Dynamic Security Service Extension Using SBOM Data Flows
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-native architectures increase the attack surface and expose applications to new vulnerabilities, making them susceptible to security threats, which conventional systems struggle to mitigate effectively.
Innovation Solution
Implementing a service provider platform that uses a software bill of materials (SBOM) to identify vulnerable components and dynamically insert additional security services into data flows through new pods or sidecar containers to mitigate threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cloud-native architectures are adopted to enable rapid application development with flexibility and scale, then application development efficiency is improved, but the attack surface increases and applications become more exposed to vulnerabilities and threats
Solution Approach 1:
The patent introduces a service mesh architecture with sidecar proxies as intermediaries between applications and the network. These sidecar proxies intercept, inspect, and control all traffic flows, acting as a mediator that enables security operations without requiring changes to the underlying cloud-native applications. The sidecar proxies monitor data flows, detect vulnerabilities using SBOM information, and dynamically insert security services to mitigate threats while preserving the flexibility and scalability of cloud-native architectures.
2Ease of operation
If conventional security systems are used to protect cloud-native applications, then implementation simplicity is maintained, but effectiveness in mitigating new vulnerabilities is insufficient
Solution Approach 1:
The patent implements a dynamic security service insertion mechanism that automatically adapts to detected threats. When a vulnerability is detected through SBOM analysis, the system dynamically inserts appropriate security services (such as authentication, encryption, or filtering) into the data flow without requiring manual reconfiguration. This dynamic approach maintains ease of operation while significantly improving security effectiveness by responding automatically to new vulnerabilities and threats.
3Reliability
If security services are inserted into data flows to mitigate vulnerabilities, then security protection is improved, but system complexity increases
Solution Approach 1:
The patent segments security functions into independent, modular security services that can be individually inserted and managed within the service mesh. Each security service operates as a separate microservice that handles specific security tasks (authentication, authorization, encryption, etc.). This segmentation allows the system to implement comprehensive security protection while maintaining manageable complexity through modular, independently deployable security components.
4Speed
If dynamic service insertion is implemented to quickly mitigate newly-detected threats, then response speed is improved, but impact on end users may increase
Solution Approach 1:
The patent implements security services with local quality by inserting them only at specific points in the data flow where vulnerabilities are detected, rather than applying security measures globally across all traffic. The sidecar proxies intelligently determine where security services are needed based on SBOM analysis and threat detection, inserting security functionality only where necessary. This approach enables rapid threat response while minimizing impact on end users by avoiding unnecessary security interventions in unaffected data flows.
Data Source
AI summary
Techniques are described herein for dynamic service extension to provide risk mitigation upon detecting a threat. In embodiments, such techniques may be performed by a service provider platform and may comprise receiving information about a security threat, identifying one or more components susceptible to the security threat, determining, based on a software bill of materials, at least one data flow that includes a point of delivery (pod) associated with the one or more components, identifying at least one additional service determined to mitigate the security threat, and implementing the at least one additional service in relation to the at least one data flow.