Component protection frameworks using defensive patterns
AssigneeSap SE
InventorsChristoph Haefner, Martin Johns, Martin Haerterich
Life of this patent
Estimating the term…
Abstract
Systems and methods are provided herein for establishing a protection framework for a component. Identified assets of a component requiring protection from a potential attack are received. A list of assets is generated based on the identified assets. A protection framework is configured to include at least one defensive pattern to protect the list of assets against the potential attack. The protection framework is executed to establish a hardened boundary between the component and an attack surface of the component.
Claims20
A method for establishing a protection framework for a component, the method being implemented by one or more data processors forming one or more computing devices and comprising:
- receiving, by at least one data processor, identified assets of a component requiring protection from a potential attack;
- generating, by the at least one data processor, a list of assets based on the identified assets;
- configuring, by the at least one data processor, a protection framework including at least one defensive pattern to protect the list of assets against the potential attack;
- and
- executing, by the at least one data processor, the protection framework to establish a hardened boundary between the component and an attack surface of the component;
- wherein the at least one defensive pattern is a constructor pattern and the hardened boundary is established by (i) sealing a returned proxy object of the component such that the returned proxy object is protected to prevent new properties from being added to the returned proxy object and marks existing properties of the returned proxy object as non-configurable (ii) sealing a prototype of the component, and (iii) modifying write permissions of a list of attributes belonging to the prototype.
A non-transitory computer-programmable product for establishing a protection framework for a component, the computer-programmable product storing instructions which, when executed by at least one data processor, result in operations comprising:
- receiving identified assets of a component requiring protection from a potential attack;
- generating a list of assets based on the identified assets;
- configuring a protection framework including at least one defensive pattern to protect the list of assets against the potential attack;
- and
- executing the protection framework to establish a hardened boundary between the component and an attack surface of the component;
- wherein the at least one defensive pattern is a constructor pattern and the hardened boundary is established by (i) sealing a returned proxy object of the component such that the returned proxy object is protected to prevent new properties from being added to the returned proxy object and marks existing properties of the returned proxy object as non-configurable (ii) sealing a prototype of the component, and (iii) modifying write permissions of a list of attributes belonging to the prototype.
A system establishing a protection framework for a component, the system comprising:
- at least one data processor;
- memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
- receiving identified assets of a component requiring protection from a potential attack;
- generating a list of assets based on the identified assets;
- configuring a protection framework including at least one defensive pattern to protect the list of assets against the potential attack;
- and
- executing the protection framework to establish a hardened boundary between the component and an attack surface of the component;
- wherein the at least one defensive pattern is a constructor pattern and the hardened boundary is established by (i) sealing a returned proxy object of the component such that the returned proxy object is protected to prevent new properties from being added to the returned proxy object and marks existing properties of the returned proxy object as non-configurable (ii) sealing a prototype of the component, and (iii) modifying write permissions of a list of attributes belonging to the prototype.
Dependencies are inferred from the claim text.