Static API Mapping for Runtime Execution Hardening Profiles

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current software hardening approaches require manual generation of platform-specific enforcement profiles, necessitating significant engineering effort and technical knowledge, and are not scalable for large projects or fast-changing products.

Innovation Solution

Implement automatic runtime execution hardening through static system API data mapping, which generates platform-specific enforcement profiles within the software development environment, analyzing artifacts without executing the software program, and using static system call analysis to create a platform-specific enforcement profile.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual generation of enforcement profiles is used, then security hardening can be achieved, but significant engineering effort and technical knowledge are required

Engineering Contradiction:

Improvesecurity hardeningVSAvoidengineering effort

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system performs static analysis of artifacts during the build process to pre-generate enforcement profiles before deployment. This preliminary action captures all system API calls without requiring runtime execution or manual configuration, resolving the contradiction by automating profile generation in advance

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The hardening system automatically analyzes its own build artifacts and generates platform-specific enforcement profiles without external intervention. The build system itself provides the data needed for profile generation, making the process self-service and eliminating manual engineering effort

Inventive Principle:

Principle #25Self-service

2Reliability

If platform-specific enforcement profiles are created manually, then secure mode hardening can be implemented, but specific configuration for each platform is required

Engineering Contradiction:

Improvesecure mode hardeningVSAvoidplatform compatibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system generates enforcement profiles that are universally applicable across multiple platforms by analyzing platform configuration data during the build process. The same build system can produce profiles for different operating systems and architectures, making the hardening solution multi-functional and platform-agnostic

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system automatically adjusts enforcement profile parameters based on detected platform configuration data. By changing parameters such as allowed system calls and security policies according to the target platform, the system maintains secure hardening across diverse environments without manual reconfiguration

Inventive Principle:

Principle #35Parameter changes

3Productivity

If static analysis of artifacts is performed, then enforcement profiles can be generated without executing the software program, but comprehensive test suites are not required

Engineering Contradiction:

Improveprofile generation efficiencyVSAvoidtesting time

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

Static analysis is performed during the build process to capture all system API calls before deployment. This preliminary capture of execution paths eliminates the need for comprehensive runtime test suites, as the enforcement profile is generated from complete static analysis of all possible code paths

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system replaces mechanical runtime execution and testing with static analysis of build artifacts. By substituting physical execution with computational analysis of compiled code, the system achieves profile generation without requiring actual software execution or comprehensive test suites

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS12474906B2Automatic runtime execution hardening through static system application programming interface (API) data mapping

Publication Date: 2025.11.18 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Systems and methods are provided for implementing automatic runtime execution hardening for software programs undergoing software development. In various embodiments, a computing system performs automatic enforcement profile generation within a software development environment in which source code of a software program is compiled or translated to create an executable software program. Automatic enforcement profile generation includes accessing, from a data storage device, an artifact associated with the software program, statically analyzing the artifact (including machine code) associated with the software program without executing the software program, and generating system API usage data based on the analysis. A platform-specific enforcement profile for a secure mode hardening feature is created based on the system API usage data and platform configuration data. When applied to the software program, the platform-specific enforcement profile defines actions (including system calls) that the software program is allowed to perform, while blocking other actions (including other system calls).