Methods for managing software supply chain risk through declared intent
OwnerLouis A. Steinberginventor
Life of this patent
Estimating the term…
Abstract
Methods and systems are defined for identifying unacceptable actions by a software package from a created list of operational behaviors determined from the software package. The unacceptable actions may result in the automatic alerting on or preventing the execution or deployment of the software package. A method for identifying and mitigating at least one of a resiliency risk and/or a performance issue of a software package is disclosed.
Claims15
A method for at least one of (i) automatic alerting on and (ii) preventing execution or deployment of a software package, the method comprising:
- scanning, using at least one of (i) a static scanner and (ii) manually scanning, the software package to create a first list of high-risk operational behaviors identified in the software package, wherein the software package includes at least one of (i) developed software and (ii) a third-party software component;
- determining if a revision of at least one of (i) the software package and (ii) a configuration of the software package is required to alter at least one of the operational behaviors from the first list of high-risk operational behaviors;
- storing a second list of high-risk operational behaviors that is a subset of the first list of high-risk operational behaviors that do not require a revision of at least one of (i) the software package and (ii) a configuration of the software package;
- installing the software package onto at least one computer system;
- receiving the second list of high-risk operational behaviors;
- determining, using a dynamic scanner at runtime, a third list of high-risk operational behaviors of the software package;
- creating a fourth list of high-risk operational behaviors as a subset of the third list of high-risk operational behaviors that are not included in the second list of high-risk operational behaviors;
- and
- determining, based on the fourth list of high-risk operational behaviors, whether to perform at least one of (i) alerting a user and (ii) altering the execution of the software package.
A method, executed by a system comprised of at least one computer, for identifying and mitigating at least one of (i) a resiliency risk and (ii) a performance issue of a software package, the method comprising:
- scanning the software package to create a first list of resiliency and performance operational behaviors identified in the software package, wherein the first list of resiliency and performance operational behaviors establishes a list of required system dependencies and resources, wherein the software package is comprised of at least one of (i) developed software and (ii) a third-party software component, wherein the scanning includes at least one of (i) scanning using a static scanner and (ii) manually scanning the software package;
- indicating the list of required system dependencies and resources on at least one of (i) a display device and (ii) adding the list to a repository;
- creating, using a dynamic scanner at runtime, a second list of resiliency and performance operational behaviors of the software package;
- identifying a third list of resiliency and performance operational behaviors that are present in second list of resiliency and performance operational behaviors that are not present in the first list of resiliency and performance operational behaviors;
- and
- determining, based on the third list of resiliency and performance operational behaviors, whether to perform at least one of (i) securing additional system dependencies or resources for proper execution of the software package, (ii) revising the software package to alter the operational behavior of the software package and (iii) revising a configuration of the software package.
Dependencies are inferred from the claim text.