Compiler Hash Verification for Source Code Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Nefarious parties exploit the separation between source code repositories and build machines to compromise the compilation process, allowing malicious modifications to software without detection, compromising application integrity.
Innovation Solution
A code integrity preserving compiler verifies source code integrity by generating and comparing hashes in volatile memory, ensuring that the source code loaded into the build machine matches the original, thereby preventing unauthorized changes during compilation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If source code is downloaded from a remote repository to a build machine for compilation, then the compilation process can be performed, but the source code may be compromised or modified by nefarious parties during transfer or storage
Solution Approach 1:
The patent applies preliminary action by computing and storing hash values of the source code at the repository before transfer. The build machine then verifies the downloaded source code against these pre-computed hashes, preventing malicious modifications before compilation occurs.
Solution Approach 2:
The patent implements feedback by continuously verifying source code integrity through hash comparison during the build process. If the computed hash does not match the stored hash, the build system detects the modification and can halt the compilation, providing immediate feedback on code tampering.
2Productivity
If source code is stored in volatile memory during compilation, then the compilation speed improves, but the source code becomes more vulnerable to unauthorized access and modification
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing hash values of source code segments before they are loaded into volatile memory. This allows rapid verification upon loading without sacrificing compilation speed, as the verification process is already prepared and can be performed efficiently.
Solution Approach 2:
The patent introduces hash values as an intermediary mechanism that bridges the speed advantage of volatile memory with the security requirements. The hash verification acts as a mediator that can quickly validate source code integrity without requiring the source code itself to remain secure in volatile memory throughout the entire compilation process.
3Reliability
If hash verification is performed on the entire source code, then complete integrity is ensured, but the verification time and computational resources increase
Solution Approach 1:
The patent applies segmentation by dividing the source code into multiple segments and computing separate hash values for each segment. This allows selective verification of only the segments that have been modified or are currently being compiled, rather than requiring verification of the entire source code base, thereby reducing verification time while maintaining integrity assurance.
Solution Approach 2:
The patent implements partial action by performing hash verification only on the specific source code segments that are being compiled or have changed, rather than verifying the entire source code repository. This partial verification approach maintains sufficient integrity checks while significantly reducing the time and computational resources required compared to full-source verification.
Data Source
AI summary
Systems and techniques are provided for compiling source code. For instance a process can include: obtaining, from a source code repository, a first overall hash of a first hash of a first portion of source code; generating a second overall hash of the first hash of the first portion of source code; verifying the first overall hash based on a determination that the first overall hash is equal to the second overall hash; obtaining, from the source code repository, the first portion of source code; loading the first portion of source code into a volatile memory system; generating a second hash of the first portion of source code in the volatile memory system; verifying the first portion of source code based on a determination that the first hash is equal to the second hash; and compiling the first portion of source code.