Object File Signatures for Trusted Executable Linking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in establishing the provenance of object files used to create executable files, particularly in the context of supply chain attacks where malicious software can be injected, compromising system security.
Innovation Solution
A processing device generates object files based on source files and signing keys, computes signatures, and attaches them to track the provenance of these files, ensuring they are created using trusted tools and environments, with verification using verification keys stored in a database.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic signatures are implemented to track object file provenance, then system security is improved, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by generating cryptographic signatures during the object file creation process itself, rather than attempting to verify provenance after the fact. The signature is embedded into the object file at compile time, establishing trust before the file enters the supply chain. This prevents the need for complex runtime verification systems.
Solution Approach 2:
The patent introduces cryptographic signatures as an intermediary mechanism that mediates between the compiler and the verification system. Instead of directly tracking and verifying every object file attribute, the signature acts as a trusted intermediary that encapsulates provenance information, simplifying the verification process to a single signature check.
2Manufacturing precision
If signature verification is performed on all object files during linking, then manufacturing precision of executable files is improved, but productivity decreases
Solution Approach 1:
The verification of object file provenance is performed as a preliminary action during the linking stage, before the executable is finalized. The linker checks signatures of all input object files and either succeeds or fails the entire link operation, avoiding repeated verification cycles and enabling fast failure when invalid files are detected.
Solution Approach 2:
The patent uses cryptographic hash functions to create compact signature copies of the original object file contents. Instead of verifying the entire object file data repeatedly, the system verifies a small signature copy that represents the full provenance information, dramatically reducing verification overhead.
3Object-affected harmful factors
If provenance tracking is implemented to detect unauthorized object files, then object-affected harmful factors are reduced, but measurement precision requirements increase
Solution Approach 1:
The patent replaces manual or heuristic methods of detecting malicious code with cryptographic verification. Instead of relying on pattern matching or security heuristics that require complex analysis, the system uses mathematical cryptography to provide deterministic verification of object file authenticity, achieving high precision through well-established cryptographic principles.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Aspects of the present disclosure relate to the tracking of provenance of object files used to create executable files. More specifically, a method of the present disclosure includes receiving, at a computing device, a source file and a signing key as input to generate an object file. The method includes generating the object file based on the source file and the signing key. The method includes generating a signature based on content of the object file. The method includes attaching the signature to the object file.