Binary Image Authenticity Verification via Build Server Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software authentication methods fail to verify the authenticity of binary images generated by compromised build servers, leading to potential malware insertion and improper authentication.
Innovation Solution
A method and system that generate a first authentication indication for the binary image and a second authentication indication for the build server using attestation, ensuring that the binary image is authentic and generated without malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a signing server signs a binary image based on the assumption that it is based only on source code, then the binary image authentication is simplified and faster, but the system becomes vulnerable to malware insertion when the build server is compromised
Solution Approach 1:
The patent applies preliminary action by having the build server sign the binary image with a build server signature BEFORE the signing server processes it. This early signing action captures the build server's authentication state at the time of binary creation, preventing later compromises from affecting the authenticity verification. The build server signature is embedded in the binary image during the build process itself, establishing a trust baseline before potential attacks can occur.
Solution Approach 2:
The patent introduces a measurement container as an intermediary between the build server and the signing server. This container isolates the build environment and captures measurements of the binary image and build server state. The measurement container acts as a trusted mediator that records the authentication context, allowing the signing server to verify not just the binary content but also the integrity of the build process that produced it, thereby resolving the contradiction between speed and reliability.
2Device complexity
If the signing server verifies only the binary image content without verifying the build server authenticity, then the authentication process is simpler and faster, but it cannot detect malware inserted by compromised build servers
Solution Approach 1:
The build server performs preliminary authentication by signing the binary image with its own signature before submitting it to the signing server. This preliminary action embeds the build server's identity and authentication state directly into the binary image, creating a verifiable record of the build process. When the signing server later verifies this signature, it can detect if the build server was compromised, as the signature would not match the expected build server credentials.
Solution Approach 2:
The patent implements feedback by having the signing server verify the build server signature and compare it against known good build server credentials. This verification feedback loop provides the signing server with information about the build server's authenticity state. If the build server signature is invalid or doesn't match expected credentials, the signing server can reject the binary image, thereby detecting malware insertion attempts from compromised build servers.
Data Source
AI summary
A method is described that includes receiving source code corresponding to a program to be loaded on a processing device, generating a representation of the source code, generating a first authentication indication that indicates the representation is authentic and is based on the source code, generating a second authentication indication that indicates a build server generating the representation is authentic, the second authentication indication generated using an attestation operation and generating a modified representation including the representation, the first authentication indication, and the second authentication indication.