Shim-Based API Interception for Sensitive Data Transfer Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices often disseminate user information unintentionally, leading to interruptions and distractions, as users are not informed about data transfer to external devices, and manufacturers lack knowledge about application behavior regarding network communication.
Innovation Solution
A method using Network Security Authorization lists (NSAL) and shimming to intercept APIs, replacing sensitive information with substitute data, allowing for verification of data transfer and obtaining user consent before external transmission, thereby reducing interruptions and enhancing user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If legal notices are posted to indicate information dissemination policies, then user information privacy is protected, but user experience is interrupted and distracted
Solution Approach 1:
The patent performs verification of information transfer behavior in advance before the user experience begins. By checking whether the application transfers information to external devices before the user interacts with the application, the system eliminates the need for interruptions during user experience, while still protecting user privacy through pre-verification
2Reliability
If user consent is requested for information transfer, then user control over sensitive information is ensured, but user experience is interrupted
Solution Approach 1:
The system performs verification of information transfer behavior before the user experience starts. By conducting the check in advance, the patent eliminates the need for time-consuming consent requests during user interaction, while still ensuring user control through pre-verification of application behavior
Solution Approach 2:
The patent enables the system to automatically verify whether applications transfer information to external devices without requiring user intervention. The verification process is self-executing, using shimming techniques to intercept and analyze API calls, thus eliminating the need for user consent requests while maintaining user control
3Measurement precision
If verification of information transfer is performed, then accurate consent requests can be provided, but system complexity increases
Solution Approach 1:
The patent introduces shimming as an intermediary technique that sits between the application and the operating system APIs. The shim intercepts API calls and verifies whether sensitive information is being transferred, providing accurate detection without requiring complex modifications to the application or operating system core
Solution Approach 2:
The verification system creates a copy or replica of the API call flow through shimming, allowing analysis of information transfer behavior without disrupting the actual application execution. This copying approach enables precise verification while keeping the verification mechanism separate and manageable
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The technology includes a method to test what information an application transfers to an external computing device. A user's consent is explicitly obtained before the application transfers certain types of information, such as sensitive information. When a determination is made that an application is transferring sensitive information, a prompt for consent from a user may be provided that is accurate and detailed. In pre-production environments, technology can be used to detect whether this sensitive information is being transferred, and to validate whether a prompt for consent is necessary or unnecessary. To determine this, shimming is used to intercept application calls to APIs that return sensitive information. Requested sensitive information may be substituted with recorded or forged information from those APIs to produce a sentinel or canary. Similarly, network traffic of the application may be analyzed by another shim to determine when the substitute information is present.