Secure App Update Server and API Server for Reverse Engineering Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing client-server systems face security challenges due to the ease with which unauthorized third parties can reverse engineer mobile apps, leading to unauthorized API calls and potential security breaches, especially in widely distributed applications where frequent modifications are impractical.
Innovation Solution
A network security system comprising a secure app update server and a secure API server that transforms app code objects, converting API requests into renormalized requests, thereby adding a secure anti-tampering layer and making reverse engineering more difficult without requiring extensive modifications to the app or its interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the client software is widely and publicly disseminated, then accessibility and ease of operation are improved, but security deteriorates because unauthorized third parties can reverse engineer the application and perform unauthorized operations
Solution Approach 1:
The patent introduces a server as an intermediary between the client software and the protected resource. The server validates API requests and mediates access, preventing direct client-to-resource communication that would be vulnerable to reverse engineering. This allows the client to remain publicly distributed while security is enforced at the server level.
Solution Approach 2:
The patent extracts the security-critical validation logic from the client software and relocates it to the server. By taking out the authentication and authorization checks from the client side, the system eliminates the vulnerability to reverse engineering while maintaining security functionality.
2Object-affected harmful factors
If all API interactions between client and server are encrypted, then security is improved, but ease of operation deteriorates because encryption does not prevent attacks when endpoint apps are compromised or replicated
Solution Approach 1:
The patent implements preliminary validation of API requests at the server before processing. By checking the legitimacy and authorization of requests in advance, the system prevents unauthorized operations even when clients are compromised, rather than relying solely on post-encryption security measures.
Solution Approach 2:
The patent implements a feedback mechanism where the server validates each API request against authorized operations and provides immediate rejection for unauthorized requests. This real-time feedback loop prevents compromised clients from successfully executing unauthorized operations.
3Object-affected harmful factors
If the system requires frequent modifications to prevent reverse engineering, then security is improved, but device complexity and ease of repair deteriorate
Solution Approach 1:
By introducing the server as a mediator, the system achieves security without requiring frequent client modifications. The server handles security updates and validation independently, allowing the client to remain stable while security measures are enhanced on the server side.
Solution Approach 2:
The patent changes the security enforcement point from client-side parameters to server-side parameters. This allows security to be strengthened by modifying server validation logic rather than requiring frequent client app updates, reducing complexity and improving maintainability.
Data Source
AI summary
A coupled set of servers in a server system protect an application programming interface (“API”) from unwanted automation facilitated by unauthorized reverse engineering of an endpoint app or communications channel used by the endpoint app. The server system comprises at least one secure app update server that transforms an app code object received from an enterprise app server into a transferred app code object, and at least one secure application programming interface (“API”) server that interacts with an endpoint device that executes the transformed app code object. The secure API is adapted to convert API requests made by the transformed app code object into renormalized API requests formatted for processing by an enterprise API server. The transforming of the app code object results in API requests from the client that would constitute invalid API requests if presented to the enterprise API server without renormalization.