SBOM Handshake for Serverless Code Execution Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In serverless computing, developers lack assurance that the underlying infrastructure executes the most recent or secure code, due to the lack of knowledge about the underlying infrastructure.
Innovation Solution
Implementing a software bill of materials (SBOM)-based handshake process, where a client requests and analyzes the SBOM of a computing service to ensure it meets security and compatibility criteria before executing code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If serverless computing is used to provide backend services on demand, then ease of operation and productivity are improved, but reliability and security are worsened due to lack of visibility into underlying infrastructure
Solution Approach 1:
The patent introduces a software bill of materials (SBOM) as an intermediary artifact that mediates between the client and the serverless infrastructure. The SBOM provides a structured representation of the software components, versions, and dependencies running on the serverless platform, enabling clients to verify security and reliability without directly interacting with or needing knowledge of the underlying infrastructure. This intermediary allows clients to make informed decisions about code execution while maintaining the abstraction benefits of serverless computing.
2Ease of operation
If serverless computing abstracts away infrastructure details, then ease of operation is improved, but measurement precision and detection capability are worsened
Solution Approach 1:
The patent segments the serverless infrastructure information into a structured software bill of materials that breaks down the complex infrastructure into discrete, analyzable components. The SBOM divides the software stack into specific components, versions, and dependencies, making it possible for clients to precisely measure and detect the security posture and configuration details without needing to understand the overall infrastructure complexity. This segmentation enables precise measurement of software attributes while maintaining infrastructure abstraction.
Data Source
AI summary
A method, computer system, and computer program product are provided for cloud-based code execution. A computing service receives a request from a client to provide to the client a software bill of materials corresponding to the computing service. The software bill of materials is provided to the client. Executable code is received from the client, wherein the client provides the executable code based on the client analyzing the software bill of materials. In response to receiving an execution instruction, the computing service executes the executable code.