Maintaining code integrity in a central software development system

• US 7,934,197 B2
• Filed: 12/19/2006
• Issued: 04/26/2011
• Est. Priority Date: 12/19/2006
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Thorell, Per
• Primary Examiner(s): Zhen; Wei Y
• Assistant Examiner(s): CHOW, CHIH CHING
• Application Number:
  US11/612,816
• Publication Number:
  US 20080148060A1
• Time in Patent Office: 1,589 Days
• Field of Search: 717/168, 717/174, 717/120, 707/698, 713/155, 713/176, 380/282, 726/29
• US Class Current: 717/120
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability

Abstract

A central software development system comprises a code processor and a code authenticator. The code processor converts modified free source code received by the system to program code such as executable code or bytecode. The code authenticator selectively signs the program code using an encryption key associated with one or more devices for which the program code is designed, e.g., a computer or mobile phone. The central system may also include a code scanner. The code scanner verifies the modified free source code, e.g., by scanning the modified free source code or intermediate code generated by the code processor for impermissible code patterns. The code authenticator signs the program code if the modified free source code is verified. The impermissible code patterns may correspond to at least one of proprietary, malicious or virulent code sequences.

Claims

1. A method of maintaining code integrity in a central software development system, comprising:

scanning modified free source code received by the system for impermissible code patterns by comparing at least one of the modified free source code or intermediate code generated from the modified free source code to one or more groups of regular expressions representing the impermissible code patterns, each regular expression being an ordered sequence of symbols describing or matching a set of strings according to certain syntax rules;

determining if the modified free source code or the intermediate code includes one or more of the impermissible code patterns based on whether a match occurs between the source code or the intermediate code and one or more of the regular expressions during scanning;

converting the modified free source code to program code; and

signing the program code if no impermissible code patterns are found in the modified free source code using an encryption key associated with one or more devices for which the program code is designed.

2. The method of claim 1, wherein scanning for impermissible code patterns comprises scanning at least one of the modified free source code or the intermediate code for at least one of proprietary, malicious or virulent code sequences.

3. The method of claim 1, wherein scanning the intermediate code for impermissible code patterns comprises scanning one of bytecode, an intermediate representation of the modified free source code, or an optimized version of the intermediate representation.

4. The method of claim 1, further comprising taking action against an entity that provided the modified free source code to the system responsive to one or more of the impermissible code patterns being detected.

5. The method of claim 1, wherein signing the program code if no impermissible code patterns are found in the modified free source code comprises:

selectively calculating a hash value based on the program code; and

encrypting the hash value using the encryption key.

6. The method of claim 1, wherein converting the modified free source code to the program code comprises converting the modified free source code to one of executable code or bytecode.

7. A central software development system, comprising:

a processor;

a code scanner configured to scan modified free source code received by the system for impermissible code patterns by comparing at least one of the modified free source code or intermediate code generated from the modified free source code to one or more groups of regular expressions representing the impermissible code patterns, each regular expression being an ordered sequence of symbols describing or matching a set of strings according to certain syntax rules, and determine if the modified free source code or the intermediate code includes one or more of the impermissible code patterns based on whether a match occurs between the source code or the intermediate code and one or more of the regular expressions during scanning;

a code processor configured to convert modified free source code received by the system to program code; and

a code authenticator configured to sign the program code if no impermissible code patterns are found in the modified free source code using an encryption key associated with one or more devices for which the program code is designed.

8. The system of claim 7, wherein the impermissible code patterns correspond to at least one of proprietary, malicious or virulent code sequences.

9. The system of claim 7, wherein the intermediate code comprises one of bytecode, an intermediate representation of the modified free source code, or an optimized version of the intermediate representation.

10. The system of claim 7, wherein the system is configured to take action against an entity that provided the modified free source code to the system responsive to the code scanner detecting one or more of the impermissible code patterns.

11. The system of claim 7, wherein the code authenticator is configured to selectively calculate a hash value based on the program code and encrypt the hash value using the encryption key.

12. The system of claim 7, wherein the program code comprises one of executable code or bytecode.

13. A computer program product implemented on a microprocessor for maintaining code integrity in a central software development system, comprising:

computer readable program code for scanning modified free source code received by the system for impermissible code patterns by comparing at least one of the modified source code or intermediate code generated from the modified free source code to one or more groups of regular expressions representing the impermissible code patterns, each regular expression being an ordered sequence of symbols describing or matching a set of strings according to certain syntax rules;

computer readable program code for determining if the modified free source code or the intermediate code includes one or more of the impermissible code patterns based on whether a match occurs between the source code or the intermediate code and one or more of the regular expressions during scanning;

computer readable program code for converting the modified free source code to program code; and

computer readable program code for signing the program code if no impermissible code patterns are found in the modified free source code using an encryption key associated with one or more devices for which the program code is designed.

14. The computer program product of claim 13, further comprising computer readable program code for taking action against an entity that provided the modified free source code to the system responsive to one or more of the impermissible code patterns being detected.

15. The computer program product of claim 13, wherein the computer readable program code for signing the program code if no impermissible code patterns are found in the modified free source code using the encryption key comprises computer readable program code for selectively calculating a hash value based on the program code and encrypting the hash value using the encryption key.