Remote SBOM Attestation for Cross-Device Vulnerability Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing Software Bill of Materials (SBOM) systems are limited in scope and lack end-to-end awareness across technology stacks, failing to detect vulnerabilities that arise from combinations of software configurations across multiple devices.

Innovation Solution

Implementing a system where network devices generate and self-attest SBOMs using manufacturer certificates, which are then compiled and analyzed by a centralized server to identify vulnerabilities across the technology stack, utilizing machine learning to correlate and remediate vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If SBOMs are generated and analyzed across multiple devices to detect combination vulnerabilities, then vulnerability detection capability is improved, but system complexity increases

Engineering Contradiction:

Improvevulnerability detection capabilityVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system segments the vulnerability detection process into independent SBOM generation modules for each device, which self-attest their own software configurations. This allows comprehensive multi-device vulnerability detection while maintaining manageable complexity through modular, distributed SBOM generation rather than centralized analysis of all devices simultaneously.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A centralized server acts as an intermediary that receives, compiles, and analyzes SBOMs from multiple devices. This intermediary coordinates the complex task of cross-device vulnerability detection by standardizing SBOM formats and managing the correlation process, thereby improving detection capability without proportionally increasing overall system complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If self-attestation is implemented using manufacturer certificates, then SBOM reliability is improved, but computational overhead increases

Engineering Contradiction:

ImproveSBOM reliabilityVSAvoidcomputational overhead

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

Manufacturer certificates are pre-established and configured in devices before SBOM generation. This preliminary setup of trust relationships enables rapid self-attestation during SBOM generation without requiring complex real-time verification computations, thereby improving SBOM reliability while minimizing computational overhead during operation.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20260046301A1Provable remote attestation of computing assets using sboms

Publication Date: 2026.02.12 CISCO TECHNOLOGY INC

AI summary

A method, computer system, and computer program product are provided for generating and analyzing remotely attested SBOMs. Instructions are provided to cause a plurality of network devices in a network to each generate a software bill of materials (SBOM), wherein each network device self-attests the SBOM that describes that network device. The SBOM is obtained from each of the plurality of network devices. Each SBOM is analyzed to identify a particular software configuration in the network. A vulnerability is identified in the network based on the particular software configuration.