intermediary layer protects secrets while maintaining the ability for administrators to manage them centrally.
2Object-affected harmful factors
If secret information is encrypted or stored externally, then security is improved, but labor-intensive modifications to application code are required to implement secure storage
Solution Approach 1:
The patent uses placeholder copies in local configuration files that reference external secret server entries. Instead of modifying application code to handle encryption or external storage, the system creates placeholder entries in the existing config files that point to the secret server, allowing applications to continue reading from their original configuration files without code changes.
Solution Approach 2:
The secret server provides a universal interface that can serve multiple applications and purposes. By implementing a standardized secret retrieval mechanism that works across different application types and configurations, the system reduces the need for application-specific security implementations, thereby lowering overall implementation complexity.
3Object-affected harmful factors
If application code is modified to use external secret servers, then security is enhanced, but the time and effort required to secure multiple applications increases significantly
Solution Approach 1:
The patent segments the secret management functionality into a separate, independent secret server component. This allows secret management to be implemented once at the infrastructure level rather than modifying each application individually. The secret server can then serve multiple applications simultaneously, dramatically reducing the time and effort required to secure multiple applications.
Solution Approach 2:
The system performs preliminary configuration by placing placeholder entries in application configuration files before the applications run. These placeholders are pre-configured to reference the secret server, so when applications start, they automatically use the secure secret retrieval mechanism without requiring code modifications or runtime configuration changes.
Data Source
AI summary
A computer system includes a memory to store an application. A processor is configured to start the application, and insert a secret-server hook into the application during start-up. The secret-server hook has instructions to access a secret server with the secret information stored therein. In response to a call being made by the application for the secret information, the secret-server hook has further instructions to intercept the call, and provide the secret information in the secret server to the application based on the intercepted call.