Microsoft Technology Licensing, LLC

Richard Steele Gibson

Jared Porter Parsons

Stephen Harris Toub

Jan Kotas

Tomas Matousek

Jason Shaver

Julien Couvreur

David M Fowler

Jobst-Immo Landwerth

Claire Novotny

Christopher Sienkiewicz

Andrew Spenser Gocke

Software provenance validation reports whether a validation binary matches the source code, resources, and other parts, as well as the compiler, runtime, operating system, and other context, which is specified in a provenance manifest for a release binary. Part context checksums, software versions, tool parameters, and other aspects of a build are checked. Certification signatures, timestamps, certain version differences, source code locations, and other data may be ignored for validation purposes. A provenance manifest may include other provenance manifests, including binary rewrite manifests. The provenance manifest may be stored in a debugger file with symbol information, or stored separately. Partial matches may be reported, with details of what matches or does not match. After provenance of a binary is validated, the binary's source code can be analyzed for vulnerabilities, thereby enhancing software supply chain security.

Software provenance validation

Improved compilers recognize interception declarations in source code, and emit code that replaces invocations of specified artifacts with invocations of specified interceptors instead. Source generators proactively modify program behavior in arbitrary desired ways without introducing hidden security violations and without requiring edits by the program's developers. Interception declarations are visible in source code and development tools. In some cases, different invocations of a particular method at respective locations are intercepted by different replacement methods. Replacement methods have identical signatures, or are otherwise compatible. Some interceptors specify optional parameters. Method calls, field accesses, and property calls may be intercepted. Work to modify program behavior is moved in the program lifecycle from runtime to compile time, thus improving runtime performance and eliminating JIT compilation security risks.

Member invocation declarative interception

Growing community of inventors

Covington, WA, United States of America

Richard Steele Gibson