Software Object Authenticity Verification via Composite Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods, such as digitally signed software, are insufficient in verifying the identity and authenticity of software objects within the supply chain for bulk electric systems, as they fail to prevent or detect software vulnerabilities, potentially leading to malicious installations that could compromise critical infrastructure.
Innovation Solution
A computer-implemented method using both cryptographic and non-cryptographic techniques to verify the integrity and authenticity of software objects and their supply chains, producing a trustworthiness score and a tamperproof record, which facilitates the reporting of potential cyber incidents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If digitally signed software is used to verify software identity, then the verification process is simplified, but it fails to detect software vulnerabilities and malicious modifications
Solution Approach 1:
The verification process is segmented into multiple independent checks: digital signature verification, hash value comparison, and vulnerability scanning. Each segment addresses a specific aspect of software authenticity and integrity, collectively providing comprehensive verification that overcomes the limitations of any single method.
Solution Approach 2:
The patent combines multiple verification methods (digital signatures, hash values, vulnerability scans) into a composite verification system. This composite approach integrates the strengths of different techniques while compensating for their individual weaknesses, resulting in a more reliable overall verification process.
2Reliability
If comprehensive verification methods including vulnerability assessments are implemented, then software trustworthiness is improved, but the complexity of the verification process increases
Solution Approach 1:
Vulnerability assessments and integrity checks are performed preliminarily before software installation. By conducting comprehensive verification in advance, the system ensures software trustworthiness while allowing the actual installation process to remain simple and straightforward.
Solution Approach 2:
The patent introduces an intermediary verification system that acts as a gateway between software distribution and installation. This intermediary layer handles the complex verification tasks, separating them from the installation process and presenting a simplified interface to end users.
Data Source
AI summary
A computer-implemented method includes determining, by a processor, an authenticity of a software object and its supply chain and providing an authenticity result indicative thereof; determining, by the processor, an integrity of the software object and its supply chain and providing an integrity result indicative thereof; and determining, by the processor, from the authenticity result and the integrity result, a score indicative of an amount of trust in the supply chain of the software object and in the software object, wherein the score is indicative of an amount of trust that the software object will work correctly if installed in a system that utilizes the software object.