Methods for firmware signature
A method for installing embedded firmware is provided. The method includes generating one or more firmware file instances and generating one or more digital certificate instances that are separate instances from the firmware file instances. The method includes associating the one or more digital certificate instances with the one or more firmware file instances to facilitate updating signature-unaware modules with signature-aware firmware or to facilitate updating signature-aware modules with signature-unaware firmware.
1. A method, comprising:
receiving, by a device, signature unaware firmware code; and
installing, by the device via boot code, the signature unaware firmware code on the first device, wherein the boot code is configured for installation of a signature aware firmware code and the signature unaware firmware code to the device, and wherein the installing the signature unaware firmware code further comprises:
receiving a certificate separate from and associated with the signature unaware firmware code,
determining whether the certificate is valid by verifying that a signature of the certificate is valid,
in response to the certificate being valid, loading the signature unaware firmware code on the device, and
in response to the certificate being invalid, preventing installation of the signature unaware firmware code on the device.
2. The method of claim 1 , wherein the installing the signature unaware firmware code further comprises verifying that the signature unaware firmware code is received from a proxy module located remotely from the device, where the proxy module has verified the signature unaware firmware code.
3. The method of claim 2 , wherein the proxy module intercepted a request to install the signature unaware firmware code on the device.
4. The method of claim 2 , wherein the proxy module verified the certificate generated for the signature unaware firmware code.
5. The method of claim 1 , wherein the determining whether the certificate is valid further comprises verifying that the signature unaware firmware code is valid for the certificate.
6. A non-transitory computer-readable medium having instructions stored thereon that, in response to execution, cause a device to perform operations comprising:
receiving signature unaware firmware code; and
installing, via boot code, the signature unaware firmware code on the device, wherein the boot code is configure for installation of a signature aware firmware code and the signature unaware firmware code to the device, and wherein the installing the signature unaware firmware code further comprises:
receiving a certificate separate from and associated with the signature unaware firmware code,
determining whether the certificate is valid by verifying that a signature of the certificate is valid,
in response to the certificate being valid, loading the signature unaware firmware code on the device, and
in response to the certificate being invalid, preventing installation of the signature unaware firmware code on the device.
7. The non-transitory computer-readable medium of claim 6 , wherein the installing the signature unaware firmware code further comprises verifying that the signature unaware firmware code is received from a proxy module located remotely from the device, where the proxy module has verified the signature unaware firmware code.
8. The non-transitory computer-readable medium of claim 7 , wherein the proxy module intercepted a request to install the signature unaware firmware code on the device.
9. The non-transitory computer-readable medium of claim 7 , wherein the proxy module verified the certificate generated for the signature unaware firmware code.
10. The non-transitory computer-readable medium of claim 6 , wherein the determining whether the certificate is valid further comprises verifying that the signature unaware firmware code is valid for the certificate.
11. A system, comprising:
a first device configured to receive signature unaware firmware code;
a boot code installed on the first device configured to install the signature unaware firmware code on the first device comprising:
receive a certificate separate from and associated with the signature unaware firmware code,
determine whether the certificate is valid by verifying that a signature of the certificate is valid,
in response to the certificate being valid, loads the signature unaware firmware code on the first device, and
in response to the certificate being invalid, prevents installation of the signature unaware firmware code on the first device; and
wherein the boot code is further configured for installation of a signature aware firmware code.
12. The system of claim 11 , wherein the boot code, prior to installing the signature unaware firmware code, verifies that the signature unaware firmware code is received from a proxy module located remotely from the device, where the proxy module has verified the signature unaware firmware code.
13. The system of claim 12 , wherein the proxy module intercepted a request to install the signature unaware firmware code on the device.
14. The system of claim 12 , wherein the proxy module verified the certificate generated for the signature unaware firmware code.