Signed SBOM Verification for Secure Software Package Passage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud customers desire to deploy software packages without interference from cloud providers or other customers, while ensuring adherence to security standards and maintaining confidentiality of their source code, which is challenging due to mutual distrust and the need for software assurance.
Innovation Solution
A system that generates a signed Software Bill of Materials (SBOM) for a software package, allowing its verification to ensure the package has not been modified, and only approved packages are allowed to pass through a gateway tenancy for deployment, ensuring integrity and adherence to security standards.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud provider monitors and scans software packages for security assurance, then security compliance is improved, but cloud customer autonomy and deployment speed deteriorate
Solution Approach 1:
The system performs security analysis, SBOM generation, and digital signing of software packages before they are deployed to the cloud. The verification service checks the digital signature and SBOM integrity in advance, ensuring security compliance is established prior to deployment rather than during runtime monitoring.
Solution Approach 2:
A verification service acts as an intermediary between the cloud customer and cloud provider. This service validates software packages using SBOM and digital signatures, enabling trustless verification that maintains customer autonomy while ensuring security compliance without requiring continuous cloud provider intervention.
2Difficulty of detecting and measuring
If cloud provider scans and analyzes source code for security vulnerabilities, then security detection capability is improved, but source code confidentiality deteriorates
Solution Approach 1:
The system segments the security verification process into separate components: SBOM generation, digital signing, and verification. The verification service only needs to check the SBOM and signature against the deployed package, not analyze the complete source code, thus maintaining confidentiality while detecting security issues through the segmented verification process.
Solution Approach 2:
Instead of requiring access to original source code for verification, the system uses a Software Bill of Materials (SBOM) as a copy or representation of the package contents. The SBOM contains component information that can be verified without exposing the actual source code, enabling security detection while preserving confidentiality.
3Reliability
If software packages are verified and approved before deployment, then software integrity is improved, but deployment time increases
Solution Approach 1:
The system performs time-consuming security analysis, SBOM generation, and digital signing operations before deployment. The verification service then quickly validates the pre-computed signature and SBOM, reducing actual deployment time while maintaining integrity verification through preliminary processing.
Data Source
AI summary
Techniques for selective passage of software packages to a deployment tenancy, based on a signed software bill of materials (SBOM), are described. A SBOM, which is generated for a first software package, is received, wherein the first software package is built from a source code. An analysis is performed on (i) the SBOM, (ii) at least first one or more sections of the source code, and/or (iii) an intermediate representation of at least second one or more sections of the source code. Responsive on passing the analysis, the SBOM is digitally signed to generate a signed SBOM. A second software package is received. A verification is performed as to whether the signed SBOM corresponds to the second software package. Responsive at least in part on a verification that the signed SBOM corresponds to the second software package, passage of the second software package to a deployment tenancy is allowed.