Reversible Source Code Obfuscation to Block Vulnerable Asset Deployment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Legacy software assets with known security vulnerabilities can reintroduce these vulnerabilities when brought back into use, as existing methodologies fail to effectively mark or prevent their deployment in new software builds.
Innovation Solution
A system and method that modifies the source code of software assets to create a modified artifact, which is unusable for building, by using a security scanner and encoder to detect vulnerabilities and apply reversible obfuscation techniques such as Base64 encoding or encryption, ensuring that only whitelisted portions are exempt from modification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vulnerability scanning is performed on legacy software assets, then security vulnerabilities can be detected, but the assets remain usable and can be reintroduced into active software builds
Solution Approach 1:
The system applies preliminary anti-action by automatically modifying detected vulnerable assets before they can be reintroduced into active software builds. The encoder reversibly modifies the source code of vulnerable assets to make them unusable for building, thereby preventing their harmful reintroduction while maintaining detection capability
Solution Approach 2:
The system introduces an intermediary mechanism between vulnerability detection and software deployment. The encoder acts as a mediator that receives vulnerable assets from the scanner and transforms them into modified, unusable versions before they can affect the software supply chain, thereby blocking the harmful path
2Object-generated harmful factors
If software assets are modified to prevent vulnerability deployment, then vulnerable assets cannot be deployed, but the modification process adds complexity to the software supply chain
Solution Approach 1:
The system implements self-service by enabling automated detection and modification of vulnerable assets within the existing CI/CD pipeline. The scanner and encoder work autonomously to identify and block vulnerable assets without requiring manual intervention, thereby preventing deployment while minimizing operational complexity
Solution Approach 2:
The system changes the state of vulnerable assets by applying reversible modifications (encoding/decoding transformations) that alter their usability parameters. These parameter changes make the assets unusable for building while allowing the modifications to be reversed if needed, thereby preventing deployment without creating irreversible complexity
Data Source
AI summary
Systems and methods for preventing vulnerable software assets from being deployed by modifying the underlying source code in such a way that a build of the software asset will fail. In one aspect of the present disclosure, a system for securing software artifacts in a repository comprises a repository interface communicably coupleable to a software repository to retrieve an original artifact usable for building a software asset, and to replace the original artifact in the software repository with a modified artifact. A security scanner is configured to initiate a security scan of the original artifact and produce an output indicating the presence of a security vulnerability in the original artifact. An encoder is configured to reversibly modify the original artifact to produce the modified artifact, the modified artifact unusable for building the software asset.