# US 12,111,957 B2 · Software provenance validation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,111,957 B2
- Document ID: US12111957B2
- Status: Granted
- Kind: B2
- Application number: 17/342,451
- Filed: 2021-06-08
- Published: 2022-12-08
- Granted: 2024-10-08
- Earliest claimed: 2021-06-08
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Claire Novotny; Jared Parsons; Jason R. Shaver; Jobst-Immo Landwerth; Richard Steele Gibson; Tomas Matousek
- Web page: https://patentgrep.com/patent/US12111957B2

## CPC

- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06F 8/41: Compilation
- G06F 8/71: Version control (security arrangements therefor G06F21/57); Configuration management
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Software provenance validation reports whether a validation binary matches the source code, resources, and other parts, as well as the compiler, runtime, operating system, and other context, which is specified in a provenance manifest for a release binary. Part context checksums, software versions, tool parameters, and other aspects of a build are checked. Certification signatures, timestamps, certain version differences, source code locations, and other data may be ignored for validation purposes. A provenance manifest may include other provenance manifests, including binary rewrite manifests. The provenance manifest may be stored in a debugger file with symbol information, or stored separately. Partial matches may be reported, with details of what matches or does not match. After provenance of a binary is validated, the binary's source code can be analyzed for vulnerabilities, thereby enhancing software supply chain security.

## Claims

### Claim 1

A computing system equipped for software provenance validation, the computing system comprising:
a digital memory; and
a processor in operable communication with the digital memory, the processor configured to perform software provenance validation steps which include (a) acquiring a provenance manifest and getting a candidate binary, (b) obtaining at least one candidate item, (c) attempting to build a validation binary based on the provenance manifest and the at least one candidate item, (d) when the attempting yields a success in building the validation binary, comparing the validation binary to the candidate binary, and producing a provenance attestation according to a result of comparing the binaries, (e) when the attempting yields a failure to build the validation binary, producing the provenance attestation according the failure, wherein the attempting yields the failure at least partially in response to finding an indication of at least one of the following: use of a non-deterministic compiler, use of a local storage to store a program part, storage of a program part outside of any publicly accessible location, or storage of a program part outside of any internet-accessible repository.

### Claim 2 (depends on 1)

The system of claim 1, wherein the provenance manifest includes:
(a) at least one of the following kinds of program part information: a source code file name and content checksum, a library file name and content checksum, or a resource file name and content checksum;
(b) at least one of the following kinds of build tool context information: a compiler name and version, a compiler parameter, a build tool name and version, or a build tool parameter; and
(c) at least one of the following kinds of kernel context information: a runtime name and version, or an operating system name and version.

### Claim 3 (depends on 1)

The system of claim 1, wherein the provenance manifest includes at least one of the following: a copy of a second provenance manifest, or a reference to the second provenance manifest, and wherein the provenance manifest and the second provenance manifest differ from each other with respect to at least one of the following: program part information, build tool context information, or kernel context information.

### Claim 4 (depends on 1)

The system of claim 1, wherein the provenance manifest includes a rewrite provenance manifest that describes a binary rewrite operation, and the rewrite provenance manifest is secured by at least one of the following: a checksum, a digital signature, or a tamper detection mechanism.

### Claim 5 (depends on 1)

The system of claim 1, wherein the provenance manifest resides in a file which is secured by at least one of the following: a checksum, a digital signature, or a tamper detection mechanism.

### Claim 6 (depends on 1)

The system of claim 1, wherein the provenance manifest resides in a debugging file which also contains symbol information.

### Claim 7

A method for software provenance validation, the method comprising:
acquiring a digital provenance manifest, wherein the digital provenance manifest resides in a file which is secured by at least one of the following: a checksum, a digital signature, or a tamper detection mechanism;
getting a candidate binary;
obtaining at least one digital candidate item;
attempting to computationally build a validation binary based on the provenance manifest and the at least one candidate item, the attempting yielding either a success or a failure;
when the attempting yields a success in building the validation binary, computationally comparing the validation binary to the candidate binary, and producing a digital provenance attestation according to a result of comparing the binaries; and
when the attempting yields a failure to build the validation binary, producing the digital provenance attestation according the failure.

### Claim 8 (depends on 7)

The method of claim 7, wherein the attempting yields the failure in response to detecting an indication of tampering with the provenance manifest.

### Claim 9 (depends on 7)

The method of claim 7, wherein the attempting yields the failure at least partially in response to finding an indication of at least one of the following:
use of a non-deterministic compiler;
use of a local storage to store a program part;
storage of a program part outside of any publicly accessible location; or
storage of a program part outside of any internet-accessible repository.

### Claim 10 (depends on 7)

The method of claim 7, wherein the attempting yields the failure in response to determining that the digital candidate item has a content checksum that does not match the provenance manifest.

### Claim 11 (depends on 7)

The method of claim 7, wherein obtaining at least one digital candidate item comprises reading from the provenance manifest a location of the digital candidate item, and fetching the digital candidate item from the location.

### Claim 12 (depends on 7)

The method of claim 7, wherein attempting to computationally build a validation binary avoids reliance on a stated location of the digital candidate item.

### Claim 13 (depends on 7)

The method of claim 7, wherein the attempting yields a success and wherein comparing the validation binary to the candidate binary avoids reliance on comparison of any certification signature of either binary.

### Claim 14 (depends on 7)

The method of claim 7, wherein the attempting yields a success and wherein comparing the validation binary to the candidate binary ignores timestamps and ignores file access permissions.

### Claim 15 (depends on 7)

The method of claim 7, wherein the attempting ignores a difference in two compiler versions in response to ascertaining that both compiler versions are known to generate equivalent code for at least a portion of the candidate binary and the validation binary.

### Claim 16

A computer-readable storage device configured with data and instructions which upon execution by a processor cause a computing system to perform a method for software provenance validation, the method comprising:
acquiring a digital provenance manifest;
getting a candidate binary;
obtaining at least one digital candidate item, wherein obtaining at least one digital candidate item comprises reading from the digital provenance manifest a location of the digital candidate item, and fetching the digital candidate item from the location;
attempting to computationally build a validation binary based on the provenance manifest and the at least one candidate item, the attempting yielding either a success or a failure;
when the attempting yields a success in building the validation binary, computationally comparing the validation binary to the candidate binary, and producing a digital provenance attestation according to a result of comparing the binaries; and
when the attempting yields a failure to build the validation binary, producing the digital provenance attestation according the failure.

### Claim 17 (depends on 16)

The storage device of claim 16, wherein the attempting yields the failure, and the method further comprises reporting that the validation binary and the candidate binary differ in at least one of the following: intermediate language, assembly language, executable code, metadata, or symbol information.

### Claim 18 (depends on 16)

The storage device of claim 16, wherein the attempting yields the failure, and the method further comprises reporting that the validation binary and the candidate binary are the same in at least one of the following: intermediate language, assembly language, executable code, metadata, or symbol information.

### Claim 19 (depends on 16)

The storage device of claim 16, wherein the attempting yields the failure, and the method further comprises reporting that the validation binary and the candidate binary differ in a particular candidate part file, and reporting a name of the particular candidate part file.

### Claim 20 (depends on 16)

The storage device of claim 16, wherein the attempting yields the failure, and the method further comprises reporting that the validation binary and the candidate binary differ in that one of the binaries contains a routine that is not present in the other one.