International Business Machines Corporation

Krithika Prakash

John Clay Richard Wray

Peter James Argue

Moshe Morris Emanuel Matsa

Application programming interface (API) management is provided. The API management comprises defining a number of GraphQL policies and integrating the GraphQL policies into an API assembly, wherein the GraphQL policies number among other API policies at an API gateway. When a query is received from a client, the GraphQL policies are enforced on the query at the API gateway, and the query is modified if it does not comply with the GraphQL policies. The query is then sent to a GraphQL backend server. A response to the query is received from the GraphQL backend server, and the GraphQL policies are enforced on the response at the API gateway, and the response is modified if it does not comply with the GraphQL policies. The response is then sent to the client.

Customizable dynamic GraphQL API management platform

Information leakage prevention in a cryptographic protocol is implemented in a network device. The technique implements an error message processing strategy to mask information otherwise useful to an attacker and that has been generated (by decryption processes) as a consequence of an attacker's exploit. The technique avoids information leakage associated with a padding oracle attack. In one aspect each error message (irrespective of its content) is replaced with a generic error message so that the attacker does not obtain the specific error message content(s) that might otherwise provide useful information. In addition to masking the error message content, the technique preferably implements a 'delay' policy that delays the transmission of particular error messages (or message types) to hide (from the attacker's point-of-view) whether a particular error message is relevant to (or a consequence of) the attacker's exploit.

Avoiding padding oracle attacks

A method to prevent information leakage in a cryptographic protocol is implemented in a network device. The method implements an error message processing strategy to mask information otherwise useful to an attacker and that has been generated (by decryption processes) as a consequence of an attacker's exploit. The technique avoids information leakage associated with a padding oracle attack. In one aspect each error message (irrespective of its content) is replaced with a generic error message so that the attacker does not obtain the specific error message content(s) that might otherwise provide useful information. In addition to masking the error message content, the technique preferably implements a 'delay' policy that delays the transmission of particular error messages (or message types) to hide (from the attacker's point-of-view) whether a particular error message is relevant to (or a consequence of) the attacker's exploit.

Growing community of inventors

Regina, CA, United States of America

Krithika Prakash