Object File Signatures for Build Provenance Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in establishing the provenance of object files used to create executable files, particularly in the context of supply chain attacks where malicious software can be injected, compromising system security.
Innovation Solution
A processing device tracks the provenance of object files by generating a signature based on their content and attaching it to the files, using signing keys to verify their authenticity, ensuring they are created with trusted tools in a trusted environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic signatures are implemented to verify object file authenticity, then system security is improved, but build process complexity increases
Solution Approach 1:
The patent applies preliminary action by generating cryptographic signatures for object files during the build process before deployment. The signing operation is performed in advance on object files using a private key, creating a signature that is attached to or stored alongside the object file. This allows verification of object file authenticity and integrity before the files are used in the executable, preventing supply chain attacks while maintaining a systematic build process.
2Measurement precision
If provenance tracking is implemented for object files, then detection of tampered files is improved, but processing time increases
Solution Approach 1:
The patent performs the time-consuming cryptographic signature generation during the build process in advance, rather than during verification. The signature is created once when the object file is produced, and subsequent verification operations only need to perform relatively fast signature validation. This preliminary action ensures high detection precision for tampered files while minimizing the time loss during actual verification.
Solution Approach 2:
The patent creates a cryptographic copy or representation of the object file's content through hashing and signing. Instead of storing or transmitting the entire object file for verification purposes, a compact cryptographic signature is generated that serves as a verified copy of the file's integrity. This copying mechanism enables fast verification without processing the full object file content during detection operations.
3Reliability
If signature verification is performed on all object files, then integrity assurance is improved, but build process duration increases
Solution Approach 1:
The patent implements preliminary action by signing object files during their creation in the build process. Rather than verifying signatures on all object files after the build is complete or during each link operation, the signature verification is integrated into the build flow at the point of object file generation. This ensures integrity assurance is built-in from the start, and the verification overhead is distributed throughout the build process rather than adding a separate verification phase.
Data Source
AI summary
Aspects of the present disclosure relate to the tracking of provenance of object files used to create executable files. More specifically, a method of the present disclosure includes receiving, at a computing device, a source file and a signing key as input to generate an object file. The method includes generating the object file based on the source file and the signing key. The method includes generating a signature based on content of the object file. The method includes attaching the signature to the object file.