Web Application Firewall Library Security via Hash Comparison

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Modern web applications using third-party libraries face challenges in detecting vulnerabilities, as attackers can modify libraries to introduce vulnerabilities without updating version information, making it difficult for administrators to detect these issues.

Innovation Solution

A web application firewall generates executable code that clients can use to monitor for vulnerable libraries by comparing hash values of library functions, allowing for detection of vulnerabilities even if an attacker modifies the library's versioning information.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If web application administrators rely on versioning information to detect library vulnerabilities, then the detection process is simple and efficient, but attackers can modify libraries to hide vulnerabilities by preserving versioning information

Engineering Contradiction:

Improvevulnerability detection efficiencyVSAvoidvulnerability detection accuracy

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system creates a cryptographic hash (copy) of the library's executable code and compares it against known vulnerability signatures. This hash copy serves as a fingerprint that cannot be easily forged, allowing detection of vulnerabilities even when versioning information is preserved by attackers. The hash acts as an immutable representation of the actual code content.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent replaces the manual/ administrative process of checking version numbers with an automated cryptographic hashing mechanism. Instead of relying on administrators to manually verify version information, the system automatically generates hashes of library functions and compares them against vulnerability databases, substituting human judgment with mathematical verification.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If web application administrators manually monitor and update third-party libraries, then vulnerability detection can be thorough, but the process is time-consuming and resource-intensive

Engineering Contradiction:

Improvevulnerability detection thoroughnessVSAvoidtime for vulnerability monitoring

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system enables automatic self-monitoring of library vulnerabilities by implementing automated hash generation and comparison processes. The web application firewall automatically monitors library functions, generates cryptographic hashes, and compares them against vulnerability databases without requiring continuous manual intervention from administrators, thus achieving thorough detection with minimal time investment.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system pre-computes and stores cryptographic hashes of known vulnerable library functions in a vulnerability database. When a library is loaded, the system immediately compares the library's function hashes against these pre-computed values, enabling rapid detection without requiring time-consuming manual analysis at the moment of vulnerability assessment.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If web application firewalls implement comprehensive library monitoring, then security against injected vulnerabilities is improved, but system complexity and computational overhead increase

Engineering Contradiction:

Improvesecurity against injected vulnerabilitiesVSAvoidfirewall system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system extracts only the essential cryptographic hash values of library functions for monitoring purposes, rather than analyzing entire library files or implementing complex static analysis tools. This extraction approach focuses monitoring efforts on the most critical aspect (function hashes) while ignoring unnecessary complexity in library structure, metadata, and non-essential code elements.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system changes the monitoring parameter from examining entire library files or version metadata to comparing cryptographic hash values. This parameter transformation converts a complex, multi-dimensional analysis problem into a simple, efficient string comparison task, significantly reducing computational overhead while maintaining detection effectiveness.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12261874B2Library security methods and systems using a web application firewall

Publication Date: 2025.03.25 SALESFORCE INC

AI summary

Database systems and methods are provided for securing an instance of a web application from vulnerabilities in third party libraries using a web application firewall. One method involves receiving, at a web application firewall between an application server and a client, vulnerability information associated with the web application, generating, at the web application firewall, executable code for securing the instance of the web application based at least in part on the vulnerability information, providing, by the web application firewall, the executable code to the client over a network, and thereafter detecting a vulnerable library associated with the instance of the web application, wherein the client executes the executable code to secure the instance of the web application in response to detecting the vulnerable library.