Binary Dependency Mapping for OSS License Compliance

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Managing open-source software (OSS) in software development is challenging due to licensing complexities, security vulnerabilities, and the difficulty in identifying and patching third-party library dependencies, especially when using different OSS licenses that may introduce intellectual property conflicts and security risks.

Innovation Solution

A method to identify and map OSS licenses by examining binary files for dynamic and static libraries, using tools like DT_NEEDED tags and ABI symbols, to create an OSS manifest that tracks transitive and recursive dependencies, and generates a visual map of relationships among libraries.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If third-party libraries are pulled in from package managers without inspection, then development speed is improved, but security vulnerabilities and licensing risks increase

Engineering Contradiction:

Improvedevelopment speedVSAvoidsecurity vulnerabilities and licensing risks

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary inspection of OSS libraries by extracting and analyzing dependency information from binary files before they are used in the application. This allows security vulnerabilities and licensing risks to be identified in advance, enabling developers to address them before deployment while maintaining efficient development workflows.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system generates feedback by extracting dependency information, mapping libraries to OSS packages, and identifying associated licenses and vulnerabilities. This feedback mechanism provides developers with comprehensive information about the OSS components used in their applications, enabling informed decisions about security and compliance without slowing down development.

Inventive Principle:

Principle #23Feedback

2Adaptability or versatility

If multiple OSS licenses are used in the same application, then functionality is improved, but license compatibility and compliance complexity increase

Engineering Contradiction:

ImprovefunctionalityVSAvoidlicense compatibility and compliance complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system acts as an intermediary by extracting dependency information from binary files, mapping libraries to their corresponding OSS packages, and identifying associated licenses. This intermediary process provides a comprehensive view of all licenses used in the application, enabling developers to manage complexity and ensure compliance without sacrificing functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system replaces manual license tracking and compatibility checking with automated extraction and analysis of dependency information from binary files. This substitution of mechanical manual processes with automated digital analysis reduces complexity and improves efficiency in managing multiple OSS licenses.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Device complexity

If transitive dependencies are not tracked, then the system is simpler to implement, but complete OSS dependency identification is lost

Engineering Contradiction:

Improvesystem implementation complexityVSAvoidcomplete OSS dependency identification

Core Design Contradiction:

Device complexityVSLoss of information

Solution Approach 1:

The system implements nested dependency tracking by extracting dependency information from binary files, then recursively examining each identified library for its own dependencies. This nested approach systematically uncovers transitive dependencies at multiple levels, providing complete OSS dependency identification while maintaining a structured and manageable implementation process.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The system performs preliminary extraction of dependency information from binary files before deeper analysis is required. This preliminary action identifies direct dependencies, which then serve as entry points for recursive analysis to uncover transitive dependencies, ensuring complete identification without requiring overly complex initial system design.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20250335332A1Identifying Open-Source Software Dependencies in Binary Files

Publication Date: 2025.10.30 DELL PROD LP

AI summary

Embodiments are directed to systems and methods for identifying open source software (OSS) required in an application. In one embodiment, a binary file associated with the application is received. The binary file is examined to identify a first library dynamically linked to the application. The first library is examined to identify a second library dynamically linked to the first library, where the second library is not identified in the binary file. The first library is mapped to a first OSS package, and the second library is mapped to a second OSS package. A first OSS license is identified in the first OSS package, and a second OSS license is identified in the second OSS package. Details related to the first OSS license and the second OSS license are extracted from the first and second OSS packages. The details are used to complete an OSS manifest.