US 11,108,803 B2Granted

Determining security vulnerabilities in application programming interfaces

AssigneeSynopsys, Inc.

InventorsShane Wilton, Benjamin D. Sedat, Angel Irizarry, Michael Borohovski, Ainsley K. Braun

Life of this patent

Estimating the term…

Loading patent…

Abstract

A security system scans application programming interfaces (APIs) to detect security vulnerabilities by receiving API documentation from a third-party system associated with the API and organizing it in an API specification that describes the hostname of the API and one or more endpoints of the API. For each of the endpoints, the API specification includes a uniform resource identifier, a method term, an input content type, an output content type (if applicable), authorization details, and any associated parameters or arguments. The security system performs an audit job for each combination of endpoints, potential security vulnerabilities, and (in some embodiments) authentication flows. In some embodiments, the security system is able to access portions of the API requiring authentication by using authentication flows received from the third-party system and detect security vulnerabilities related to authentication by manipulating the authentication units that make up the authentication flow.

Claims18

Dependent claims

A method performed by a computer system for automating detection of security vulnerabilities of an application programming interface (API), the method comprising:

receiving information about an API of a third-party system;
receiving one or more authentication flows for the API;
generating an API specification based on the received information, the API specification describing one or more API endpoints of the API, wherein a description of an API endpoint comprises a specified addressable location that provides access to one or more of services associated with the API, a method term that indicates a type of interaction with the API endpoint, and a set of input parameters that indicates the data types accepted as input by the API endpoint;
for each of the one or more API endpoints described in the API specification:
for each of the one or more authentication flows for the API:
determining, based on information about the authentication flow and the API endpoint in the API specification, one or more potential security vulnerabilities of the API endpoint;
for each of the determined one or more potential security vulnerabilities of the API endpoint, performing a first audit job on the API endpoint to determine an indication of whether the API endpoint is vulnerable to the potential security vulnerability and performing a second audit job on the authentication flow to determine an indication of whether the authentication flow is vulnerable to the potential security vulnerability, wherein performing the second audit job includes modifying the authentication flow based on the potential security vulnerability by removing one or more authentication units and testing the modified authentication flow against the potential security vulnerability by receiving an unauthenticated request;
and
recording results of the first audit job and the second audit jobs performed;
generating a scan report for the API based on the recorded results;
and
sending the scan report to the third-party system.

9 more elements

A non-transitory computer-readable medium comprising instructions that when executed by a processor cause the processor to perform steps for automating detection of security vulnerabilities of an application programming interface (API), the steps comprising:

receiving information about an API of a third-party system;
receiving one or more one authentication flows for the API;
generating an API specification based on the received information, the API specification describing one or more API endpoints of the API, wherein a description of an API endpoint comprises a specified addressable location that provides access to one or more of services associated with the API, a method term that indicates a type of interaction with the API endpoint, and a set of input parameters that indicates the data types accepted as input by the API endpoint;
for each of the one or more API endpoints described in the API specification:
for each of the one or more authentication flows for the API:
determining, based on information about the authentication flow and the API endpoint in the API specification, one or more potential security vulnerabilities of the API endpoint;
for each of the determined one or more potential security vulnerabilities of the API endpoint, performing a first audit job on the API endpoint to determine an indication of whether the API endpoint is vulnerable to the potential security vulnerability and performing a second audit job on the authentication flow to determine an indication of whether the authentication flow is vulnerable to the potential security vulnerability, wherein performing the second audit job includes modifying the authentication flow based on the potential security vulnerability by removing one or more authentication units and testing the modified authentication flow against the potential security vulnerability by receiving an unauthenticated request;
and
recording results of the first and the second audit jobs performed;
generating a scan report for the API based on the recorded results;
and
sending the scan report to the third-party system.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/447,108Filed 1 Mar 2017
Published: US 2018/0255089 A16 Sep 2018
Granted: 31 Aug 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/1433
For detecting or protecting against malicious traffic: vulnerability analysis
H04L 63/0281
For separating internal from external traffic, e.g. firewalls: proxies
H04L 63/083
For authentication of entities: using passwords
H04L 63/0884
For authentication of entities: by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity…