SBOM-Based Access Control for Cloud-Native Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern software applications built with reusable components are susceptible to security threats due to their widespread accessibility, and cloud-native architectures increase the attack surface, leading to potential catastrophic security breaches.
Innovation Solution
A service provider platform implements dynamic service extensions by identifying vulnerable components and inserting additional services into data flows to mitigate threats, using a software bill of materials (SBOM) to determine vulnerabilities and reroute data through secure pods or sidecar containers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cloud-native architectures are adopted to enable rapid application development with flexibility and scale, then application development efficiency is improved, but the attack surface is massively increased exposing applications to new vulnerabilities and threats
Solution Approach 1:
The patent introduces a service mesh architecture with sidecar proxies as intermediary components between applications and the network. These sidecars act as mediators that handle security concerns, traffic management, and vulnerability mitigation without requiring changes to the application code itself, thus maintaining development efficiency while reducing the attack surface through standardized security enforcement points.
Solution Approach 2:
The patent segments the application infrastructure by introducing service mesh as a separate layer that sits between applications and the network. This segmentation isolates security concerns from application logic, allowing security policies to be enforced independently at the network boundary while applications continue to develop and operate independently, thus maintaining productivity while managing security risks.
2Productivity
If reusable components and open-source code are used to build software applications, then application development speed is improved, but security vulnerabilities increase due to widespread accessibility of these components
Solution Approach 1:
The patent implements preliminary security actions by maintaining a software bill of materials (SBOM) that pre-identifies vulnerable components in the application stack. Security policies are pre-configured based on known vulnerabilities in open-source components, allowing the system to proactively block or mitigate attacks on vulnerable components before they can be exploited, thus maintaining the use of reusable components while improving security reliability.
3Loss of time
If dynamic service extensions are implemented to quickly mitigate newly detected threats, then security response time is improved, but system complexity increases due to additional services inserted into data flows
Solution Approach 1:
The patent implements universal sidecar proxies that can handle multiple security functions through a single standardized interface. The same sidecar infrastructure can dynamically insert different security services (WAF, rate limiting, authentication) based on the detected threat, providing multi-functional security enforcement without requiring separate complex systems for each security concern, thus reducing overall system complexity while improving response time.
Data Source
AI summary
Techniques are described herein for managing access to remotely accessed software applications. In embodiments, such techniques may be performed by a service provider platform for software applications capable of being accessed by computing devices. The techniques may involve determining (e.g., based on a software bill of materials) components associated with the software applications, identifying a number of current security threats, and determining, based on the components and current security threats, a risk score associated with each of the software applications. The service provider platform may receive an indication of a level of risk for each of the computing devices in the organization, generate, based on the risk score associated with the software applications and the level of risk for each of the computing devices, policy data for each of the computing devices, and provide the policy data to at least one second computing device.