Distributed Software Build Assurance for Software Supply Chain Integrity
Source abstract
Abstract
Computing and networking are increasingly implemented in software. We design and build a software build assurance scheme detecting if there have been injections or modifications in the various steps in the software supply chain, including the source code, compiling, and distribution. Building on the reproducible build and software bill of materials (SBOM), our work is distinguished from previous research in assuring multiple software artifacts across the software supply chain. Reproducible build, in particular, enables our scheme, as our scheme requires the software materials/artifacts to be consistent across machines with the same operating system/specifications. Furthermore, we use blockchain to deliver the proof reference, which enables our scheme to be distributed so that the assurance beneficiary and verifier are the same, i.e., the node downloading the software verifies its own materials, artifacts, and outputs. Blockchain also significantly improves the assurance efficiency. We first describe and explain our scheme using abstraction and then implement our scheme to assure Ethereum as the target software to provide concrete proof-of-concept implementation, validation, and experimental analyses. Our scheme enables more significant performance gains than relying on a centralized server thanks to the use of blockchain (e.g., two to three orders of magnitude quicker in verification) and adds small overheads (e.g., generating and verifying proof have an overhead of approximately one second, which is two orders of magnitude smaller than the software download or build processes).
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Safety Systems Engineering in Autonomy · Security and Verification in Computing · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Science, University of Colorado Colorado Springs, Colorado Springs, CO 80918, USA
Department of Computer Science, Florida Polytechnic University, Lakeland, FL 33805, USA
Department of Computer Science and Information Systems, Texas A&M University-Commerce, Commerce, TX 75428, USA
Electronics and Telecommunications Research Institute, Daejeon 34129, Republic of Korea
Funding
National Science Foundation · Institute of Information and Communications Technology Planning and Evaluation (IITP) grant funded by the Korean government (MSIT)
References (54)
Show source-provided references
1. The United States Government (2023, October 29). The White House, Available online: https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/.
2. (2024, September 29). SolarWinds Supply Chain Attack|Fortinet. Available online: https://www.fortinet.com/resources/cyberglossary/solarwinds-cyber-attack.
3. (2024, September 29). Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations|CISA, Available online: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a.
4. Wu, Q., and Lu, K. (2024, August 11). On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits 2021. Available online: https://api.semanticscholar.org/CorpusID:233479632.
5. Meli, M., McNiece, M.R., and Reaves, B. (2019, January 24–27). How Bad Can It Git? Characterizing Secret Leakage in Public GitHub Repositories. Proceedings of the Network and Distributed System Security Symposium 2019, San Diego, CA, USA.10.14722/ndss.2019.23418 ↗
6. Liu, C., Chen, S., Fan, L., Chen, B., Liu, Y., and Peng, X. (2022, January 25–27). Demystifying the vulnerability propagation and its evolution via dependency trees in the NPM ecosystem. Proceedings of the 44th International Conference on Software Engineering, Pittsburgh, PA, USA.10.1145/3510003.3510142 ↗
7. Neupane, S., Holmes, G., Wyss, E., Davidson, D., and Carli, L.D. (2023, January 9–11). Beyond Typosquatting: An In-depth Look at Package Confusion. Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA, USA.
8. Cybersecurity and Infrastructure Security Agency (CISA) (2024, August 11). Types of Software Bill of Material (SBOM) Documents, Available online: https://www.cisa.gov/sites/default/files/2023-04/sbom-types-document-508c.pdf.
9. Sarker, A., Wuthier, S., Kim, J., Kim, J., and Chang, S.Y. (2023, January 8–11). Version++: Cryptocurrency Blockchain Handshaking with Software Assurance. Proceedings of the 2023 IEEE 20th Consumer Communications & Networking Conference (CCNC), IEEE, Las Vegas, NV, USA.10.1109/CCNC51644.2023.10059971 ↗
10. Purification, S., Kim, J., Kim, J., Kim, I., and Chang, S.Y. (2023). Distributed and Lightweight Software Assurance in Cellular Broadcasting Handshake and Connection Establishment. Electronics, 12.10.3390/electronics12183782 ↗
11. The Go-Ethereum Authors (2023, October 29). Stable Releases. Available online: https://geth.ethereum.org/downloads.
12. Merkle, R.C. (1988). A digital signature based on a conventional encryption function. Advances in Cryptology—CRYPTO ’87, Springer. Lecture Notes in Computer Science.10.1007/3-540-48184-2_32 ↗
13. (2024, October 01). Bitcoin.org. Available online: https://bitcoin.org/bitcoin.pdf.
14. (2023, November 10). GitHub—Anchore/Syft: CLI Tool and Library for Generating a Software Bill of Materials from Container Images and Filesystems. Available online: https://github.com/anchore/syft.
15. Microsoft (2023, October 20). Microsoft/Merklecpp: A C++ Library for Creation and Manipulation of Merkle Trees. Available online: https://github.com/microsoft/merklecpp.
16. (2024, January 29). Redis. Available online: https://redis.io/.
17. Ethereum.org (2024, August 06). The History of Ethereum. Available online: https://ethereum.org/en/history/.
18. Trusted Computing Group (2023, May 26). Trusted Platform Module (TPM). Available online: https://trustedcomputinggroup.org/work-groups/trusted-platform-module/.
19. Intel (2023, May 26). Intel Software Guard Extensions. Available online: https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html.
20. ARM (2023, May 26). Layered Security for Your Next SoC. Available online: https://www.arm.com/products/silicon-ip-security.
21. Armknecht, F., Sadeghi, A.R., Schulz, S., and Wachsmann, C. (2013, January 4–8). A security framework for the analysis and design of software attestation. Proceedings of the 2013 ACM SIGSAC Conference on COMPUTER & Communications Security, Berlin, Germany.10.1145/2508859.2516650 ↗
22. Kovah, X., Kallenberg, C., Weathers, C., Herzog, A., Albin, M., and Butterworth, J. (2012, January 20–23). New results for timing-based attestation. Proceedings of the 2012 IEEE Symposium on Security and Privacy, IEEE, San Francisco, CA USA.10.1109/SP.2012.45 ↗
23. Detecting code alteration by creating a temporary memory bottleneck10.1109/TIFS.2009.2033231 ↗
24. Castelluccia, C., Francillon, A., Perito, D., and Soriente, C. (2009, January 9–13). On the difficulty of software-based attestation of embedded devices. Proceedings of the 16th ACM Conference on Computer and Communications Security, Chicago, IL, USA.10.1145/1653662.1653711 ↗
25. Nunes, I.D.O., Eldefrawy, K., Rattanavipanon, N., and Tsudik, G. (2020, January 12–14). APEX: A Verified Architecture for Proofs of Execution on Remote Devices under Full Software Compromise. Proceedings of the USENIX Security Symposium, Boston, MA, USA.
26. Ammar, M., Crispo, B., De Oliveira Nunes, I., and Tsudik, G. (July, January 28). Delegated attestation: Scalable remote attestation of commodity CPS by blending proofs of execution with software attestation. Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, Abu Dhabi, United Arab Emirates.
27. Eldefrawy, K., Rattanavipanon, N., and Tsudik, G. (2017, January 18–20). HYDRA: Hybrid design for remote attestation (using a formally verified microkernel). Proceedings of the 10th ACM Conference on Security and Privacy in wireless and Mobile Networks, Boston, MA, USA.10.1145/3098243.3098261 ↗
28. Reproducible Builds (2023, November 10). A Set of Software Development Practices That Create an Independently-Verifiable Path from Source to Binary Code. Available online: https://reproducible-builds.org/.
29. (2023, November 10). ReproducibleBuilds—Debian Wiki. Available online: https://wiki.debian.org/ReproducibleBuilds.
30. (2023, November 10). GitHub—Devrandom/Gitian-Builder: Build Packages in a Secure Deterministic Fashion Inside a VM. Available online: https://github.com/devrandom/gitian-builder.
31. (2023, November 10). Build Result Compare Script. Available online: https://build.opensuse.org/package/show/openSUSE:Factory/build-compare.
32. GitHub—Kholia/ReproducibleBuilds: Reproducible Builds in Fedora (“Remock”) (2023, November 10). Updated for Fedora 23, and Rawhide. Available online: https://github.com/kholia/ReproducibleBuilds.
33. (2023, November 10). FOSDEM 2014—Reproducible Builds for Debian. Available online: https://archive.fosdem.org/2014/schedule/event/reproducibledebian/.
34. de Carné de Carnavalet, X., and Mannan, M. (2014, January 8–12). Challenges and implications of verifiable builds for security-critical open-source software. Proceedings of the 30th Annual Computer Security Applications Conference, ACM, New Orleans, LA, USA.10.1145/2664243.2664288 ↗
35. Fourné, M., Wermke, D., Enck, W., Fahl, S., and Acar, Y. (2023, January 22–25). It’s like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security. Proceedings of the 2023 IEEE Symposium on Security and Privacy (SP), IEEE, San Francisco, CA, USA.10.1109/SP46215.2023.10179320 ↗
36. Bazzi, A., Shaout, A., and Ma, D. (2023). MT-SOTA: A Merkle-Tree-Based Approach for Secure Software Updates over the Air in Automotive Systems. Appl. Sci., 13.10.3390/app13169397 ↗
37. Ghosal, A., Halder, S., and Conti, M. (2020, January 7–11). STRIDE: Scalable and secure over-the-air software update scheme for autonomous vehicles. Proceedings of the ICC 2020-2020 IEEE International Conference on Communications (ICC), IEEE, Dublin, Ireland.10.1109/ICC40277.2020.9148649 ↗
38. Nilsson, D.K., Sun, L., and Nakajima, T. (December, January 30). A framework for self-verification of firmware updates over the air in vehicle ECUs. Proceedings of the 2008 IEEE Globecom Workshops, IEEE, New Orleans, LA, USA.10.1109/GLOCOMW.2008.ECP.56 ↗
39. Secure over-the-air software update for connected vehicles10.1016/j.comnet.2022.109394 ↗
40. Nakamoto, S. (2008). Bitcoin: A peer-to-peer electronic cash system. Decentralized Bus. Rev.
41. A next-generation smart contract and decentralized application platform
42. Git (2023, January 10). Git—Distributed-Even-If-Your-Workflow-Isnt. Available online: https://git-scm.com/.
43. Apache Subversion (2023, January 10). Apache Subversion. Available online: https://subversion.apache.org/.
44. Mercurial (2023, January 10). Work Easier Work Faster. Available online: https://www.mercurial-scm.org/.
45. Blockchain-based identity management systems: A review10.1016/j.jnca.2020.102731 ↗
46. Analysis of blockchain solutions for E-voting: A systematic literature review10.1109/ACCESS.2022.3187688 ↗
47. Security of Cryptocurrencies in blockchain technology: State-of-art, challenges and future prospects10.1016/j.jnca.2020.102635 ↗
48. A literature review of blockchain technology applications in supply chains: A comprehensive analysis of themes, methodologies and industries10.1016/j.cie.2021.107133 ↗
49. Blockchain for healthcare management systems: A survey on interoperability and security10.1109/ACCESS.2023.3236505 ↗
50. Matsumoto, S., and Reischuk, R.M. (2017, January 22–26). IKP: Turning a PKI around with decentralized automated incentives. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), IEEE, San Jose, CA, USA.10.1109/SP.2017.57 ↗
51. Sarker, A., Byun, S., Fan, W., and Chang, S.Y. (2021, January 22–26). Blockchain-based root of trust management in security credential management system for vehicular communications. Proceedings of the 36th Annual ACM Symposium on Applied Computing, Virtual.10.1145/3412841.3441905 ↗
52. Blockchain for 5G and beyond networks: A state of the art survey10.1016/j.jnca.2020.102693 ↗
53. A comprehensive survey on blockchain in industrial internet of things: Motivations, research progresses, and future challenges10.1109/COMST.2022.3141490 ↗
54. A comprehensive survey on the applications of blockchain for securing vehicular networks10.1109/COMST.2022.3160925 ↗