Methodology for trustworthy software build

Patent metadata

Field	Value
Publication number	US-11520902-B2
Application number	US-202016812090-A
Country	US
Kind code	B2
Filing date	Mar 6, 2020
Priority date	May 14, 2019
Publication date	Dec 6, 2022
Grant date	Dec 6, 2022

Abstract

A certificate-based methodology is used to establish the trustworthy relationship between source codes and produced binary files for a given software build. The trustworthy relationship between the source code and binary files is generated by recording build information during building of the source code. The build information may include build environment information, framework information, source files identification, intermediately generated files information, final binary files information, file operations during building of the source code, and/or commands/operations during building of the source code. A certificate is generated using the build information for establishing a relationship between the source code and a binary file created from the source code, and the certificate is signed with a public cryptographic key. A software release package is provided to the recipient including at least the source code, final binary files generated from the source code, and the certificate.

First claim

What is claimed is:

1. A computer-implemented method of establishing a trustworthy relationship between a source code and one or more binary files generated from the source code, the method comprising:
recording build information during building of the source code;
generating a certificate using the build information, the source code, and the one or more binary files, the certificate establishing a relationship between the source code and the one or more binary files created from the source code; and
signing the certificate with a public cryptographic key, the signed certificate being usable to verify that the one or more binary files referenced in the signed certificate have been created from the source code referenced in the signed certificate.

2. The method as in claim 1 , further comprising providing a software release package, the software release package including at least the source code, the one or more binary files generated from the source code, and the signed certificate.

3. The method as in claim 1 , further comprising generating, via a fingerprint generation algorithm, a recorded build information fingerprint.

4. The method as in claim 3 , further comprising:
receiving the recorded build information fingerprint;
cross-checking the recorded build information fingerprint against a fingerprint generated by a tool used during building of the source code; and
verifying that no modification has been made to a file between a time that the recorded build information fingerprint was generated and a time that the fingerprint was generated by the tool.

5. The method as in claim 1 , further comprising encrypting the signed certificate with the public cryptographic key or another public cryptographic key depending on given build requirements for a given build instance of the source code.

6. The method as in claim 1 , the public cryptographic key being provided by a recipient or a trusted third party, wherein the certificate is generated using a hashing algorithm not related to the public cryptographic key.

7. The method as in claim 1 , the build information comprising at least one of build environment information, framework information, source files identification, intermediately generated files information, final binary files information, file operations during building of the source code, or commands/operations during building of the source code.

8. A software build tool for establishing establishes a trustworthy relationship between a source code and one or more binary files generated from the source code, comprising:
a memory storing instructions; and
at least one processor in communication with the memory, the at least one processor configured, upon execution of the instructions, to perform the following steps:
record build information during building of the source code and record a build information fingerprint;
generate a certificate using the build information, the source code, and the one or more binary files, the certificate establish establishing a relationship between the source code and the one or more binary files created from the source code; and
sign the certificate with a public cryptographic key, the signed certificate being usable to verify that the one or more binary files referenced in the signed certificate have been created from the source code referenced in the signed certificate.

9. The software build tool as in claim 8 , the at least one processor being further configured to instruct a compiler to compile the source code into the one or more binary files, organize the source code, identify commands for execution by the compiler, and invoke the compiler to execute the identified commands.

10. The software build tool as in claim 8 , the at least one processor being further configured to generate a software release package including at least the source code, the one or more binary files generated from the source code, and the signed certificate.

11. The software build tool as in claim 8 , the at least one processor being further configured to encrypt the signed certificate with the public cryptographic key or another public cryptographic key, depending on given build requirements for a given build instance of the source code.

12. The software build tool as in claim 8 , the at least one processor being further configured to use a fingerprint generation algorithm to generate a recorded build information fingerprint.

13. The software build tool as in claim 12 , the at least one processor being further configured to:
cross-check the recorded build information fingerprint against a fingerprint generated by a tool used during building of the source code; and
verify that no modification has been made to a file between a time that the recorded build information fingerprint was generated and a time that the fingerprint was generated by the tool.

14. The software build tool as in claim 8 , the public cryptographic key being provided by a recipient or a trusted third party, wherein the certificate is generated using a hashing algorithm not related to the public cryptographic key.

15. The software build tool as in claim 8 , the build information comprising at least one of build environment information, framework information, source files identification, intermediately generated files information, final binary files information, file operations during building of the source code, or commands/operations during building of the source code.

16. A software build tool for verifying trustworthiness of binary code received by a recipient, comprising:
a memory storing instructions and storing a software release package including at least a source code, one or more binary files generated from the source code, and a signed certificate, the certificate including build information, the source code, and the one or more binary files, the signed certificate establishing a relationship between the source code and the one or more binary files created from the source code, the signed certificate being signed with a public cryptographic key and the build information being recorded during building of the source code; and
at least one processor in communication with the memory, the at least one processor configured, upon execution of the instructions, to perform the following steps:
verify the signed certificate included in the software release package is free of modification;
locally generate fingerprints of the source code and the one or more binary files included in the software release package;
compare the fingerprints of the source code and the one or more binary files included in the software release package against the locally generated fingerprints; and
determine that the source code and the one or more binary files included in the software release package are trustworthy when the locally generated fingerprints match the software release package fingerprints.

17. The software build tool as in claim 16 , the at least one processor being further configured to decrypt the certificate when the certificate is encrypted.

18. The software build tool as in claim 16 , the at least one processor being further configured to implement a fingerprint generation algorithm known to the recipient and a provider of the software release package, the fingerprint generation algorithm generating the fingerprints of the source code and the one or more binary files.

19. The software build tool as in claim 16 , the public cryptographic key being provided by a recipient or a trusted third party, wherein the certificate is generated using a hashing al

Assignees

• Futurewei Technologies Inc

Inventors

• Liu Haijun
• Chen Long

Classifications

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• G06F2221/033

  Test or assess software · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• G06F21/44

  Program or device authentication · CPC title

• H04L9/3247

  involving digital signatures · CPC title