Server Data Integrity Validation via Tainted Object Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures for client-server interactions, such as SSL and application firewalls, are inefficient in validating data integrity and detecting vulnerabilities, particularly in HTTP communications, as they rely on manual validation or hardware solutions that are not easily integrable into development environments and generate performance overhead.
Innovation Solution
A method and system that implement a global information flow control by using compiled code transformation, APIs extension, and additional code to monitor and validate only editable data parameters, creating data structures to track and propagate tainted objects, and performing proactive actions to ensure data integrity without modifying the original source code or parsing entire responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application firewalls parse all server responses to validate data integrity, then security validation is improved, but parsing efficiency deteriorates and performance overhead increases
Solution Approach 1:
The patent extracts only the critical validation information from the complete server response by identifying and processing only the state identifiers and risk point data structures, rather than parsing the entire HTML response. This selective extraction maintains security validation while significantly improving parsing efficiency.
Solution Approach 2:
The patent segments the validation process into distinct phases: initial request processing to extract state identifiers, state maintenance for tracking modifications, and validation execution only when needed. This segmentation allows efficient validation by processing only relevant portions of data at appropriate times.
2Reliability
If application firewalls validate all requests automatically, then security detection is improved, but device complexity and integration difficulty worsen
Solution Approach 1:
The patent merges the firewall validation functionality directly into the server application code itself, eliminating the need for separate hardware firewalls. The server maintains state information and performs validation internally, simplifying the overall system architecture and improving integration.
Solution Approach 2:
The patent implements a universal validation mechanism that handles multiple security concerns (data integrity, XSS prevention, SQL injection detection) through a single integrated state management system, reducing the need for multiple specialized components.
3Ease of manufacture
If manual validation by developers is performed, then implementation simplicity is improved, but validation efficiency and reliability deteriorate
Solution Approach 1:
The patent implements self-service validation where the server automatically maintains state information and detects client modifications without requiring manual developer intervention. The system autonomously tracks state changes and identifies security risks, eliminating dependency on human factors while maintaining implementation simplicity.
4Reliability
If all data parameters are validated, then security coverage is improved, but performance overhead increases due to processing entire data sets
Solution Approach 1:
The patent applies local quality validation by focusing security checks only on specific risk points and state identifiers rather than validating all data parameters uniformly. This targeted approach maintains comprehensive security coverage for critical elements while reducing overall processing overhead.
Solution Approach 2:
The patent implements partial validation by processing only the necessary state information and risk point data structures, rather than validating every possible parameter. This selective validation maintains adequate security coverage while significantly reducing performance overhead.
Data Source
Figure 1A~1B
Figure 2A
Figure 2B
AI summary
The present invention relates to a solution to improve the security of applications. Particularly, the invention relates to the control of the whole lifecycle of data traffic between a client and a server applying also internal data flow system within the server only for editable data. The invention presents a method for detection of manipulation of data (29) by a client (11, 15, 25) that performs a request to a server (13, 17, 27) and detection of vulnerabilities within source code. The invention also presents an application and a system for the detection of manipulation in applications. As a particular example, the invention presents a method for detection of manipulation of web pages in HTTP.