Tested Software Bill of Materials for Runtime Component Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Software Bill-of-Materials (SBOMs) are inaccurate, leading to security breaches due to missing software components with vulnerabilities, and inconsistencies between testing and execution environments, which can result in supply chain vulnerabilities.
Innovation Solution
Implement a Tested Software Bill-of-Materials (TSBOM) that tracks and verifies software components during installation and execution, using a blockchain-based system to ensure compatibility and identify any discrepancies or vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a traditional Software Bill-of-Materials (SBOM) is used to track software components, then the SBOM can identify some vulnerabilities, but the SBOM is inaccurate and misses software components leading to security breaches
Solution Approach 1:
The patent applies preliminary action by creating and signing the Software Bill of Materials (SBOM) during the software build process before deployment. The SBOM is generated with cryptographic signatures from the build environment, establishing a trusted baseline of software components and their versions before the software is installed or executed. This pre-established authenticated SBOM enables accurate tracking and comparison later during installation and execution phases.
Solution Approach 2:
The patent implements feedback mechanisms by continuously comparing the authenticated SBOM against the actual software components present during installation and execution. The system generates alerts when discrepancies are detected between the SBOM and the actual runtime environment, providing real-time feedback about unauthorized or modified components. This feedback loop ensures continuous verification of software integrity.
2Adaptability or versatility
If the execution environment uses different component versions or third-party dependencies than the testing environment, then the software may run in production, but inconsistencies arise between the SBOM and execution environment leading to supply chain vulnerabilities
Solution Approach 1:
The patent establishes the authenticated SBOM with cryptographic signatures during the build process, creating a trusted reference before deployment. This preliminary authentication enables the system to detect any deviations from the tested configuration during installation and execution, ensuring that only authorized component versions are used even in different environments.
Solution Approach 2:
The patent introduces an intermediary verification mechanism that compares the authenticated SBOM against the actual software components during installation and execution. This intermediary layer acts as a mediator between the build environment specifications and the runtime environment, ensuring consistency and detecting supply chain attacks or unauthorized modifications.
3Reliability
If comprehensive tracking of all software components is implemented to ensure accuracy, then security is improved, but system complexity increases
Solution Approach 1:
The patent implements self-service by automating the generation, signing, and verification of the Software Bill of Materials throughout the software lifecycle. The build system automatically creates the SBOM with cryptographic signatures, and the installation/execution systems automatically verify components against the authenticated SBOM without requiring manual intervention. This automation reduces complexity while maintaining comprehensive tracking.
Solution Approach 2:
The patent transforms the SBOM from a simple list of components into a cryptographically authenticated data structure with digital signatures and version identifiers. By changing the parameter structure of the SBOM to include cryptographic verification mechanisms, the system achieves comprehensive security tracking without proportionally increasing operational complexity, as the verification process is automated.
Data Source
AI summary
A determination is made that a software application is one of being installed in an installation environment or executed in an execution environment. In response to determining that the software application is one of being installed in the installation environment or executed in the execution environment, a Tested Software Bill-of-Materials (TSBOM) of the software application is retrieved. The TSBOM of the software application is a list of tested software components that are executed during testing of the software application. A determination is made that software components in the installation environment or in the execution environment matches the list of tested software components. In response to determining that at least one of the software components in the installation environment or in the execution environment does not match the tested software components in the list of tested software components, a notification is generated.