# US 12,182,230 B2 · Dynamic decision engine for software authority to operate > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,230 B2 - Document ID: US12182230B2 - Status: Granted - Kind: B2 - Application number: 17/862,140 - Filed: 2022-07-11 - Published: 2024-01-11 - Granted: 2024-12-31 - Earliest claimed: 2022-07-11 - Assignees: The Boeing Company - Applicants: The Boeing Company - Inventors: Michael L. Heim; Christopher Breeden; Hong Chuen Terence Ho - Web page: https://patentgrep.com/patent/US12182230B2 ## CPC - G06F 21/121: {Restricting unauthorised execution of programs} - G06F 8/65: Updates (security arrangements therefor G06F21/57) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system for, and method of, authorizing usage of software developed in an application management platform are disclosed. The techniques include obtaining, from the application management platform, risk qualification parameters for the software; determining a risk qualification value from the risk qualification parameters; obtaining risk threshold parameters; determining a risk threshold value from the risk threshold parameters; comparing the risk qualification value to the risk threshold value to obtain an acceptability state for usage of the software; and performing an authority to operate action based on the acceptability state, where the authority to operate action includes at least one of: authorizing release of the software upon a positive acceptability state, or instructing the application management platform to send an alert upon a negative acceptability state. ## Claims ### Claim 1 An automated computer-implemented method of authorizing usage of software developed in an application management platform, the method comprising: obtaining, from the application management platform, risk qualification parameters for the software, wherein the application management platform comprises a computing environment that manages the development of a software product, wherein the application management platform allows a user to access and develop software on any of a plurality of virtual machines, wherein the risk quantification parameters comprise design time risk parameters obtained at a software security architecture/planning phase, and wherein the risk quantification parameters comprise build time risk parameters obtained at a continuous deployment pipeline phase; determining a risk qualification value from the risk qualification parameters; obtaining risk threshold parameters; determining a risk threshold value from the risk threshold parameters; comparing the risk qualification value to the risk threshold value to obtain an acceptability state for usage of the software; and performing an authority to operate action based on the acceptability state, wherein the authority to operate action comprises at least one of: authorizing release of the software upon a positive acceptability state, or instructing the application management platform to send an alert upon a negative acceptability state. ### Claim 2 (depends on 1) The automated computer-implemented method of claim 1, wherein the authority to operate action comprises authorizing release of the software, the method further comprising: automatically deploying the software. ### Claim 3 (depends on 1) The automated computer-implemented method of claim 1, wherein the design time risk parameters comprise at least two of: a software security risk security parameter, an application threat model parameter, or a business criticality assessment parameter. ### Claim 4 (depends on 1) The automated computer-implemented method of claim 1, wherein the build time risk parameters comprise at least two of: a secrets detection parameter, a static application security testing parameter, a dynamic application security testing parameter, a container vulnerability assessment parameter, a software bill of materials parameter, a software composition analysis parameter, an interactive application security testing parameter, an infrastructure as code scanning parameter, a policy as code parameter, or a code signing parameter. ### Claim 5 (depends on 1) The automated computer-implemented method of claim 1, wherein the risk threshold parameters comprise runtime risk parameters. ### Claim 6 (depends on 5) The automated computer-implemented method of claim 5, wherein the runtime risk parameters comprise at least one of: a runtime application security protection parameter or an application security telemetry parameter. ### Claim 7 (depends on 1) The automated computer-implemented method of claim 1, wherein the risk threshold parameters comprise real time risk and threat parameters. ### Claim 8 (depends on 7) The automated computer-implemented method of claim 7, wherein the real time risk and threat parameters comprise at least one of: a code risk analysis parameter or a threat intel parameter. ### Claim 9 A computer system for authorizing usage of software developed in an application management platform, the computer system comprising an electronic processor and a persistent non-transitory computer-readable medium comprising instructions that, when executed by the electronic processor, configure the electronic processor to perform actions comprising: obtaining, from the application management platform, risk qualification parameters for the software, wherein the application management platform comprises a computing environment that manages the development of a software product, wherein the application management platform allows a user to access and develop software on any of a plurality of virtual machines, wherein the risk quantification parameters comprise design time risk parameters obtained at a software security architecture/planning phase, and wherein the risk quantification parameters comprise build time risk parameters obtained at a continuous deployment pipeline phase; determining a risk qualification value from the risk qualification parameters; determining a risk qualification value from the risk qualification parameters; obtaining risk threshold parameters; determining a risk threshold value from the risk threshold parameters; comparing the risk qualification value to the risk threshold value to obtain an acceptability state for usage of the software; and performing an authority to operate action based on the acceptability state, wherein the authority to operate action comprises at least one of: authorizing release of the software upon a positive acceptability state, or instructing the application management platform to send an alert upon a negative acceptability state. ### Claim 10 (depends on 9) The computer system of claim 9, wherein the authority to operate action comprises authorizing release of the software, the method further comprising: automatically deploying the software. ### Claim 11 (depends on 9) The computer system of claim 9, wherein the design time risk parameters comprise at least two of: a software security risk security parameter, an application threat model parameter, or a business criticality assessment parameter. ### Claim 12 (depends on 9) The computer system of claim 9, wherein the build time risk parameters comprise at least two of: a secrets detection parameter, a static application security testing parameter, a dynamic application security testing parameter, a container vulnerability assessment parameter, a software bill of materials parameter, a software composition analysis parameter, an interactive application security testing parameter, an infrastructure as code scanning parameter, a policy as code parameter, or a code signing parameter. ### Claim 13 (depends on 9) The computer system of claim 9, wherein the risk threshold parameters comprise runtime risk parameters. ### Claim 14 (depends on 13) The computer system of claim 13, wherein the runtime risk parameters comprise at least one of: a runtime application security protection parameter or an application security telemetry parameter. ### Claim 15 (depends on 9) The computer system of claim 9, wherein the risk threshold parameters comprise real time risk and threat parameters. ### Claim 16 (depends on 15) The computer system of claim 15, wherein the real time risk and threat parameters comprise at least one of: a code risk analysis parameter or a threat intel parameter.