Software Release Verification via Stage Digital Signatures

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

There is no effective method to verify that a software release has successfully completed each stage of the development process, leading to potential vulnerabilities in computer systems executing unverified software.

Innovation Solution

A system that generates and shares digital signatures corresponding to each development stage of a software release, allowing node devices to verify the completion of these stages before processing the software.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If software releases are deployed without verification of development stage completion, then deployment speed is improved, but system security deteriorates due to potential vulnerabilities from unverified software

Engineering Contradiction:
Improvedeployment speedVSAvoidsystem security
Core Design Contradiction:
SpeedVSReliability

Solution Approach 1:

The patent implements preliminary verification by generating digital signatures at each development stage before deployment. These signatures are created in advance and attached to the software release, allowing the deployment system to verify completion of required stages without delaying the deployment process. The verification data is prepared beforehand, enabling fast deployment while maintaining security.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If multiple digital signatures are generated and verified for each software release, then software verification reliability is improved, but system complexity increases due to additional verification steps

Engineering Contradiction:
Improvesoftware verification reliabilityVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent uses digital signatures as simplified copies or representations of the complex verification process. Instead of implementing complex verification logic at each deployment node, the system creates compact digital signature copies that encapsulate the verification state. These signatures can be easily transmitted and verified using standard cryptographic operations, reducing system complexity while maintaining high verification reliability.

Inventive Principle:
Principle #26Copying

3Reliability

If digital signatures are generated at each development stage, then software authenticity is improved, but processing time increases due to additional signature generation and verification steps

Engineering Contradiction:
Improvesoftware authenticityVSAvoidprocessing time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

Digital signatures are generated in advance at each development stage during the build process, rather than being created at deployment time. This preliminary generation allows the actual deployment to proceed quickly, as the verification process only needs to validate pre-generated signatures. The time investment is made during development stages when processing is already occurring, minimizing impact on deployment speed.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentUS12289415B2Software release verification
Publication Date: 2025.04.29 JFROG LTD
  • US12289415B2 patent drawing
  • US12289415B2 patent drawing
  • US12289415B2 patent drawing

AI summary

The present disclosure provides a method, system, and device for verifying a software release. To illustrate, as software (e.g., one or more files or artifacts) completes one or more stages of a development process, one or more digital signatures are generated. The one or more digital signatures are generated using private keys that correspond to the stage of the development process that is completed. The one or more digital signatures, and one or more public keys corresponding to the private keys, are sent to a node device. Upon receipt of the one or more digital signatures and the public keys (e.g., as part of a software release), the node device verifies the digital signatures before processing the software.