In-Toto: Providing farm-to-table guarantees for bits and bytes

Document Type

Conference Proceeding

Publication Date

1-1-2019

Abstract

The software development process is quite complex and involves a number of independent actors. Developers check source code into a version control system, the code is compiled into software at a build farm, and CI/CD systems run multiple tests to ensure the software's quality among a myriad of other operations. Finally, the software is packaged for distribution into a delivered product, to be consumed by end users. An attacker that is able to compromise any single step in the process can maliciously modify the software and harm any of the software's users. To address these issues, we designed in-toto, a framework that cryptographically ensures the integrity of the software supply chain. in-toto grants the end user the ability to verify the software's supply chain from the project's inception to its deployment. We demonstrate in-toto's effectiveness on 30 software supply chain compromises that affected hundreds of million of users and showcase in-toto's usage over cloud-native, hybrid-cloud and cloud-agnostic applications. in-toto is integrated into products and open source projects that are used by millions of people daily. The project website is available at: https://in-toto.io.

Identifier

85076368216 (Scopus)

ISBN

[9781939133069]

Publication Title

Proceedings of the 28th Usenix Security Symposium

First Page

1393

Last Page

1410

Grant

CNS 1801430

Fund Ref

National Science Foundation

This document is currently not available here.

Share

COinS