Method and system for secure software distribution

Abstract

A method, system, and apparatus for securely distributing software deliverables. A first computing device may be configured to encrypt one or more software deliverables into encrypted data files, encrypt a key and policy file associated with the encrypted data files, and transmit the encrypted data files, the key, and the policy file to a second computing device. The policy file may include policy information for authenticating access to the encrypted data files. The second computing device may use the key and policy information to access and authenticate a software application on the second computing device. The software application may be used to decrypt the data files and access the one or more software deliverables.

Description

[Background technology]

[0001] (CROSS-REFERENCE TO RELATED ART) This application claims the benefit of and relies on the filing date of U.S. Provisional Patent Application No. 63 / 385,377, filed November 29, 2022, the entire disclosure of which is incorporated herein by reference.

[0002] (background) Air-gapped machines typically include computing systems or servers that are physically disconnected (air-gapped) from other machines or networks, thus preventing attempts at remote attacks against the air-gapped machine. Traditional software or data distribution methods utilizing air-gapped systems involve the use of portable storage devices to transfer data between computing systems. These methods rely on encrypting the data before storing it on the portable storage device and protecting the public / private keys used to decrypt and access the data manually or by relying on access controls. Traditional encryption systems support operations in which data is encrypted in a way that it can only be decrypted by a user with a unique decryption key. For symmetric key encryption systems such as the Advanced Encryption Standard (AES), the encryption and decryption keys are the same, and every effort must be made to prevent leaking the key to an adversary, allowing the adversary to gain the ability to decrypt and access sensitive data. For public key encryption systems such as RSA, paired public and private keys are used so that data, once encrypted with the public key, can only be decrypted with the corresponding private key. If an adversary obtains the public key, the adversary will still not be able to decrypt the data. However, individual computing devices are still vulnerable to software attacks, such as malware attacks. These computing devices can be compromised, and malware can gain access to the device and access the key used to decrypt the associated data. Summary of the Invention [Means for solving the problem]

[0003] It is to be understood that both the following general description and the following detailed description are exemplary and explanatory only and are not restrictive.

[0004] Methods, systems, and apparatuses for providing secure software distribution are described herein. A secure build server may be configured to encrypt one or more software deliverables (e.g., data files, container images, bioinformatics (e.g., genomic, epigenomic, and / or proteomic data from patient test samples), etc.) into encrypted data files and encrypt a first key and a policy file associated with the encrypted data files. The policy file may include policy information that authorizes access to the encrypted data files. The secure build server may store the encrypted first key via a trusted execution environment and the encrypted data files and policy file via portable storage. A destination server may access the portable storage and receive the encrypted data files, the encrypted policy file, and the encrypted first key. The destination server may use a second key to decrypt the encrypted software application, the encrypted policy file, and the encrypted first key. The destination server may authenticate the software application based on the policy information and use the software application and the first key to decrypt the encrypted data files and access the one or more software deliverables.

[0005] In one embodiment, disclosed is a method including: encrypting, by a first computing device, one or more software artifacts into encrypted data files; encrypting an encryption key and a policy file associated with the encrypted data files, the policy file including policy information for authenticating access to the encrypted data files; storing the encrypted encryption key via a trusted execution environment of the first computing device; and storing the encrypted data files and the policy file via portable storage; wherein a second computing device accesses the encrypted data files via a software application of the second computing device that is authenticated based on the encryption key and the policy information.

[0006] In one embodiment, disclosed is a method that includes receiving, by a computing device, an encrypted data file, an encrypted policy file, and an encrypted first encryption key; decrypting the encrypted software application, the encrypted policy file, and the encrypted first encryption key based on the second encryption key, where the policy file includes policy information for authenticating access to the encrypted data file; authenticating the software application based on the policy information; decrypting the encrypted data file via the software application based on the authentication of the software application and based on the first encryption key; and accessing one or more software deliverables based on the decrypted data file.

[0007] In an embodiment, disclosed is a system including: a first computing device having a trusted execution environment configured to: encrypt one or more software artifacts into encrypted data files; encrypt a first encryption key and a policy file associated with the encrypted data files, the policy file including policy information for authenticating access to the encrypted data files; store the encrypted first encryption key via the trusted execution environment; and store the encrypted data files and the policy file via portable storage; and a second computing device configured to: decrypt the encrypted software application, the encrypted policy file, and the encrypted first encryption key based on the second encryption key; authenticate the software application based on the policy information; decrypt the encrypted data files via the software application based on the authentication of the software application and based on the first encryption key; and access the one or more software artifacts based on the decrypted data files.

[0008] The various steps of the methods disclosed herein, or steps performed by the systems disclosed herein, may occur at the same time or at different times, and / or in the same geographic location or in different geographic locations, e.g., countries. The various steps of the methods disclosed herein can be performed by the same person / entity or different people / entities.

[0009] Additional advantages will be set forth in part in the description that follows, or may be learned by practice. The advantages will be realized and attained by means of the elements and combinations particularly pointed out in the appended claims. [Brief explanation of the drawings]

[0010] The accompanying drawings, which are incorporated in and constitute a part of this description, serve to explain the principles of the methods and systems described herein. [Figure 1] FIG. 1 shows an exemplary system. [Figure 2] FIG. 2 illustrates an example scenario. [Figure 3] FIG. 3 illustrates an exemplary encryption / decryption process. [Figure 4] FIG. 4 illustrates an exemplary encryption / decryption process. [Figure 5] FIG. 5 shows a flow chart of an exemplary method. [Figure 6] FIG. 6 shows a flow chart of an exemplary method. DETAILED DESCRIPTION OF THE INVENTION

[0011] (Detailed explanation) As used in this specification and the appended claims, the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. Ranges may be expressed herein as from "about" one particular value, and / or to "about" another particular value. When such a range is expressed, the other configuration includes from the one particular value and / or to the other particular value. Similarly, when values ​​are expressed as approximations, by use of the antecedent "about," it will be understood that the particular value forms the other configuration. Further, it will be understood that the endpoints of each of the ranges are significant both in relation to the other endpoint, and independently of the other endpoint.

[0012] "Optional" or "optionally" means that the subsequently described event or circumstance may or may not occur, and that the description includes cases where the event or circumstance occurs and cases where it does not occur.

[0013] Throughout the description and claims, the word "comprise" and variations of that word, such as "comprising" and "comprises," mean "including but not limited to" and are not intended to exclude, for example, other components, integers, or steps. "Exemplary" means "an example of" and is not intended to convey an indication of a preferred or ideal configuration. "Such as" is used for descriptive purposes, not in a limiting sense.

[0014] It is understood that when combinations, subsets, interactions, groups, etc. of components are described, specific reference to each of these various individual and collective combinations and permutations thereof may not be explicitly described, but each is specifically contemplated and described herein. This applies to all parts of this application, including, but not limited to, described method steps. Thus, where there are various additional steps that may be performed, it is understood that each of these additional steps may be performed using any specific configuration or combination of configurations of the described method features.

[0015] As will be appreciated by those skilled in the art, hardware, software, or a combination of software and hardware may be implemented. Furthermore, the method and system may take the form of a computer program product on a computer-readable storage medium (e.g., non-transitory) having processor-executable instructions (e.g., computer software) embodied in the storage medium. Any suitable computer-readable storage medium may be utilized, including a hard disk, a CD-ROM, an optical storage device, a magnetic storage device, a MEM register, a non-volatile random access memory (NVRAM), a flash memory, or a combination thereof.

[0016] Throughout this application, reference will be made to block diagrams and flowcharts. It will be understood that each block of the block diagrams and flowcharts, and combinations of blocks in the block diagrams and flowcharts, respectively, can be implemented by processor-executable instructions. These processor-executable instructions, when loaded onto a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, can generate a machine such that the processor-executable instructions, when executed on the computer or other programmable data processing apparatus, create a device for implementing the functions specified in one or more of the flowchart blocks.

[0017] These processor-executable instructions may also be stored in a computer-readable memory and may direct a computer or other programmable data processing apparatus to function in a particular manner, such that the processor-executable instructions stored in the computer-readable memory produce an article of manufacture including the processor-executable instructions for implementing the functions defined in one or more of the flowchart blocks. The processor-executable instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus, producing a computer-implemented process such that the processor-executable instructions executing on the computer or other programmable apparatus provide steps for implementing the functions defined in one or more of the flowchart blocks.

[0018] The blocks in the block diagrams and flowcharts support combinations of devices for performing the specified functions, combinations of steps for performing the specified functions, and program instruction means for performing the specified functions. It will also be understood that each block of the block diagrams and flowcharts, and combinations of blocks in the block diagrams and flowcharts, can be implemented by a dedicated hardware-based computer system that performs the specified functions or steps, or a combination of dedicated hardware and computer instructions.

[0019] FIG. 1 illustrates an exemplary system 100 for securely transferring software. In some embodiments, some or all steps of any described method may be implemented on a computing device as described herein. The system may include a first computing device 101, a second computing device 103, and an electronic device 104. The first computing device 101 may comprise a server computing device (e.g., a secure build server). For example, the first computing device 101 may comprise a digital computer. The digital computer may comprise a memory 110, one or more input / output (I / O) interfaces 120, a processor 122, and one or more network interfaces 124. The memory 110, the one or more input / output (I / O) interfaces 120, the processor 122, and the one or more network interfaces 124 may communicate with each other via a local interface 118. The local interface 118 may comprise one or more buses or other wired or wireless connections. To enable communications, the local interface 118 may comprise additional elements, such as controllers, buffers (caches), drivers, repeaters, and receivers, which are omitted for simplicity. The local interface 118 may further include address, control, and / or data connections to enable appropriate communications between the memory 110, one or more input / output (I / O) interfaces 120, the processor 122, and one or more network interfaces 124.

[0020] The one or more I / O interfaces 120 may comprise one or more interfaces for receiving user input from one or more devices or components and / or providing system output to one or more devices or components. User input may be provided, for example, via a keyboard and / or a mouse. System output may be provided via a display device and a printer (not shown). The I / O interfaces 120 may include, for example, a serial port, a parallel port, a small computer system interface (SCSI), an infrared (IR) interface, a radio frequency (RF) interface, and / or a universal serial bus (USB) interface. In some embodiments, at least one of the one or more I / O interfaces 120 may be configured to connect to the electronic device 103. The electronic device 103 may comprise a portable storage device comprising one or more of USB storage, secure digital storage, a mobile device, a smartphone, a tablet, or any other computing device capable of communicating with and storing data / information on the first computing device 101 and / or the second computing device 102.

[0021] The processor 122 may be a hardware device, particularly for executing software that may be stored in the memory 110. The processor 122 may be any custom-made or commercially available processor, a central processing unit (CPU), an auxiliary processor among several processors associated with the first computing device 101, a semiconductor-based microprocessor (in the form of a microchip or chipset), or generally any device for executing software instructions. When the first computing device 101 is operating, the processor 122 may be configured to execute software stored in the memory 110, communicate data to and from the memory 110, and generally control the operation of the first computing device 101 in accordance with the software. In some embodiments, the processor 122 may further include a trusted execution environment with hardware-based memory encryption (e.g., an Intel Software Guard Extensions (SGX) CPU). The trusted execution environment may be used to store keys for encrypting / decrypting data. For example, the first computing device 101 may generate a public / private key pair for encrypting / decrypting data. The first computing device 101 may store the public key via a trusted execution environment and the private key via portable storage (e.g., USB storage, secure digital storage). In one embodiment, the first computing device 101 may be configured to transmit the private key to a destination server via a secure backhaul network.

[0022] The one or more network interfaces 124 may be used to transmit and receive data from the first computing device 101 over a network (e.g., an intranet, an extranet, the Internet, a secure backhaul network, etc.). The network interface 124 may include, for example, a 10BaseT Ethernet adapter, a 100BaseT Ethernet adapter, a LAN PHY Ethernet adapter, a Token Ring adapter, a wireless network adapter (e.g., WiFi, cellular, satellite), or any other suitable network interface device. The one or more network interfaces 124 may include address, control, and / or data connections to enable appropriate communication over the network.

[0023] The memory 110 may include any one or combination of volatile memory elements (e.g., random access memory (RAM, such as DRAM, SRAM, SDRAM, etc.)) and non-volatile memory elements (e.g., ROM, hard drive, tape, CD-ROM, DVD-ROM, etc.). Furthermore, the memory 110 may incorporate electronic, magnetic, optical, and / or other types of storage media. It is noted that the memory 110 may have a distributed architecture, where various components are located remotely from each other but can be accessed by the processor 122.

[0024] The software in memory 110 may include one or more software programs, each comprising an ordered listing of executable instructions for implementing a logical function. The software in memory system 110 of first computing device 101 may include operating system (O / S) 112, encryption program 114, and software artifact data 116. Operating system 112 may control the execution of other computer programs and provide scheduling, input / output control, file and data management, memory management, and communication control and related services. For example, first computing device 101 may receive one or more software artifacts (e.g., data files, container images, or bioinformatics) and store the one or more software artifacts as software artifact data 116 in memory 110. The one or more software artifacts in software artifact data 116 may be encrypted by encryption program 114 into encrypted data files, and first computing device 101 may store the encrypted data files in electronic device 103. The first computing device 101 may generate a public key / private key (e.g., asymmetric encryption) associated with the encrypted data file. The first computing device 101 may encrypt the public key and store it in a trusted execution environment, as well as encrypt the private key and store the encrypted private key in the electronic device 103. In addition, the first computing device 101 may generate policy information associated with the encrypted data file. The policy information may include information used to authenticate a receiving device (e.g., a destination server) or person for authorizing access to the encrypted data file. For example, the policy information may include one or more of identifier information of one or more users authorized to access the encrypted data file, identifier information of one or more servers authorized to access the encrypted data file, software authorized to access the encrypted data file, or encryption key information.The first computing device 101 may encrypt the policy information as an encrypted policy file and store the policy file on the electronic device 103. In some embodiments, the first computing device 101 may further include a third-party software policy manager that generates the policy information. In some embodiments, the first computing device 101 may pre-share the encrypted policy file with the second computing device 102, such as via another electronic device or a secure backhaul network, before the second computing device 102 is provided access to the encrypted data file. In some embodiments, the first computing device 101 may associate a signature code with the policy information and the encrypted data file to verify the encrypted data file.

[0025] The second computing device 102 may comprise a server computing device (e.g., a destination server). For example, the second computing device 102 may comprise a digital computer. The digital computer may comprise a memory 126, one or more input / output (I / O) interfaces 134, a processor 136, and one or more network interfaces 138. The memory 126, the one or more input / output (I / O) interfaces 134, the processor 136, and the one or more network interfaces 138 may communicate with each other via a local interface 132. The local interface 132 may comprise one or more buses or other wired or wireless connections. The local interface 132 may comprise additional elements, such as controllers, buffers (caches), drivers, repeaters, and receivers, which are omitted for simplicity, to enable communication. The local interface 132 may further include address, control, and / or data connections to enable appropriate communication between the memory 126, one or more input / output (I / O) interfaces 134, the processor 136, and one or more network interfaces 138.

[0026] The one or more I / O interfaces 134 may comprise one or more interfaces for receiving user input from one or more devices or components and / or providing system output to one or more devices or components. User input may be provided, for example, via a keyboard and / or a mouse. System output may be provided via a display device and a printer (not shown). The I / O interfaces 134 may include, for example, a serial port, a parallel port, a small computer system interface (SCSI), an infrared (IR) interface, a radio frequency (RF) interface, and / or a universal serial bus (USB) interface. In an embodiment, at least one of the one or more I / O interfaces 120 may be configured to connect to the electronic device 103 to access encrypted data files, encrypted policy files, and / or encrypted private keys.

[0027] The processor 136 may be a hardware device for executing software, which may be stored in the memory 126. The processor 136 may be any custom-made or commercially available processor, a central processing unit (CPU), an auxiliary processor among several processors associated with the second computing device 102, a semiconductor-based microprocessor (in the form of a microchip or chipset), or generally any device for executing software instructions. When the second computing device 102 is operating, the processor 136 may be configured to execute software stored in the memory 126, communicate data to and from the memory 126, and generally control the operation of the second computing device 102 in accordance with the software. In some embodiments, the processor 136 may further include a trusted execution environment with hardware-based memory encryption (e.g., an Intel Software Guard Extensions (SGX) CPU). The trusted execution environment may be used to store authentication keys (e.g., secure shell (SSH) keys) associated with a user of the second computing device 102. For example, a user of the second computing device 102 may provide user input to the second computing device 102 via the I / O interface 134, requesting an authentication key. The second computing device 102 may generate a decryption key and store the decryption key via the trusted execution environment. In some embodiments, the SSH key may be generated by a third-party application / device and provided to the second computing device 102. In some embodiments, the authentication key may be valid for only a certain period of time (e.g., 10 minutes, 1 hour, 1 week, etc.).

[0028] The one or more network interfaces 138 may be used to transmit and receive data from the second computing device 102 over a network (e.g., an intranet, an extranet, the Internet, etc.). The network interface 138 may include, for example, a 10BaseT Ethernet adapter, a 100BaseT Ethernet adapter, a LAN PHY Ethernet adapter, a Token Ring adapter, a wireless network adapter (e.g., WiFi, cellular, satellite), or any other suitable network interface device. The one or more network interfaces 138 may include address, control, and / or data connections to enable appropriate communication over the network.

[0029] The memory 126 may include any one or combination of volatile memory elements (e.g., random access memory (RAM, such as DRAM, SRAM, SDRAM, etc.)) and non-volatile memory elements (e.g., ROM, hard drive, tape, CD-ROM, DVD-ROM, etc.). The memory 126 may also incorporate electronic, magnetic, optical, and / or other types of storage media. It is noted that the memory 126 may have a distributed architecture, where various components are located remotely from each other but can be accessed by the processor 136.

[0030] The software in memory 126 may include one or more software programs, each comprising an ordered listing of executable instructions for implementing logical functions. The software in memory system 126 of second computing device 102 may include an operating system (O / S) 128 and software applications 130. The operating system 128 may control the execution of other computer programs and provide scheduling, input / output control, file and data management, memory management, and communication control and related services. For example, second computing device 102 may access encrypted data files, encrypted policy files, and / or encrypted private keys via electronic device 103. Second computing device 102 may use stored decryption keys to decrypt encrypted policy files and encrypted private keys. In some embodiments, software applications 130 may be initially encrypted when second computing device 102 initially receives software applications 130, such as via a third-party device. The second computing device 102 may decrypt the encrypted software application 130 based on the authentication key. The second computing device 102 may authenticate the software application based on the policy information. The second computing device 102 may use the authenticated software application to decrypt the encrypted data file based on the private key. In one embodiment, a signature code may be associated with the policy information and / or the encrypted data file. The second computing device 102 may further verify the encrypted data file based on the associated signature code. The second computing device 102 may access one or more software artifacts based on the decrypted data file. In one embodiment, the second computing device 102 may store the one or more software artifacts in a secure location.

[0031] As shown in FIG. 1 , application programs and other executable program components, such as operating system 112 / 128, are depicted as discrete blocks. However, it is recognized that such programs and components may reside at various times in different storage components of first computing device 101 and / or second computing device 102. As an example, encryption program 114 and / or software application 130 may be stored on or transmitted across some form of computer-readable media. Any of the disclosed methods may be performed by computer-readable instructions embodied on computer-readable media. Computer-readable media may be any available medium that can be accessed by a computer. For example, computer-readable media may comprise “computer storage media” and “communications media.” “Computer storage media” may comprise volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information, such as computer-readable instructions, data structures, program modules, or other data. In some embodiments, computer storage media may comprise RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device, or any other medium that can be used to store desired information and that can be accessed by a computer.

[0032] 2 illustrates an exemplary scenario for securely transferring software, in which a first computing device 101 (e.g., a secure build server) may provide an encrypted data file, an encrypted policy file, and an encrypted private key to a second computing device 102 (e.g., a destination server) via an electronic device 103 (e.g., a portable storage device such as USB storage, secure digital storage, etc.), and the second computing device may decrypt the encrypted data file and access the contents of the data file based on the policy file and the private key. The first computing device 101 may receive one or more software artifacts 210 (e.g., data files, container images, or bioinformatics). The first computing device may encrypt the software artifacts into encrypted data files 230 and associate a signature code with the encrypted data files 230. In addition, the first computing device 101 generates and encrypts a policy file 212 and a private key 214 to be associated with the encrypted data files 230. In one embodiment, the first computing device 101 may generate a public-private key (e.g., asymmetric encryption) associated with the encrypted data file 230. The first computing device 101 may encrypt the public key and store the encrypted public key (e.g., via the trusted execution environment of the first computing device 101), as well as encrypt the private key and store the encrypted private key at the electronic device 103. The second computing device 102 may access the encrypted and signed data file 230 and the encrypted policy file 232 via the electronic device 103. The second computing device 102 receives and stores an authentication key 224 (e.g., an SSH key) associated with a user of the second computing device 102. For example, a user may provide input requesting an authentication key, which may be generated, for example, by the second computing device 102 or a third-party device.The authentication key may be valid only for a certain period of time (e.g., 10 minutes, 1 hour, 1 week, etc.). The authentication key 224 may be used to decrypt the encrypted software application, the encrypted policy file, and the encrypted private key 232. For example, the second computing device 102 may receive the encrypted software application, and the software application 226 may be used to decrypt the encrypted data file 230. The second computing device 102 may authenticate the software application 226 based on the policy file 222. The second computing device 102 may use the authenticated software application 226 to decrypt the encrypted data file based on the private key 228. The second computing device 102 may access one or more software artifacts based on the decrypted data file 220.

[0033] 3 shows an exemplary process for securely transferring software. At 302, a first computing device 101 (e.g., a secure build server) may encrypt one or more software deliverables (e.g., data files, container images, or bioinformatics) into encrypted data files. At 304, the first computing device 101 may generate and encrypt a private key and a policy file associated with the encrypted data files. The policy file may include policy information for authorizing access to the encrypted data files. The policy information may include one or more of: identifier information of one or more users authorized to access the encrypted data files; identifier information of one or more servers authorized to access the encrypted data files; software authorized to access the encrypted data files; or encryption key information. In one embodiment, the first computing device 101 may generate a public-private key pair (e.g., asymmetric encryption) associated with the encrypted data files. The first computing device 101 may store the public key via a trusted execution environment of the first computing device 101 (e.g., hardware-based memory encryption such as an Intel SGX CPU). At 306, the first computing device 101 may store the encrypted data file, the encrypted private key, and the encrypted policy file via the electronic device 103 (e.g., a portable storage device such as USB storage, secure digital storage, etc.). At 308, the second computing device 102 (e.g., a destination server) may access the encrypted data file, the encrypted private key, and the encrypted policy file via the electronic device 103. At 310, the second computing device 102 may decrypt the encrypted private key, the encrypted policy file, and the encrypted software application based on an authentication key (e.g., an SSH key) associated with a user of the second computing device 102.For example, an authentication key may be generated based on a user request. At 312, the second computing device 102 may authenticate the software application based on the policy information. At 314, the second computing device 102 may use the authenticated software application to decrypt the encrypted data file based on the private key and access the one or more software artifacts. In one embodiment, the second computing device 102 may store the one or more software artifacts in a secure location.

[0034] FIG. 4 shows an exemplary process for securely transferring software. Steps 402 and 404 are similar to steps 302 and 304 of FIG. 3. However, an additional step 406 may be included, in which the first computing device 101 may send the encrypted policy file directly to the second computing device 102. For example, the first computing device 101 may send the policy file to the second computing device 102 via a secure backhaul network. In 408, the first computing device 101 may store the encrypted data file and the encrypted private key via the electronic device 103. In 410, the second computing device 102 may access the encrypted data file and the encrypted private key via the electronic device 103. Steps 412, 414, and 416 are similar to steps 310, 312, and 314, respectively, of FIG. 3.

[0035] 5 shows a flowchart of an exemplary method 500. Method 500 may be implemented by first computing device 101, second computing device 102, electronic device 103, any combination thereof, or any other suitable device. In step 510, one or more software artifacts may be encrypted into encrypted data files. For example, one or more software artifacts may be encrypted into encrypted data files by first computing device 101. First computing device 101 may comprise a secure build server. The one or more software artifacts may include one or more of a data file, a container image, or bioinformatics.

[0036] In step 520, a key and policy file associated with the encrypted data file may be encrypted. For example, the key and policy file associated with the encrypted data file may be encrypted by the first computing device 101. For example, the key and policy file may be generated by the first computing device 101 based on the encrypted data file. The key may include a private key that can be used to decrypt the encrypted data file. In one embodiment, the first computing device 101 may generate a public key and a private key (e.g., a public-private key pair based on asymmetric encryption) based on the encrypted data file. The policy file may include policy information for authenticating access to the encrypted data file. The policy information may include one or more of identifier information of one or more users authorized to access the encrypted data file, identifier information of one or more servers authorized to access the encrypted data file, software authorized to access the encrypted data file, or encryption key information. In one embodiment, the first computing device 102 may associate a signature code with the policy information and the encrypted data file.

[0037] In step 530, the encrypted key may be stored via a trusted execution environment of the first computing device 101. The trusted execution environment may comprise hardware-based memory encryption (e.g., an Intel Software Guard Extensions (SGX) CPU).

[0038] In step 540, the encrypted data file and the policy file may be stored via portable storage. For example, the first computing device 101 may store the encrypted data file and the policy file via portable storage. The portable storage may be external to the first computing device 101 and the second computing device 102 and may comprise one or more of USB storage or secure digital storage. In one embodiment, the second computing device 101 may access the encrypted data file via a software application on the second computing device. The software application may be authenticated based on the key and policy information. For example, the second computing device 102 may access the portable storage and receive the encrypted data file and the encrypted policy file. The second computing device 102 may include a second trusted execution environment that includes hardware-based memory encryption (e.g., an Intel Software Guard Extensions (SGX) CPU). The second computing device 102 may store an authentication key associated with a user of the second computing device 102 via the trusted execution environment. The second computing device 102 may decrypt the encrypted software application, the encrypted policy file, and the encrypted key based on the authentication key. The second computing device 102 may authenticate the software application based on the policy information in the policy file. The second computing device 102 may use the software application and, based on the authentication of the software application and based on the key, decrypt the encrypted data file and access one or more software artifacts.

[0039] FIG. 6 shows a flowchart of an exemplary method 600. Method 600 may be implemented by the first computing device 101, the second computing device 102, the electronic device 103, any combination thereof, or any other suitable device. In step 610, an encrypted data file, an encrypted policy file, and an encrypted first key may be received. For example, the second computing device 102 may receive the encrypted data file, the encrypted policy file, and the encrypted first key. The second computing device 102 may comprise a destination server. The second computing device 102 may receive the encrypted data file, the encrypted policy file, and the encrypted first key from a secure build server (e.g., the first computing device 101) via portable storage. The portable storage may be external to the second computing device 102 and the first computing device 101 and may comprise one or more of USB storage or secure digital storage.

[0040] As an example, the first computing device 101 may encrypt one or more software artifacts into encrypted data files. In addition, the first computing device 101 may encrypt a first key (e.g., a private key), a public key, and a policy file. The first computing device 101 may store the encrypted data files, the encrypted first key, and the encrypted policy file via portable storage. In one example, the first computing device 101 may associate a signature code with the policy information and the encrypted data file. In one example, the first computing device 101 may pre-share (e.g., transmit) the encrypted policy file to the second computing device 102 via a secure backhaul network or network path.

[0041] In step 620, the software application, the encrypted policy file, and the encrypted first key may be decrypted based on the second key. For example, the software application, the encrypted policy file, and the encrypted first key may be decrypted by the second computing device 102 based on the second key. For example, the software application may be initially encrypted when the second computing device 102 initially receives the software application, such as via a third-party device. In some embodiments, the second computing device 102 may include a trusted execution environment that includes hardware-based memory encryption (e.g., an Intel Software Guard Extensions (SGX) CPU). The second computing device 102 may store an authentication key (e.g., a second key) associated with a user of the second computing device 102 via the trusted execution environment. The policy file may include policy information for authorizing access to the encrypted data file. The policy information may include one or more of identifier information of one or more users authorized to access the encrypted data file, identifier information of one or more servers authorized to access the encrypted data file, software authorized to access the encrypted data file, or encryption key information.

[0042] In step 630, the software application may be authenticated based on the policy information. For example, the software application may be authenticated by the second computing device 102 based on the policy information.

[0043] In step 640, the encrypted data file may be decrypted via the software application based on authentication of the software application and based on the first key. For example, the encrypted data file may be decrypted by the second computing device via the software application based on authentication of the software application and based on the first key. In one embodiment, the encrypted data file may be verified by the second computing device 102 based on policy information and a signature code associated with the encrypted data file. The encrypted data file may be decrypted based on verification of the encrypted data file.

[0044] In step 650, one or more software artifacts may be accessed based on the decrypted data file. For example, the one or more software artifacts may be accessed by computing device 102 based on the decrypted data file. The one or more software artifacts may include one or more software artifacts including one or more of a data file, a container image, or bioinformatics.

[0045] While the methods and systems have been described in connection with preferred embodiments and specific examples, it is not intended that the scope be limited to the particular embodiments described, as the embodiments herein are intended in all respects to be illustrative rather than restrictive.

[0046] Unless expressly stated otherwise, it is not intended in any way that any method set forth herein be construed as requiring that its steps be performed in a specific order. Thus, if a method claim does not actually recite the order to be followed by its steps, or if it is not otherwise specifically stated in the claim or description that the steps are to be limited to a specific order, then no order is intended to be inferred in any respect. This is true with respect to any possible non-expressive basis for interpretation, including matters of logic regarding the arrangement of steps or operational flow, the plain meaning derived from grammatical organization or punctuation, and the number or type of embodiments described herein.

[0047] It will be apparent to those skilled in the art that various modifications and variations can be made without departing from the scope or spirit. Other embodiments will be apparent to those skilled in the art from consideration of the specification and practice disclosed herein. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit being indicated by the following claims.

Claims

1. 1. A method, comprising: encrypting, by a first computing device, one or more software artifacts into encrypted data files; encrypting a key and policy file associated with the encrypted data file, the policy file including policy information for authorizing access to the encrypted data file; storing the encrypted key via a trusted execution environment of the first computing device; storing the encrypted data file and the policy file via portable storage, wherein a second computing device accesses the encrypted data file via a software application on the second computing device that is authenticated based on the key and the policy information; A method comprising:

2. The method of claim 1 , wherein the first computing device comprises a secure build server and the second computing device comprises a destination server.

3. The method of any one of claims 1-2, wherein the one or more software artifacts include one or more of a data file, a container image, or bioinformatics.

4. A method according to any one of claims 1 to 3, wherein the policy information includes one or more of identifier information of one or more users authorized to access the encrypted data file, identifier information of one or more servers authorized to access the encrypted data file, software authorized to access the encrypted data file, or encryption key information.

5. The method of any one of claims 1-4, further comprising associating a signature code with the policy information and the encrypted data file.

6. The method of any one of claims 1 to 5, wherein the trusted execution environment comprises hardware-based memory encryption.

7. The method of any one of claims 1-6, wherein the portable storage comprises one or more of USB storage or secure digital storage.

8. The method of any one of claims 1-7, wherein the portable storage is external to the first computing device and the second computing device.

9. The method of any one of claims 1-9, wherein the second computing device decrypts the encrypted key and the encrypted policy file based on a second key associated with the second computing device.

10. 1. A method, comprising: receiving, by a computing device, the encrypted data file, the encrypted policy file, and the encrypted first key; decrypting the encrypted software application, the encrypted policy file, and the encrypted first key based on a second key, the policy file including policy information for authorizing access to the encrypted data file; authenticating the software application based on the policy information; decrypting, via the software application, the encrypted data file based on authentication of the software application and based on the first key; accessing one or more software products based on the decrypted data file; and A method comprising:

11. 11. The method of claim 10, wherein the computing device comprises a destination server, the destination server receiving the encrypted data file, the encrypted policy file, and the encrypted first key from a secure build server.

12. The method of any one of claims 10-11, wherein the computing device receives the encrypted data file, the encrypted policy file, and the encrypted first key via portable storage.

13. The method of claim 12 , wherein the portable storage comprises one or more of USB storage or secure digital storage.

14. The method of claim 12 , wherein the portable storage is external to the computing device.

15. The method of any one of claims 10-14, wherein the second key is stored via a trusted execution environment of the computing device.

16. The method of claim 15 , wherein the trusted execution environment comprises hardware-based memory encryption.

17. A method according to any one of claims 10-16, wherein the policy information includes one or more of identifier information of one or more users authorized to access the encrypted data file, identifier information of one or more servers authorized to access the encrypted data file, software authorized to access the encrypted data file, or encryption key information.

18. The method of any one of claims 10-17, wherein the one or more software artifacts include one or more of a data file, a container image, or bioinformatics.

19. The method of any one of claims 10-18, further comprising verifying the encrypted data file based on the policy information and a signature code associated with the encrypted data file.

20. 20. The method of claim 19, wherein the encrypted data file is decrypted based on the verification of the encrypted data file.

21. 1. A system comprising: a first computing device having a trusted execution environment, encrypting one or more software artifacts into encrypted data files; encrypting a first key and a policy file associated with the encrypted data file; the policy file includes policy information for authorizing access to the encrypted data file; and storing, via the trusted execution environment, the encrypted first key; storing the encrypted data file and the encrypted policy file via portable storage; a first computing device configured to: a second computing device, decrypting the encrypted software application, the encrypted policy file, and the encrypted first key based on a second key; authenticating the software application based on the policy information; decrypting, via the software application, the encrypted data file based on authentication of the software application and based on the first key; accessing the one or more software artifacts based on the decrypted data file; and a second computing device configured to perform A system comprising:

22. 22. The system of claim 21, wherein the first computing device comprises a secure build server and the second computing device comprises a destination server.

23. The system of any one of claims 21-22, wherein the trusted execution environment comprises hardware-based memory encryption.

24. The system of any one of claims 21-23, wherein the one or more software artifacts include one or more of a data file, a container image, or bioinformatics.

25. The system of any one of claims 21-24, wherein the policy information includes one or more of identifier information of one or more users authorized to access the encrypted data file, identifier information of one or more servers authorized to access the encrypted data file, software authorized to access the encrypted data file, or encryption key information.

26. The system of any one of claims 21-25, wherein the first computing device is further configured to associate a signature code with the policy information and the encrypted data file.

27. 27. The system of claim 26, wherein the second computing device is further configured to verify the encrypted data file based on the policy information and the signature code associated with the encrypted data file.

28. 30. The system of claim 27, wherein the second computing device is further configured to decrypt the encrypted data file based on the verification of the encrypted data file.

29. The system of any one of claims 21-28, wherein the portable storage comprises one or more of USB storage or secure digital storage.

30. The system of any one of claims 21-29, wherein the portable storage is external to the first computing device and the second computing device.

31. The system of any one of claims 21-30, wherein the second computing device is further configured to receive the encrypted data file and the policy file via the portable storage.

32. 32. The system of claim 21, wherein the second computing device comprises a second trusted execution environment, and the second computing device is further configured to store the second key via the second trusted execution environment.

Images