Source Code Trustworthiness via Multi-Developer Signing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods cannot ensure the trustworthiness of software source code throughout the process from creation to executable code generation, as untrustworthy changes can be introduced by unauthorized parties between the completion of source code and the generation of executable programs.
Innovation Solution
A method involving at least two software developers who register and use private signature keys to sign the source code, with the signed code stored in a secure infrastructure, where a compiling device verifies and translates it into executable binary code, which is then signed and exported, ensuring the trustworthiness of the source code and binary code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If source code is created and stored without continuous verification, then development efficiency is improved, but trustworthiness deteriorates due to potential unauthorized changes
Solution Approach 1:
The patent applies preliminary action by requiring developers to sign source code with their private keys before storage, and by having the compiling device verify signatures before translation. This advance verification ensures trustworthiness is established prior to any potential unauthorized changes, while maintaining efficient development workflows.
Solution Approach 2:
The patent implements feedback mechanisms where the compiling device continuously verifies the trustworthiness of source code through cryptographic signature validation before translation. This feedback loop ensures that only trusted code is compiled, maintaining reliability without hindering productivity.
2Reliability
If multiple developers sign source code to ensure trustworthiness, then reliability is improved, but device complexity increases due to additional verification steps
Solution Approach 1:
The patent applies self-service by enabling developers to autonomously sign their own source code with their personal private keys, and by having the compiling device automatically verify these signatures. This eliminates the need for complex manual verification processes while maintaining high reliability through cryptographic authentication.
Solution Approach 2:
The patent replaces manual verification mechanisms with automated cryptographic signature verification. The compiling device automatically checks digital signatures before translation, eliminating complex mechanical verification processes and reducing operational complexity while enhancing trustworthiness.
3Reliability
If source code is verified at multiple stages, then trustworthiness is improved, but loss of time increases due to additional checking steps
Solution Approach 1:
The patent applies preliminary action by performing cryptographic signature verification during the source code creation and storage phases, rather than only during compilation. This advance verification ensures trustworthiness is established early, reducing the time needed for subsequent verification steps.
Solution Approach 2:
The patent enables developers to self-verify their own code through automatic digital signing, eliminating the need for lengthy manual review processes. The compiling device automatically validates signatures, reducing verification time while maintaining high reliability.
Data Source
AI summary
A method for ensuring the trustworthiness of software source code (source code) is provided, wherein two software developers sign the source code produced by said software developers. A compiling device checks, on the basis of the public signature keys of the software developers, whether the source code is trustworthy and produces a binary code from the source code. The produced binary code is signed by the compiling device, and the signed binary code together with the public signature key of the compiling device is made available for further use. The signed binary code is therefore likewise trustworthy.