Executable Section Hashing for Accurate SBOM Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software development and deployment systems face challenges in accurately matching deployed portable and linkable executable files with their source files, especially when transformations such as digital signing, re-versioning, or metadata changes occur, leading to inaccuracies in software bill of materials (SBOM) generation.
Innovation Solution
A method involving a mapping database that calculates hash values for a predefined subset of sections of executable files, including essential segments like code and data segments, and stores these values with file identifiers, enabling accurate matching and generating a more precise SBOM by associating deployed files with their source packages, even when non-functional changes occur.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If hash values are calculated for all sections of executable files, then matching accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The patent divides the executable file into multiple sections (e.g., code section, data section, resource section, debug section) and calculates hash values only for specific essential sections rather than the entire file. This segmentation allows the system to focus computational effort on the most critical parts of the file that determine functionality, thereby maintaining matching accuracy while reducing processing time and resource consumption.
2Reliability
If transformations such as digital signing and metadata changes are applied to executable files, then security and functionality are improved, but file integrity matching becomes more difficult
Solution Approach 1:
The patent extracts and excludes specific sections from hash calculation that are subject to non-functional transformations such as digital signatures, version information, and metadata. By removing these transformable sections from the integrity check, the system can accurately match executable files even after they have undergone security-related transformations, maintaining both security requirements and matching accuracy.
Solution Approach 2:
The patent applies different quality requirements to different sections of the executable file. Essential sections like code and data segments require strict integrity matching, while non-essential sections like resources and debug information allow for transformations. This local quality approach enables the system to maintain high matching accuracy for critical functionality while accommodating necessary security transformations.
3Loss of information
If a comprehensive mapping database is created for all executable files, then traceability is improved, but storage requirements and system complexity increase
Solution Approach 1:
The patent creates an asymmetric mapping relationship where the mapping database stores only essential identification information (such as hash values of critical sections) rather than complete file copies or extensive metadata. This asymmetric approach provides sufficient traceability to track executable files through the deployment process while keeping the database size manageable and system complexity reduced.
Data Source
AI summary
A computer-implemented method is provided for use with a package repository including software packages that include source portable and linkable executable files. The method includes populating a mapping database by, for each of a plurality of the source portable and linkable executable files having a file format: calculating a hash value of a pre-defined subset of sections of the source portable and linkable executable file, the pre-defined subset defined for the file format and including fewer than all of the sections specified by the file format; and storing, in the mapping database, the calculated hash value in association with (a) an identifier of the source portable and linkable executable file and (b) an identifier of the software package of the source portable and linkable executable file. Other embodiments are also described.