Software Provenance Tracking via External Marketplace Verification

The patent introduces a marketplace infrastructure as an intermediary that hosts and verifies product codes externally. Instead of storing product codes within the VM images where they can be tampered with, the system uses the marketplace server as a trusted mediator to validate ownership. The VM images reference product codes stored on the marketplace infrastructure, which performs verification without requiring the codes to be embedded in the images themselves.

The patent replaces the mechanical/embedded approach (storing product codes directly in VM images) with a service-based verification system. The marketplace infrastructure provides a remote verification service that checks ownership claims without relying on embedded credentials that could be extracted or modified. This substitution moves the trust model from embedded authentication to service-based validation.

The patent implements preliminary action by requiring developers to declare the product codes of original VM images before creating derivative works. The marketplace infrastructure pre-records these relationships in a provenance database, establishing the ownership chain before any potential disputes arise. This proactive declaration system simplifies later verification and compensation calculations compared to attempting to track modifications retroactively.

The system implements feedback mechanisms where the marketplace infrastructure continuously monitors and verifies provenance relationships. When derivative works are submitted, the system automatically checks against the recorded provenance data and provides feedback on compensation requirements. This continuous verification loop ensures that provenance tracking remains accurate and that compensation can be automatically calculated based on the chain of derivative works.

The marketplace infrastructure acts as a trusted intermediary that performs ownership verification independently of the VM image contents. Instead of relying on embedded product codes that can be obscured or removed, the system uses the marketplace server to validate ownership claims against externally stored records. This intermediary approach maintains measurement precision while eliminating the vulnerability to embedding-related attacks.

The patent moves the product code storage from the VM image dimension to the marketplace infrastructure dimension. By externalizing the authentication data to a separate, controlled environment, the system creates a new dimension of security where verification occurs outside the potentially compromised VM image space. This dimensional separation prevents obfuscation attempts within the image from affecting ownership verification.