DIGITAL ASSET TRACEABILITY AND ASSURANCE USING A DISTRIBUTED LEDGER

• US 20190065709A1
• Filed: 01/08/2018
• Published: 02/28/2019
• Est. Priority Date: 08/24/2017
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Salomon, Roberto
• Granted Patent: US 10,795,977 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 8/40 Transformation of program code
• CPC Class Codes: G06F 8/41 Compilation
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

Various embodiments provide an apparatus, method, system, and/or instructions by which source code can be linked to a compiled binary, guaranteeing the origin of the binary and ensuring traceability of the binary file back to the source code that originated it. An example method includes determining a request to register a digital asset; computing a first hash of an initial source file of the digital asset; ascertaining a version of the initial source file; electing one or more nodes of a blockchain to commit the first hash to the blockchain in association with a version of the digital asset corresponding to the version of the initial source file; converting the source file into a binary file, resulting in a binary version of the digital asset; computing a second hash of the binary file; and committing the second hash to the blockchain in association with the version of the digital asset.

Claims

1. One or more tangible media including logic for execution by one or more processors and when executed operable for facilitating digital asset traceability in a networked computing environment, the method comprising:

determining a request to register a digital asset in the networked computing environment;

computing a first hash of an initial source file of the digital asset;

ascertaining a version of the initial source file;

electing one or more nodes of a distributed ledger of the networked computing environment to commit the first hash to the distributed ledger in association with a version of the digital asset corresponding to the version of the initial source file;

converting the source file into a binary file, resulting in a binary version of the digital asset;

computing a second hash, wherein the second hash is of the binary file; and

committing the second hash to the distributed ledger in association with the version of the digital asset.

2. The one or more tangible storage media of claim 1, further including:

using version information associated with the second hash and version information associated with the first hash to associate one or more binary file hashes in the distributed ledger with one or more source files in a source file repository, a workstation from which the source file originated, and a developer of the source file, wherein the distributed ledger includes a blockchain, and wherein the digital asset includes software.

3. The one or more tangible storage media of claim 2, further including:

selectively making the binary file available to one or more client devices and associated one or more respective authenticated and permissioned users of the networked computing environment, in accordance with one or more permissions allocated to the one or more authenticated and permissioned users, wherein the one or more client devices include one or more computers of one or more customers of one or more cloud services provided in the networked computing environment.

4. The one or more tangible storage media of claim 3, further including:

selectively making data in the blockchain accessible to the one or more client devices and accompanying one or more respective authenticated and permissioned users, whereby the one or more respective authenticated and permissioned users can compare a registered hash for the binary file in the blockchain with an obtained binary file.

5. The one or more tangible storage media of claim 4, further including:

using Public Key Infrastructure (PKI) to authenticate user permissions to access data in the blockchain.

6. The one or more tangible storage media of claim 2, wherein electing further includes:

selecting, in accordance with a proof-of-stake mechanism, one or more nodes of the networked computing environment to implement committing the first hash, and for committing the second hash, to the blockchain, wherein the proof-of-stake mechanism implements the following steps;

referencing identifying information and associated permissions of the one or more nodes, to confirm that the one or more nodes are permissioned to commit one or more blocks to the blockchain, resulting in a set of one or more confirmed nodes;

determining which of the one or more confirmed nodes first received a source file or binary file;

selecting a node from among the one or more confirmed nodes to perform a calculation to commit a registration entry to the blockchain, resulting in a selected node; and

using the selected node to commit the registration entry to the blockchain in combination with an indicator of the selected node that commits the registration entry to the blockchain as a block, whereby the block includes the indicator.

7. The one or more tangible storage media of claim 6, further including:

submitting the binary file to a production server;

storing the source file in a source code repository that is accessible to one or more quality control mechanism; and

storing the binary file in a binary code repository.

8. The one or more tangible storage media of claim 7, further including:

updating the blockchain with updated source file registration information in response to detection that a new version of the source file, called the updated source file, is loaded into the source code repository, wherein the updated source file registration information includes information linking the updated source file with the initial source file; and

updating the blockchain with updated binary registration information in response to detection that the updated source file version of the initial source file has been compiled into a new binary file.

9. The one or more tangible storage media of claim 1, wherein the request to register a digital asset originates from a computer with which the source file was developed or from which it was submitted, and wherein the first hash is computed using a first hash function that receives, as input, a digital fingerprint of the source file, a user IDentification (ID), a Central Processing Unit (CPU) ID, and a Media Access Control (MAC) address, all associated with or characterizing the computer.

10. The one or more tangible storage media of claim 9, wherein the first hash is accessible to one or more software quality control servers, and further including:

using the one or more quality control servers to selectively register, in the distributed ledger, the first hash in association with source file version information.

11. A method for facilitating digital asset traceability in a networked computing environment comprising the following acts:

determining a request to register a digital asset in the networked computing environment;

computing a first hash of an initial source file of the digital asset;

ascertaining a version of the initial source file;

electing one or more nodes of a distributed ledger of the networked computing environment to commit the first hash to the distributed ledger in association with a version of the digital asset corresponding to the version of the initial source file;

converting the source file into a binary file, resulting in a binary version of the digital asset;

computing a second hash, wherein the second hash is of the binary file; and

committing the second hash to the distributed ledger in association with the version of the digital asset.

12. The method of claim 11, further including:

using version information associated with the second hash and version information associated with the first hash to associate one or more binary file hashes in the distributed ledger with one or more source files in a source file repository, a workstation from which the source file originated, and a developer of the source file, wherein the distributed ledger includes a blockchain, and wherein the digital asset includes software.

13. The method of claim 12, further including:

selectively making the binary file available to one or more client devices and associated one or more respective authenticated and permissioned users of the networked computing environment, in accordance with one or more permissions allocated to the one or more authenticated and permissioned users, wherein the one or more client devices include one or more computers of one or more customers of one or more cloud services provided in the networked computing environment.

14. The method of claim 13, further including:

selectively making data in the blockchain accessible to the one or more client devices and accompanying one or more respective authenticated and permissioned users, whereby the one or more respective authenticated and permissioned users can compare a registered hash for the binary file in the blockchain with an obtained binary file.

15. The method of claim 14, further including:

using Public Key Infrastructure (PKI) to authenticate user permissions to access data in the blockchain.

16. The method of claim 12, wherein electing further includes:

selecting, in accordance with a proof-of-stake mechanism, one or more nodes of the networked computing environment to implement committing the first hash, and for committing the second hash, to the blockchain, wherein the proof-of-stake mechanism implements the following steps;

referencing identifying information and associated permissions of the one or more nodes, to confirm that the one or more nodes are permissioned to commit one or more blocks to the blockchain, resulting in a set of one or more confirmed nodes;

determining which of the one or more confirmed nodes first received a source file or binary file;

selecting a node from among the one or more confirmed nodes to perform a calculation to commit a registration entry to the blockchain, resulting in a selected node; and

using the selected node to commit the registration entry to the blockchain in combination with an indicator of the selected node that commits the registration entry to the blockchain as a block, whereby the block includes the indicator.

17. The method of claim 16, further including:

submitting the binary file to a production server;

storing the source file in a source code repository that is accessible to one or more quality control mechanism; and

storing the binary file in a binary code repository.

18. The method of claim 17, further including:

updating the blockchain with updated source file registration information in response to detection that a new version of the source file, called the updated source file, is loaded into the source code repository, wherein the updated source file registration information includes information linking the updated source file with the initial source file; and

updating the blockchain with updated binary registration information in response to detection that the updated source file version of the initial source file has been compiled into a new binary file.

19. The method of claim 11, wherein the request to register a digital asset originates from a computer with which the source file was developed or from which it was submitted, and wherein the first hash is implemented by a hash function that receives, as input, a digital fingerprint of the source file, a user IDentification (ID), a Central Processing Unit (CPU) ID, and a Media Access Control (MAC) address, all associated with or characterizing the computer, and wherein the first hash is accessible to one or more software quality control servers, and further including:

using the one or more quality control servers to selectively register, in the distributed ledger, the first hash in association with source file version information.

20. An apparatus comprising:

one or more processors;

logic encoded in one or more tangible media for execution by the one or more processors and when executed operable for;

determining a request to register a digital asset in a networked computing environment;

computing a first hash of an initial source file of the digital asset;

ascertaining a version of the initial source file;

electing one or more nodes of a distributed ledger of the networked computing environment to commit the first hash to the distributed ledger in association with a version of the digital asset corresponding to the version of the initial source file;

converting the source file into a binary file, resulting in a binary version of the digital asset;

computing a second hash, wherein the second hash is of the binary file; and

committing the second hash to the distributed ledger in association with the version of the digital asset.