Security Virtual Machine for API Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software systems face vulnerabilities through their application programming interfaces (APIs) due to complex interactions between different versions and components, leading to inadequate parameter validation and potential misuse or attacks, necessitating a mechanism to enforce security policies.
Innovation Solution
A security virtual machine is introduced that executes a security program in an intermediate language, compiled from a high-level representation of the security policy, to enforce security policies by intercepting and validating system calls, blocking undesired behaviors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing parameter validation functions are used in software systems, then backward compatibility with prior versions is maintained, but parameter validation becomes insufficient due to complex interactions between different versions and components
Solution Approach 1:
The patent introduces a security virtual machine as an intermediary layer between the application programming interface and the underlying software systems. This security virtual machine executes security programs that intercept and validate parameters before they are passed to the actual software components, thereby maintaining backward compatibility while providing enhanced parameter validation through a dedicated security enforcement layer
Solution Approach 2:
The patent segments the security validation function from the existing software system by implementing it as a separate security virtual machine. This segmentation allows the security validation logic to be independently developed, maintained, and updated without affecting the underlying software systems, thus resolving the complexity issue while improving validation reliability
2Adaptability or versatility
If functions from prior versions are combined with newer versions and components from different developers are integrated, then functionality and versatility are improved, but parameter validation adequacy deteriorates
Solution Approach 1:
The security virtual machine provides universal parameter validation capability that works across all functions from different versions and all components from different developers. By implementing a single security enforcement layer that intercepts all system calls, the patent achieves multi-functional validation without requiring version-specific or developer-specific validation logic, thus maintaining adaptability while ensuring validation adequacy
3Reliability
If a security mechanism is added to enforce security policies, then security validation is improved, but system complexity increases
Solution Approach 1:
The security virtual machine serves as an intermediary layer that sits between the application programming interface and the software systems. It intercepts system calls, executes security programs to validate parameters, and only allows valid calls to proceed. This intermediary approach provides robust security policy enforcement while containing complexity in a dedicated module rather than distributing it throughout the entire system
Data Source
AI summary
A method and system for enforcing a security policy encoded in an instruction set of a security virtual machine is provided. A security system provides a security virtual machine that executes security programs expressed in the instruction set of the security virtual machine. The security system stores the security program in an instruction store of the security virtual machine. When a security enforcement event occurs, the security virtual machine executes the instructions of its instruction store using data of the security enforcement event to enforce the security policy.