Back to results
US 12,596,847 B2Granted
Decentralized attestations for software artifacts
AssigneeSap SE
InventorChristian Martick
Life of this patent
Estimating the term…
Abstract
Embodiments describe techniques for validating the integrity and compliance of software artifacts through the use of attestations. An attestation manager is capable of retrieving an attestation file from storage, validating the software artifact and the attestation chain within the attestation, and optionally generate new attestations to add to the attestation chain when the software artifact and the attestation chain have been validated. A public-key encryption scheme may be applied to validate attestations while a fingerprint comparison scheme may be applied to validate the software artifact.
Claims15
A method, comprising:
- retrieving an attestation file from storage, the attestation file including a first attestation that attests a software artifact satisfies a first property, the first attestation including a first cryptographic fingerprint associated with the software artifact and a first cryptographic signature;
- validating the software artifact, wherein validating the software artifact includes:
- applying a cryptographic algorithm on the software artifact to generate a second cryptographic fingerprint;
- and
- comparing the first cryptographic fingerprint and the second cryptographic fingerprint;
- validating contents of the first attestation, wherein validating the contents of the first attestation includes applying a first public-key to the contents of the first attestation other than the first cryptographic signature stored within the first attestation to generate a second cryptographic signature and comparing the first cryptographic signature and the second cryptographic signature;
- and
- in response to successfully validating the contents of the first attestation and validating the software artifact, generating a second attestation that the software artifact satisfies a second property and adding the second attestation to the attestation file.
5 more elements
A system comprising:
- one or more processors;
- a non-transitory computer-readable medium storing a program executable by the one or more processors, the program comprising sets of instructions for:
- retrieving an attestation file from storage, the attestation file including a first attestation that attests a software artifact satisfies a first property, the first attestation including a first cryptographic fingerprint associated with the software artifact and a first cryptographic signature;
- validating the software artifact, wherein validating the software artifact includes:
- applying a cryptographic algorithm on the software artifact to generate a second cryptographic fingerprint;
- and
- comparing the first cryptographic fingerprint and the second cryptographic fingerprint;
- validating contents of the first attestation, wherein validating the contents of the first attestation includes applying a first public-key to the contents of the first attestation other than the first cryptographic signature stored within the first attestation to generate a second cryptographic signature and comparing the first cryptographic signature and the second cryptographic signature;
- and
- in response to successfully validating the contents of the first attestation and validating the software artifact, generating a second attestation that the software artifact satisfies a second property and adding the second attestation to the attestation file.
7 more elements
A non-transitory computer-readable medium storing a program executable by one or more processors, the program comprising sets of instructions for:
- retrieving an attestation file from storage, the attestation file including a first attestation that attests a software artifact satisfies a first property, the first attestation including a first cryptographic fingerprint associated with the software artifact and a first cryptographic signature;
- validating the software artifact, wherein validating the software artifact includes:
- applying a cryptographic algorithm on the software artifact to generate a second cryptographic fingerprint;
- and
- comparing the first cryptographic fingerprint and the second cryptographic fingerprint;
- validating contents of the first attestation, wherein validating the contents of the first attestation includes applying a first public-key to the contents of the first attestation other than the first cryptographic signature stored within the first attestation to generate a second cryptographic signature and comparing the first cryptographic signature and the second cryptographic signature;
- and
- in response to successfully validating the contents of the first attestation and validating the software artifact, generating a second attestation that the software artifact satisfies a second property and adding the second attestation to the attestation file.
5 more elements
Dependencies are inferred from the claim text.