Static Analysis for Privilege Escalation in Cross-Service Calls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face limitations in analyzing and detecting errors within executable code, particularly across different code objects of varying languages or architectures, as traditional compilers and interpreters are unable to provide similar analysis for service invocations, leading to challenges in modularized network-based services.
Innovation Solution
The on-demand code execution system enables static analysis of service invocations within code to identify potential issues such as parameter mismatches, privilege escalation vulnerabilities, and impedance mismatches, by maintaining a datastore of service information and utilizing monitoring data to analyze direct and indirect service calls, allowing for rapid execution and real-time error detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional compilers and interpreters are used for code analysis, then analysis capability is provided for native code, but analysis capability for service invocations across different code objects is lost
Solution Approach 1:
The code analysis system is designed to analyze multiple types of code objects (native code, service invocations, cross-service calls) through a unified analysis framework. The system performs static analysis on service invocation code and dynamic analysis on executed service invocations, combining multiple analysis approaches into a single versatile platform that can handle diverse code types and detection scenarios.
Solution Approach 2:
The system introduces an intermediary code analysis system that acts as a bridge between traditional compilers/interpreters and service invocation targets. This intermediary layer performs static and dynamic analysis of service invocations without interfering with the normal execution flow, enabling error detection across service boundaries while maintaining system modularity.
2Reliability
If static analysis of service invocations is performed to identify errors, then error detection capability is improved, but execution time increases
Solution Approach 1:
The system performs static analysis of service invocation code before execution to identify potential errors in advance. By analyzing the code structure, parameters, and service definitions beforehand, the system prepares analysis results that can be quickly validated during runtime without significantly impacting execution time. This preliminary analysis catches many errors before they manifest during actual service calls.
Solution Approach 2:
The code analysis system operates continuously during service invocation execution, performing dynamic analysis without interrupting the normal flow. The system monitors service calls in real-time and validates parameters as they are passed, maintaining continuous error detection coverage while minimizing impact on execution performance through efficient analysis techniques.
3Measurement precision
If comprehensive code analysis is performed across all service invocations, then detection precision is improved, but system complexity increases
Solution Approach 1:
The code analysis system divides the analysis process into distinct segments: static analysis of service invocation code, dynamic analysis of executed invocations, and analysis of cross-service calls. Each segment handles specific aspects of error detection independently, allowing the system to maintain high detection precision while managing complexity through modular organization of analysis functions.
Data Source
AI summary
Systems and methods are described for conducting static analysis of code invoking network-based services to identify, without requiring execution of the code, security issues that may be introduced due to the invocations of the network-based services. A system is provided that may analyze code to detect both direct invocations of services, as well as indirect invocations caused by the direct invocations. The system can compare permissions information for the code to both directly or indirectly invoked services to identify instances in which the code calls services not permitted by the permissions information. In some instances, the system can traverse a “call graph” of all services invoked by code either directly or indirectly to identify permissions errors through multiple levels of indirection.