US 12,111,957 B2 · Software provenance validation

Abstract

Software provenance validation reports whether a validation binary matches the source code, resources, and other parts, as well as the compiler, runtime, operating system, and other context, which is specified in a provenance manifest for a release binary. Part context checksums, software versions, tool parameters, and other aspects of a build are checked. Certification signatures, timestamps, certain version differences, source code locations, and other data may be ignored for validation purposes. A provenance manifest may include other provenance manifests, including binary rewrite manifests. The provenance manifest may be stored in a debugger file with symbol information, or stored separately. Partial matches may be reported, with details of what matches or does not match. After provenance of a binary is validated, the binary's source code can be analyzed for vulnerabilities, thereby enhancing software supply chain security.

Claims20

Dependent claims

A computing system equipped for software provenance validation, the computing system comprising:

a digital memory;
and
a processor in operable communication with the digital memory, the processor configured to perform software provenance validation steps which include (a) acquiring a provenance manifest and getting a candidate binary, (b) obtaining at least one candidate item, (c) attempting to build a validation binary based on the provenance manifest and the at least one candidate item, (d) when the attempting yields a success in building the validation binary, comparing the validation binary to the candidate binary, and producing a provenance attestation according to a result of comparing the binaries, (e) when the attempting yields a failure to build the validation binary, producing the provenance attestation according the failure, wherein the attempting yields the failure at least partially in response to finding an indication of at least one of the following:
use of a non-deterministic compiler, use of a local storage to store a program part, storage of a program part outside of any publicly accessible location, or storage of a program part outside of any internet-accessible repository.

1 more element

A computer-readable storage device configured with data and instructions which upon execution by a processor cause a computing system to perform a method for software provenance validation, the method comprising:

acquiring a digital provenance manifest;
getting a candidate binary;
obtaining at least one digital candidate item, wherein obtaining at least one digital candidate item comprises reading from the digital provenance manifest a location of the digital candidate item, and fetching the digital candidate item from the location;
attempting to computationally build a validation binary based on the provenance manifest and the at least one candidate item, the attempting yielding either a success or a failure;
when the attempting yields a success in building the validation binary, computationally comparing the validation binary to the candidate binary, and producing a digital provenance attestation according to a result of comparing the binaries;
and
when the attempting yields a failure to build the validation binary, producing the digital provenance attestation according the failure.

4 more elements

Dependencies are inferred from the claim text.

Software provenance validation

Life of this patent

Software provenance validation

Life of this patent

Abstract

Claims20