Secure application development using distributed ledgers
AssigneeAmerican Express Travel Related Services Company, Inc.
InventorsHiranmayi Palanki, Upendra Sharadchandra Mardikar
Life of this patent
Estimating the term…
Abstract
Disclosed are various embodiments for using distributed ledgers to assist in securely developing applications. An application component comprising a component file can be received from a validation client. It can then be determined that the application component complies with a security policy. In response to a determination that the application component complies with the security policy, an endorsed application component record can be generated that comprises the component file or a network address at which the component file is obtainable and a signature for the component file generated with an asymmetric key-pair stored in the memory. The endorsed application component record can then be stored in the distributed ledger.
Claims20
A system, comprising:
- a computing device comprising a hardware processor and a memory;
- a distributed ledger stored in the memory, wherein the distributed ledger represents a data store that is replicated across computing nodes in a peer-to-peer network;
- and
- machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
- receive a software application component comprising a software component file;
- determine that the software component file complies with a security policy for inclusion of software files in the software application component evaluating a degree or type of security risk that usage of the software component file can introduce to the software application component;
- in response to a determination that the software component file complies with the security policy, generate an endorsed application component record comprising a network address at which the software component file is obtainable, a use indicator that indicates a permissible use of the software component file, a distributor identifier for the software component file, and a signature for the software component file generated with an asymmetric key-pair stored in the memory;
- and
- store the endorsed application component record in the distributed ledger.
A method, comprising:
- receiving a request to access a source-code component file;
- determining that an endorsed application component record for the source-code component file is located in a distributed ledger, wherein the distributed ledger represents a data store that is replicated across computing nodes in a peer-to-peer network and the endorsed application component record verifies that the source-code component file complies with a security policy for inclusion of software files in a software application component by evaluating a degree or type of security risk that usage of the source-code component file can introduce to the software application component, wherein the endorsed application component record comprises a network address at which the source-code component file is obtainable, a list of approved uses of the source-code component file, and a distributor identifier for the source-code component file;
- and
- sending a response indicating that access to the source-code component file is approved in response to determining that the endorsed application component record is located in the distributed ledger.
A system, comprising
- a computing device comprising a hardware processor and a memory;
- and
- machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
- identify a software component file to include in a software application;
- send, to a validation computing device, a request to include the software component file in the software application to a validation client, wherein the request comprises an identifier for the software component file;
- and
- receive, from the validation computing device, an endorsed response that includes an endorsed application component file retrieved from a distributed ledger that verifies that the software component file complies with a security policy for inclusion of the software component file in the software application by evaluating a degree or type of security risk that usage of the software component file can introduce to the software application, wherein the endorsed application component file comprises a network address from which the software component file can be obtained, a use indicator that indicates a permissible use of the software component file, and a distributor identifier for the software component file.
Dependencies are inferred from the claim text.