Software Component Risk Control via Automated Policy Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing reliance on open source software components in software development poses challenges due to limited visibility and understanding of their quality, with existing tools making it easy to use but difficult to assess potential issues, leading to risks such as security vulnerabilities and licensing concerns.
Innovation Solution
A system that includes a processor configured to evaluate software components against predefined repository and application policies, determining risks such as security vulnerabilities and licensing, and taking pre-defined actions to either allow or block their inclusion in a software repository, with features like quarantine storage and deep inspection to manage potentially unacceptable components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If developers use open source software components extensively, then software development productivity increases, but software quality and security reliability deteriorate due to lack of visibility and understanding
Solution Approach 1:
The system implements automated feedback loops by continuously analyzing software components against predefined policies, detecting risks, and providing immediate alerts to developers. This feedback mechanism maintains productivity while improving quality through automated quality assurance and risk detection.
Solution Approach 2:
The patent introduces an intermediary system (software analysis tool) that sits between developers and open source components. This intermediary automatically analyzes components for security risks, licensing issues, and quality problems, enabling developers to use open source software productively without directly assessing quality themselves.
2Reliability
If developers manually review open source components for quality, then software reliability improves, but development time and complexity increase
Solution Approach 1:
The system enables self-service quality assessment where software components automatically analyze themselves against predefined policies. The components are evaluated for security risks, licensing compliance, and quality issues without requiring manual developer intervention, thus maintaining reliability while preserving development speed.
Solution Approach 2:
The patent implements preliminary action by pre-defining quality policies and risk criteria before software components are introduced. The automated system evaluates components against these predetermined standards in advance, preventing quality issues before they reach production rather than requiring time-consuming manual reviews afterward.
3Reliability
If comprehensive risk evaluation is performed on all software components, then software security improves, but system complexity and processing time increase
Solution Approach 1:
The system applies local quality by evaluating different aspects of software components (security, licensing, quality) separately using specialized analysis methods for each. This modular approach improves security through comprehensive evaluation while managing complexity by organizing analysis into distinct, manageable domains with targeted evaluation criteria.
Solution Approach 2:
The patent segments the risk evaluation process into distinct analysis modules: security risk detection, licensing compliance verification, and quality assessment. Each module handles specific aspects independently, improving overall security through thorough evaluation while reducing system complexity through modular design and specialized processing for each risk category.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer system, method, or computer-readable medium controls a potentially unacceptable software component (215, 231) intended for a software repository (227). A pre-defined application or repository policy (223, 225 A, 225B) associated with the repository or application pre-defines risks (217, 219) and, for each of the risks, an action to take for the risk. The action can be a pass action or a does-not-pass action, which are pre-defined programmatic steps also defined in the policy. When the component (215) is not new to the repository (227) or the application, the component is passed through for the usual handling. When the component (231) is new, risks are determined that match the software component (231); for risks which match, the actions are taken as defined in the pre-defined policy (223, 225A, 225B). The pass action can include adding the software component (231) to the software repository (227). The does-not-pass action is followed for a component that does not pass as a potentially unacceptable software component.