Runtime protection of web services
AssigneeInternational Business Machines Corporation
InventorsOmer Tripp, Emmanuel Wurth
Life of this patent
Estimating the term…
Abstract
Protecting a runtime Web service application. A web service application is instrumented to log its operation and allow recreation of its execution trace. Trace point vulnerabilities are identified using one or more data payloads. Candidate trace point operations associated with the trace point vulnerabilities are identified. Supplementary candidate operations are computed based on the existing trace point operations and the one or more data payloads. The Web service application is further instrumented with the one or more supplementary candidate operations.
Claims20
A computer-implemented method for protecting a runtime Web service application, the method comprising:
- instrumenting, by a computer, the Web service application to log its operation and create an execution trace;
- identifying, by the computer, a trace point vulnerability using one or more data payloads and one or more security rules;
- identifying, by the computer, a first candidate trace point operation associated with the trace point vulnerability;
- computing, by the computer, a supplementary candidate operation based on the first candidate trace point operation and the trace point vulnerability;
- and
- further instrumenting, by the computer, the Web service application with the supplementary candidate operation.
A computer program product for protecting a runtime Web service application, the computer program product comprising:
- one or more computer-readable storage media and program instructions stored on the one or more computer-readable storage media, the program instructions executable by a processor to perform a method comprising:
- instrumenting the Web service application to log its operation and create an execution trace;
- identifying a trace point vulnerability using one or more data payloads and one or more security rules;
- identifying a first candidate trace point operation associated with the trace point vulnerability;
- computing a supplementary candidate operation based on the first candidate trace point operation and the trace point vulnerability;
- and
- further instrumenting the Web service application with the supplementary candidate operation.
A computer system for protecting a runtime Web service application, the computer system comprising:
- one or more computer processors, one or more computer-readable storage media, and program instructions stored on one or more of the computer-readable storage media for execution by at least one of the one or more processors to perform a method comprising:
- instrumenting the Web service application to log its operation and create an execution trace;
- identifying a trace point vulnerability using one or more data payloads and one or more security rules;
- identifying a first candidate trace point operation associated with the trace point vulnerability;
- computing a supplementary candidate operation based on the first candidate trace point operation and the trace point vulnerability;
- and
- further instrumenting the Web service application with the supplementary candidate operation.
Dependencies are inferred from the claim text.