Future constraints for hierarchical chain of trust

1. A method for configuring, in an electronic device, a target domain of a hierarchical chain of trust, the target domain providing a cryptographic identity for authenticating commands to be executed by the electronic device, the method comprising:

receiving a domain configuration command requesting configuration of the target domain on the electronic device, the domain configuration command specifying at least one target domain constraint to be satisfied by commands to be authenticated by the target domain and at least one target domain future constraint to be combined with other constraints when configuring a descendant domain of the target domain;

authenticating the domain configuration command based on a cryptographic identity provided by an authenticating domain, wherein the target domain is the authenticating domain or a descendant domain of the authenticating domain in the hierarchical chain of trust; and

when the domain configuration command is authenticated:

combining, using one or more logical functions, said at least one target domain constraint and at least one future constraint specified by the authenticating domain to generate a combined constraint set comprising zero, one or more constraints to be satisfied by commands to be authenticated by the target domain, and storing an indication of said combined constraint set, and

combining, using one or more logical functions, said at least one target domain future constraint and said at least one future constraint specified by the authenticating domain to generate a combined target domain future constraint set comprising zero, one or more constraints to be combined with other constraints when configuring a descendant domain of the target domain, and storing an indication of said combined target domain future constraint set,

wherein the target domain constraint refers to one or more requirements to be satisfied by a command in order to be authenticated, and

wherein the future constraint refers to one or more requirements to be satisfied by a command authenticated by one or more descendant domains of the authenticating domain.

2. The method of claim 1 , wherein subsequent commands to be authenticated by the target domain which are received following configuration of the target domain are authenticated based on whether they satisfy the combined constraint set.

3. The method of claim 1 , comprising, in response to the domain configuration command being authenticated, storing an indication of at least one target domain future constraint for combining with other constraints when configuring a descendant domain of the target domain.

4. The method of claim 3 , wherein said at least one target domain future constraint is selected in dependence on at least one of:

said at least one authenticating domain future constraint; and

at least one target domain future constraint specified by the domain configuration command.

5. The method of claim 1 , wherein a same type of command is subject to different sets of constraints depending on the level of the hierarchical chain of trust at which the command is to be authenticated.

6. The method of claim 1 , wherein said at least one future constraint comprises at least one descendant constraint to be satisfied by commands to be authenticated by the target domain and any descendant domain of the target domain in the hierarchical chain of trust.

7. The method of claim 1 , wherein said at least one future constraint comprises at least one level-specific constraint to be satisfied by commands to be authenticated by a domain at one or more predetermined levels of the hierarchical chain of trust.

8. The method of claim 1 , wherein said at least one future constraint comprises at least one type-specific constraint to be satisfied for one or more predetermined types of command to be authenticated by the target domain or a descendant domain of the target domain.

9. The method of claim 1 , wherein said at least one future constraint comprises at least one type-restricting constraint specifying which types of command are allowed to be authenticated by the target domain or a descendant domain of the target domain.

10. The method of claim 1 , wherein said at least one future constraint comprises at least one conditional constraint to be satisfied by the command if at least one predetermined constraint is also to be satisfied by the command.

11. The method of claim 1 , wherein said at least one future constraint comprises at least one default constraint to be satisfied by the command unless overruled by another constraint.

12. The method of claim 1 , wherein said at least one future constraint comprises at least one device mode constraint specifying that a command is to be authenticated only if the electronic device is operating in a predetermined mode of operation.

13. The method of claim 1 , wherein said at least one future constraint comprises a blocking constraint specifying that a domain install command for installing a new domain of the hierarchical chain of trust on the electronic device is to be authenticated by the target domain or a descendant domain of the target domain only when the domain install command specifies that the new domain is to be installed in a blocked state in which the new domain cannot authenticate commands.

14. The method of claim 13 , wherein the new domain is unblocked in response to a unblocking command.

15. The method of claim 14 , wherein said at least one future constraint comprises an unblocking constraint specifying that the unblocking command is to be authenticated by the target domain or the descendant domain of the target domain only when the unblocking command restricts unblocking of the new domain to a specific electronic device.

16. The method of claim 1 , wherein the command to be authenticated specifies a digital signature and signature metadata identifying which portions of the command are authenticated by the digital signature; and

said future constraint comprises a signature enforcing constraint specifying that a command is to be authenticated by the target domain or a descendant domain of the target domain only when the signature metadata specifies that all of the portions of the command are authenticated by the digital signature.

17. The method of claim 1 , wherein the domain configuration command comprises one of:

a domain install command requesting installation of the target domain on the electronic device; and

a domain update command requesting updating of parameters of the target domain on the electronic device.

18. A non-transitory storage medium storing a computer program comprising program instructions to control an electronic device to:

receive a domain configuration command requesting configuration of a target domain of a hierarchical chain of trust on the electronic device, the target domain providing a cryptographic identity for authenticating commands to be executed by the electronic device, and the domain configuration command specifying at least one target domain constraint to be satisfied by commands to be authenticated by the target domain and at least one target domain future constraint to be combined with other constraints when configuring a descendant domain of the target domain;

authenticate the domain configuration command based on a cryptographic identity provided by an authenticating domain, wherein the target domain is the authenticating domain or a descendant domain of the authenticating domain in the hierarchical chain of trust; and

when the domain configuration command is authenticated:

combine, using one or more logical functions, said at least one target domain constraint and at least one future constraint specified by the authenticating domain to generate a combined constraint set comprising zero, one or more constraints to be satisfied by commands to be authenticated by the target domain, and storing an indication of said combined constraint set, and

combine, using one or more logical functions, said at least one target domain future constraint and said at least one future constraint specified by the authenticating domain to generate a combined target domain future constraint set comprising zero, one or more constraints to be combined with other constraints when configuring a descendant domain of the target domain, and storing an indication of said combined target domain future constraint set,

wherein the target domain constraint refers to one or more requirements to be satisfied by a command in order to be authenticated, and

wherein the future constraint refers to one or more requirements to be satisfied by a command authenticated by one or more descendant domains of the authenticating domain.

19. An electronic device comprising:

the non-transitory storage medium of claim 18 , and

processing circuitry configured to execute the computer program stored on the non-transitory storage medium.

20. An electronic device comprising:

authentication circuitry configured to receive a domain configuration command requesting configuration of a target domain of a hierarchical chain of trust on the electronic device, the target domain providing a cryptographic identity for authenticating commands to be executed by the electronic device, the domain configuration command specifying at least one target domain constraint to be satisfied by commands to be authenticated by the target domain and at least one target domain future constraint to be combined with other constraints when configuring a descendant domain of the target domain, and to authenticate the domain configuration command based on a cryptographic identity provided by an authenticating domain, wherein the target domain is the authenticating domain or a descendant domain of the authenticating domain in the hierarchical chain of trust;

wherein when the domain configuration command is authenticated, the authentication circuitry is configured to:

combine, using one or more logical functions, said at least one target domain constraint and at least one future constraint specified by the authenticating domain to generate a combined constraint set comprising zero, one or more constraints to be satisfied by commands to be authenticated by the target domain, and to store an indication of said combined constraint set, and

combine, using one or more logical functions, said at least one target domain future constraint and said at least one future constraint specified by the authenticating domain to generate a combined target domain future constraint set comprising zero, one or more constraints to be combined with other constraints when configuring a descendant domain of the target domain, and storing an indication of said combined target domain future constraint set,

wherein the target domain constraint refers to one or more requirements to be satisfied by a command in order to be authenticated, and

wherein the future constraint refers to one or more requirements to be satisfied by a command authenticated by one or more descendant domains of the authenticating domain.