Blockchain Code-Sign Chain of Custody for PKI Certificate Expiration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional code-sign mechanisms face issues with expired public key certificates, untrustworthy timestamps, and lack of chain-of-custody, leading to integrity and validation challenges, especially when managing multiple PKI certificate chains and ensuring code integrity across different development environments.
Innovation Solution
Implementing a blockchain-based system that records code-sign events and timestamps for each stage of the development process, providing a chain-of-custody and ensuring code integrity by adding blocks to the blockchain with time indicators for each code signing event, thereby managing multiple PKI certificate chains and maintaining accurate timestamping.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional code-sign mechanisms use public key certificates for verification, then code authentication is enabled, but certificate expiration causes validation failures even when code remains legitimate
Solution Approach 1:
The patent introduces a blockchain as an intermediary layer between the code and the certificate validation mechanism. The blockchain stores immutable records of code hashes and their corresponding certificate validity periods, allowing verification of code integrity independent of current certificate status. This mediator preserves authentication reliability by decoupling code validation from time-bound certificate validity.
Solution Approach 2:
The system performs preliminary recording of code hashes and certificate validity information in the blockchain before certificate expiration occurs. This advance recording creates a permanent audit trail that can be verified later, ensuring that legitimate code signed during the certificate's valid period remains verifiable even after expiration.
2Loss of time
If conventional mechanisms rely on timestamps for code signing, then signing time is recorded, but timestamps are untrustworthy and can be manipulated
Solution Approach 1:
The patent replaces the mechanical clock-based timestamp system with a cryptographic blockchain-based time recording system. Instead of relying on system clocks that can be manipulated, the blockchain uses cryptographic hashing and distributed consensus to create tamper-proof time records, substituting a trust-based mechanical system with a mathematically secure cryptographic system.
Solution Approach 2:
The system changes the fundamental parameter of time recording from mutable system clock values to immutable blockchain transaction timestamps. By transforming the time parameter into a cryptographic hash value embedded in blockchain blocks, the system ensures that time records cannot be altered without changing the entire blockchain history, which is computationally infeasible.
3Ease of operation
If conventional code-sign mechanisms are used, then code signing is simple, but chain-of-custody cannot be established and multiple PKI certificate chains cannot be managed
Solution Approach 1:
The blockchain system serves multiple functions simultaneously: it stores code hashes, records certificate validity periods, maintains chain-of-custody information, and manages multiple PKI certificate chains. This universal ledger replaces multiple separate management systems, enabling the system to handle complex certificate chain validation while maintaining a unified, searchable record of all code signing events across different environments and certificate authorities.
Data Source
AI summary
The present disclosure is directed to systems, methods, and non-transitory computer-readable media including adding first block to a blockchain in response to signing first code by a first system and adding second block to the blockchain in response to signing second code by second system, the second code is different from the first code. The first block includes a first time indicator. The second block includes a second time indicator.