Build Server Source File Corruption Detection via Partition Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware can corrupt executable programs built by a build server by adding or modifying source files, making it difficult to detect and leading to unauthorized access or malicious actions across a large number of electronic devices, especially in computing environments where verification systems are overwhelmed by noise from the entire OS file system.
Innovation Solution
A verification system that copies source files to a separate storage partition, computes and compares measurements using an integrity measurement engine, and utilizes a trusted platform module to protect the integrity log and detect corruption, ensuring the integrity of source files used for building executable programs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If verification systems measure all files in the OS file system, then comprehensive security coverage is achieved, but the verification system is overwhelmed by noise and becomes inefficient
Solution Approach 1:
The patent segments the file system into two distinct partitions: a first partition for storing source files used to build executable programs, and a second partition for other OS files. The verification system then selectively measures only files in the first partition, isolating the security verification process from the noise of the entire file system while maintaining comprehensive coverage of build-related files.
2Object-affected harmful factors
If malware adds or modifies source files to corrupt executable programs, then unauthorized access or malicious actions are enabled, but detection becomes difficult without selective verification
Solution Approach 1:
The patent implements preliminary action by computing and storing measurements of source files in the integrity log before the build process occurs. When files are added or modified in the first partition, the verification system can immediately detect these changes by comparing current measurements against the stored baseline, enabling early detection of malware-induced corruption before executable programs are built.
3Measurement precision
If the build server processes all source files without selective verification, then complete integrity checking is performed, but the verification process becomes unnecessarily complex and slow
Solution Approach 1:
The patent applies local quality by assigning different verification characteristics to different file partitions. Files in the first partition (source files for executable programs) receive rigorous integrity verification with measurements stored in the protected integrity log, while files in the second partition (other OS files) are excluded from this intensive verification process. This localized approach maintains high measurement precision where needed while reducing overall system complexity.
Data Source
AI summary
In some examples, a system receives first measurements of data items used by a build server in building an executable program, the data items copied from a data repository to a storage partition that is separate from the data repository, and the storage partition to store the data items relating to building the executable program by the build server. The system determines, based on the first measurements and according to a policy specified for the storage partition, whether a corruption of the data items used by the build server in building the executable program has occurred.