Source authentication of a software product

• US 10,558,816 B2
• Filed: 04/03/2018
• Issued: 02/11/2020
• Est. Priority Date: 07/17/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bhat, Badekila Ganesh Prashanth, Gokavarapu, Nageswararao V., Kurian, John, Srinivasan, Raghavendran
• Primary Examiner(s): Kabir, Jahangir
• Assistant Examiner(s): Wilcox, James J
• Application Number:
  US15/943,860
• Publication Number:
  US 20180225470A1
• Time in Patent Office: 679 Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

Embodiments of the present invention provide systems and methods for authenticating the source code of a software end product. The method includes generating a compound key, which is composed of a set of unique keys generated from a source file. A set of files are separately build based on a received source code, and a key generated and embedded into the files at the time of the build. A validation tool is used to compare the values of the generated compound key to the values of the embedded key to determine if the values match.

Claims

1. A method comprising:

preventing, by one or more processors, installation of unauthorized source code based on a generated compound key, wherein preventing installation of unauthorized source code comprises;

generating, by a key generator, a compound key comprising at least one source file, a hash function run on the at least one source file, and a file size of the at least one source file;

in response to determining a source type during the build process, injecting, by one or more processors, a generated value based on the compound key into each file of a built set of files;

validating, by a key validation tool, the generated value against the compound key by comparing the compound key and the generated value to determine the generated value is equivalent to the compound key before loading the built set of files into a central repository;

in response to determining the compound key and the generated value match producing, by one or more processors, a final product, wherein the final product comprises;

the key validation tool and the generated compound key and installing source code associated with the generated compound key;

in response to determining the compound key and the generated value do not match, uninstalling source code associated with the generated compound key;

determining, by one or more processors, whether there is a difference between the compound key and the generated value;

in response to determining that there is not a difference between the compound key and the value, loading the final product to a repository; and

dynamically updating the compound key in response to a modification of a source file in the built set of files.

2. The method of claim 1, further comprising:

extracting, by one or more processors, source code having at least one source file having at least one reserved field.

3. The method of claim 2, further comprising:

building, by one or more processors, a set of files, based on the source code from the at least one source file.

4. The method of claim 1, wherein comparing, by the key validation tool, the compound key and the value to determine if said compound key is equivalent to said value comprises:

scanning, by the key validation tool, the compound key;

for a compound key entry, searching, by the key validation tool, the set of files for an entry which matches the entry in the compound key; and

responsive to detecting an entry in the set of files which matches the entry in the compound key, comparing a value associated with the entry in the set of files to a value associated with the entry in the compound key, to determine if the value associated with the entry in the set of files is equivalent to the value associated with the entry in the compound key.

5. The method of claim 1, further comprising:

inserting, by the key generator, into the set of files, the generated value associated with each file of the set of files.

6. The method of claim 1, wherein extracting, by one or more processors, source code having at least one source file having at least one reserved field comprises:

adding, by a manager, a row to the compound key, wherein the row comprises;

a source path; and

information associated with the at least one source file.

7. The method of claim 1, further comprising:

receiving, by a manager, the source code from the at least one source file; and

generating, by the manager, a unique key for the at least one source file, wherein the unique key comprises information associated with the at least one source file.

8. A computer program product comprising:

one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising;

program instructions to prevent installation of unauthorized source code based on a generated compound key, wherein the program instructions to prevent installation of unauthorized source code comprise;

program instructions to generate by a key generator, a compound key comprising at least one source file, a hash function run on the at least one source file, and a file size of the at least one source file;

program instructions to in response to determining a source type during the build process, inject a generated value based on the compound key into each file of a built set of files;

program instructions to validate, by a key validation tool, the generated value against the compound key by comparing the compound key and the generated value to determine the generated value is equivalent to the compound key before loading the built set of files into a central repository;

program instructions to, in response to determining the compound and the generated value match, produce a final product, wherein the final product comprises;

the key validation tool and the generated compound key and install source code associated with the generated compound key;

program instructions to, in response to determining the compound key and the generated value do not match, uninstall source code associated with the generated compound key;

program instructions to determine whether there is a difference between the compound key and the generated value;

program instructions to, in response to determining that there is not a difference between the compound key and the value, load the final product to a repository, and

program instructions to dynamically update the compound key in response to a modification of a source file in the built set of files.

9. The computer program product of claim 8, wherein the program instructions stored on the one or more computer readable storage media further comprise:

program instructions to extract source code having at least one source file having at least one reserved field.

10. The computer program product of claim 9, wherein the program instructions stored on the one or more computer readable storage media further comprise:

program instructions to build a set of files, based on the source code from the at least one source file.

11. The computer program product of claim 8, wherein the program instructions to compare, by the key validation tool, the compound key and the value to determine if said compound key is equivalent to said value comprises:

program instructions to scan, by the key validation tool, the compound key;

program instructions to for a compound key entry, search, by the key validation tool, the set of files for an entry which matches the entry in the compound key; and

program instructions to, responsive to detecting an entry in the set of files which matches the entry in the compound key, compare a value associated with the entry in the set of files to a value associated with the entry in the compound key, to determine if the value associated with the entry in the set of files is equivalent to the value associated with the entry in the compound key.

12. The computer program product of claim 8, wherein the program instructions stored on the one or more computer readable storage media further comprise:

program instructions to insert, by the key generator, into the set of files, the generated value associated with each file of the set of files.

13. The computer program product of claim 8, wherein the program instructions to extract source code having at least one source file having at least one reserved field comprise:

program instructions to add, by a manager, a row to the compound key, wherein the row comprises;

a source path; and

information associated with the at least one source file.

14. The computer program product of claim 8, wherein the program instructions stored on the one or more computer readable storage media further comprise:

program instructions to receiving, by a manager, the source code from the at least one source file; and

program instructions to generating, by the manager, a unique key for the at least one source file, wherein the unique key comprises information associated with the at least one source file.

15. A computer system comprising:

one or more computer processors;

one or more computer readable storage media; and

program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising;

program instructions to prevent installation of unauthorized source code based on a generated compound key, wherein the program instructions to prevent installation of unauthorized source code comprise;

program instructions to generate by a key generator, a compound key comprising at least one source file, a hash function run on the at least one source file, and a file size of the at least one source file;

program instructions to inject a generated value based on the compound key into each file of a built set of files;

program instructions to validate, by a key validation tool, the generated value against the compound key by comparing the compound key and the generated value to determine the generated value is equivalent to the compound key before loading the built set of files into a central repository;

program instructions to, in response to determining the compound and the generated value match, produce a final product, wherein the final product comprises;

the key validation tool and the generated compound key and install source code associated with the generated compound key;

program instructions to, in response to determining the compound key and the generated value do not match, uninstall source code associated with the generated compound key;

program instructions to determine whether there is a difference between the compound key and the generated value;

program instructions to, in response to determining that there is not a difference between the compound key and the value, load the final product to a repository, and

program instructions to dynamically update the compound key in response to a modification of a source file in the built set of files.

16. The computer system of claim 15, wherein the program instructions stored on the one or more computer readable storage media further comprise:

program instructions to extract source code having at least one source file having at least one reserved field.

17. The computer system of claim 16, wherein the program instructions stored on the one or more computer readable storage media further comprise:

program instructions to build a set of files, based on the source code from the at least one source file.

18. The computer system of claim 15, wherein the program instructions to compare, by the key validation tool, the compound key and the value to determine if said compound key is equivalent to said value comprises:

program instructions to scan, by the key validation tool, the compound key;

program instructions to for a compound key entry, search, by the key validation tool, the set of files for an entry which matches the entry in the compound key; and

program instructions to, responsive to detecting an entry in the set of files which matches the entry in the compound key, compare a value associated with the entry in the set of files to a value associated with the entry in the compound key, to determine if the value associated with the entry in the set of files is equivalent to the value associated with the entry in the compound key.

19. The computer system of claim 15, wherein the program instructions stored on the one or more computer readable storage media further comprise:

program instructions to insert, by the key generator, into the set of files, the generated value associated with each file of the set of files.

20. The computer system of claim 15, wherein the program instructions to extract source code having at least one source file having at least one reserved field comprise:

program instructions to add, by a manager, a row to the compound key, wherein the row comprises;

a source path; and

information associated with the at least one source file.