File origin determination

• US 10,068,067 B2
• Filed: 08/03/2017
• Issued: 09/04/2018
• Est. Priority Date: 07/27/2015
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Childress, Rhonda L., Spisak, Michael J., Stark, George E.
• Primary Examiner(s): Zhao, Don G
• Application Number:
  US15/667,803
• Publication Number:
  US 20170357781A1
• Time in Patent Office: 397 Days
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/107 License processing; Key processing

Abstract

A file validation method and system is provided. The method includes retrieving from an authoritative source system, an artifact file. Identification information identifying a requesting user of the artifact file is recorded and associated metadata and a modified artifact file comprising the metadata combined with the artifact file are generated. An encryption key including a first portion and a second portion is generated and the first portion is stored within a central key store database. An encrypted package comprising the modified artifact file and the second portion of the key is generated.

Claims

1. A file validation method comprising:

requesting, by a computer processor of a computing system executing an agent in response to a request, a detachable fetch software module;

retrieving, by said computer processor, said detachable fetch software module;

downloading, by said computer processor executing said detachable fetch software module, an artifact file;

generating, by said computer processor executing said detachable fetch software module, a digital fingerprint associated with securing said artifact file; and

generating, by said computer processor, metadata describing identification information identifying a requesting user of said artifact file, wherein said metadata comprises attributes including an IP address for said computing system and an identifier for a network receiving said artifact file;

encrypting, by said computer processor based on results of said executing, said metadata resulting in encrypted metadata;

generating, by said computer processor, a log indicating that said encrypted metadata has been successfully generated;

generating, by said computer processor, a modified artifact file comprising said encrypted metadata combined with said artifact file and said log;

validating, by said computer processor, that said modified artifact file is in compliance with a licensing agreement for execution of said artifact file resulting in the generation of a portable binary for execution; and

generating, by said computer processor, an encrypted package comprising said modified artifact file and a portion of an encryption key.

2. The method of claim 1, wherein said detachable fetch software module comprises a single use only software module.

3. The method of claim 1, further comprising:

receiving, by said computer processor from said user, a request for distribution of said encrypted package;

determining, by said computer processor, that said user is authorized to access said encrypted package; and

retrieving, by said computer processor in response to results of said determining, a first portion of said encryption key from said central key store database.

4. The method of claim 3, further comprising:

receiving, by said computer processor from said user, a request for installing said artifact file;

combining, by said computer processor, said first portion of said encryption key with said second portion of said encryption key comprised by said package;

decrypting, by said computer processor in response to results of said combining, said encrypted package resulting in a decrypted package comprising said modified artifact file;

installing, by said computer processor, said artifact file into an external computing system; and

storing, by said computer processor as a hidden file, said metadata with said installed artifact file.

5. The method of claim 4, further comprising:

validating, by said computer processor based on said metadata, an origin of said artifact file, wherein said validating comprises running said encryption key through said central key store database to retrieve said origin via said metadata.

6. The method of claim 1, wherein said information comprises data selected from the group consisting of a URL associated with a browser said computing system, an identification for said user, and a subnet used to perform said retrieving.

7. The method of claim 1, wherein said identification information comprises a name of said requesting user, an email address of said requesting user, and employee related information associated with said requesting user.

8. The method of claim 1, wherein data associated with said artifact file comprises an IP address of said authoritative source system, a date and time of requesting said artifact file, and a file size of said artifact file.

9. The method of claim 1, wherein data associated with said computing system comprises an IP address of a destination system for said artifact file and a subnet associated with said artifact file.

10. The method of claim 1, further comprising:

providing at least one support service for at least one of creating, integrating, hosting, maintaining, and deploying computer-readable code in the computing system, said code being executed by the computer processor to implement said requesting, said retrieving, said downloading, said generating, said metadata, said generating said digital fingerprint, said generating said metadata, said encrypting, said generating said log, said generating said modified artifact file, said validating, and said generating said encrypted package.

11. A computer program product, comprising a computer readable hardware storage device storing a computer readable program code, said computer readable program code comprising an algorithm that when executed by a computer processor of a computing system implements a file validation method, said method comprising:

requesting, by said computer processor executing an agent in response to a request, a detachable fetch software module;

retrieving, by said computer processor, said detachable fetch software module;

downloading, by said computer processor executing said detachable fetch software module, an artifact file;

generating, by said computer processor executing said detachable fetch software module, a digital fingerprint associated with securing said artifact file; and

generating, by said computer processor, metadata describing identification information identifying a requesting user of said artifact file, wherein said metadata comprises attributes including an IP address for said computing system and an identifier for a network receiving said artifact file;

encrypting, by said computer processor based on results of said executing, said metadata resulting in encrypted metadata;

generating, by said computer processor, a log indicating that said encrypted metadata has been successfully generated;

generating, by said computer processor, a modified artifact file comprising said encrypted metadata combined with said artifact file and said log;

validating, by said computer processor, that said modified artifact file is in compliance with a licensing agreement for execution of said artifact file resulting in the generation of a portable binary for execution; and

generating, by said computer processor, an encrypted package comprising said modified artifact file and a portion of an encryption key.

12. The computer program product of claim 11, wherein said detachable fetch software module comprises a single use only software module.

13. The computer program product of claim 11, wherein said method further comprises:

receiving, by said computer processor from said user, a request for distribution of said encrypted package;

determining, by said computer processor, that said user is authorized to access said encrypted package; and

retrieving, by said computer processor in response to results of said determining, a first portion of said encryption key from said central key store database.

14. The computer program product of claim 13, wherein said method further comprises:

receiving, by said computer processor from said user, a request for installing said artifact file;

combining, by said computer processor, said first portion of said encryption key with said second portion of said encryption key comprised by said package;

decrypting, by said computer processor in response to results of said combining, said encrypted package resulting in a decrypted package comprising said modified artifact file;

installing, by said computer processor, said artifact file into an external computing system; and

storing, by said computer processor as a hidden file, said metadata with said installed artifact file.

15. The computer program product of claim 14, wherein said method further comprises:

validating, by said computer processor based on said metadata, an origin of said artifact file, wherein said validating comprises running said encryption key through said central key store database to retrieve said origin via said metadata.

16. The computer program product of claim 11, wherein said information comprises data selected from the group consisting of a URL associated with a browser said computing system, an identification for said user, and a subnet used to perform said retrieving.

17. The computer program product of claim 11, wherein said identification information comprises a name of said requesting user, an email address of said requesting user, and employee related information associated with said requesting user.

18. The computer program product of claim 11, wherein data associated with said artifact file comprises an IP address of said authoritative source system, a date and time of requesting said artifact file, and a file size of said artifact file.

19. The computer program product of claim 11, wherein data associated with said computing system comprises an IP address of a destination system for said artifact file and a subnet associated with said artifact file.

20. A computing system comprising a computer processor coupled to a computer-readable memory unit, said memory unit comprising instructions that when executed by the computer processor implements a file validation method comprising:

requesting, by said computer processor executing an agent in response to a request, a detachable fetch software module;

retrieving, by said computer processor, said detachable fetch software module;

downloading, by said computer processor executing said detachable fetch software module, an artifact file;

generating, by said computer processor executing said detachable fetch software module, a digital fingerprint associated with securing said artifact file; and

generating, by said computer processor, metadata describing identification information identifying a requesting user of said artifact file, wherein said metadata comprises attributes including an IP address for said computing system and an identifier for a network receiving said artifact file;

encrypting, by said computer processor based on results of said executing, said metadata resulting in encrypted metadata;

generating, by said computer processor, a log indicating that said encrypted metadata has been successfully generated;

generating, by said computer processor, a modified artifact file comprising said encrypted metadata combined with said artifact file and said log;

validating, by said computer processor, that said modified artifact file is in compliance with a licensing agreement for execution of said artifact file resulting in the generation of a portable binary for execution; and

generating, by said computer processor, an encrypted package comprising said modified artifact file and a portion of an encryption key.