Generic code signing client with downloadable modules
A method for signing data such as software images is provided that uses modules executable by a generic client to sign hashes of the software images rather than the images themselves. The method avoids both the requirement for new or updated client software and the uploading of full software images to the signing system. This approach uses a generic client that requests and downloads processing modules from the signing system to perform the pre-processing operations in signing software images, as well as optionally for post-processing operations.
1. A method of signing a software image, at least a portion of the method being performed by a computer device comprising one or more processors, the method comprising:
(a) accepting a request to sign a software image, the request comprising:
the software image; and
a pointer to a signing configuration already defined in a signing system, the signing configuration including a signing operation type;
(b) transmitting a module request to the signing system, the module request for a module for performing operations associated with signing the software image, the request comprising the pointer to the signing configuration;
(c) receiving the module and at least a subset of configuration parameters for executing the module from the signing system, the module identified by the signing system according to the pointer transmitted with the module request;
(d) executing at least a subset of the operations of the received module on the software image according to the at least a subset of the configuration parameters to generate a modified software image;
(e) generating a hash of the modified software image;
(f) transmitting a signing request to the signing system, the signing request comprising the hash of the modified software image and a pointer to the configuration; and
(g) receiving a signature generated from the modified software image that verifies the authenticity of the software image.
2. The method of claim 1 , further comprising:
(h) executing further module operations to generate the signed software image according to the modified software image and the signature generated from the modified software image.
3. The method of claim 1 , further comprising:
determining if the received module is a newer version of a locally stored received module and if no version of the received module is locally stored; and
if the received module is a newer version of the locally stored module, or if no version of the received module is locally stored:
generating a mapping of the received module to the signing operation type;
locally storing the mapping;
locally storing the received module as the locally stored module.
4. The method of claim 1 , further comprising:
accepting a second request to sign a software image, the request comprising:
a second software image
a second pointer to the signing configuration already defined in the signing system, the signing configuration including the signing operation type;
determining if the module is locally stored; and
performing steps (d)-(g) using the locally stored module only if the module is locally stored;
performing steps (b)-(g) if the module is not locally stored.
5. The method of claim 4 , wherein the module is locally stored, and wherein:
the signing request further comprises a version identifier of the executed module;
if the executed module is not the latest version of the module as determined by the signing system from the version identifier of the executed module:
receiving a newer version of the module and at least a subset of configuration parameters for executing the newer version of the module from the signing system;
executing at least a subset of the operations of the newer version of the module on the software image according to the at least a subset of the configuration parameters to generate a modified software image;
generating a second hash of the modified software image;
transmitting a second signing request to the signing system, the second signing request comprising the second hash of the modified software image and the second pointer to the signing configuration; and
receiving a signature generated from the modified software image.
6. The method of claim 1 , wherein:
the module request is transmitted from a client having a crypto-token;
the module request further comprises:
a crypto-token identifier;
a crypto-token signature; and
before transmitting the received the module and configuration parameters, the signing system verifies the client according to the crypto token identifier and the crypto-token signature.
7. The method of claim 1 , wherein:
the software image comprises a first version identifier;
the at least a subset of the configuration parameters comprises a second version identifier;
the method further comprises:
determining, by the executing module, whether the first version identifier equals the second version identifier; and
performing steps (f)-(g) according to the determination.
8. The method of claim 1 , wherein:
the configuration parameters further comprise at least one key identifiers or more code signing digital certificate to be inserted into the modified software image.
9. The method of claim 1 , wherein the module comprises executable code.
10. The method of claim 1 , wherein the module comprises a binary mapping to atomic operations for performing at least the subset of the operations of the module.
11. The method of claim 10 , wherein the atomic operations are pre-provisioned to a generic client performing steps (a)-(g).
12. The method of claim 1 , wherein:
the received configuration parameters include a code encryption key;
the executed subset of operations includes decrypting the encrypted code encryption key; and
at least a portion of the modified software image is encrypted according to the code encryption key.
13. An apparatus for signing a software image, comprising:
a processor;
a memory, communicatively coupled to the processor, the memory storing processor instructions comprising instructions for:
(a) accepting a request to sign a software image, the request comprising:
the software image; and
a pointer to a signing configuration already defined in a signing system, the signing configuration including a signing operation type;
(b) transmitting a module request to the signing system, the module request for a module for performing operations associated with signing the software image, the request comprising the pointer to the signing configuration;
(c) receiving the module and at least a subset of configuration parameters for executing the module from the signing system, the module identified by the signing system according to the pointer transmitted with the module request;
(d) executing at least a subset of the operations of the received module on the software image according to the at least a subset of the configuration parameters to generate a modified software image;
(e) generating a hash of the modified software image;
(f) transmitting a signing request to the signing system, the signing request comprising the hash of the modified software image and a pointer to the configuration; and
(g) receiving a signature generated from the modified software image that verifies the authenticity of the software image.
14. The apparatus of claim 13 , wherein the processor instructions further comprise instructions for:
(h) executing further module operations to generate the signed software image according to the modified software image and the signature generated from the modified software image.
15. The apparatus of claim 13 , wherein the processor instructions further comprise instructions for:
determining if the received module is a newer version of a locally stored received module and if no version of the received module is locally stored; and
if the received module is a newer version of the locally stored module, or if no version of the received module is locally stored:
generating a mapping of the received module to the signing operation type;
locally storing the mapping;
locally storing the received module as the locally stored module.
16. The apparatus of claim 13 , wherein the processor instructions further comprise instructions for:
accepting a second request to sign a software image, the request comprising:
a second software image;
a second pointer to the signing configuration already defined in the signing system, the signing configuration including the signing operation type;
determining if the module is locally stored; and
performing steps (d)-(g) using the locally stored module only if the module is locally stored;
performing steps (b)-(g) if the module is not locally stored.
17. The apparatus of claim 16 , wherein the module is locally stored, and wherein:
the signing request further comprises a version identifier of the executed module;
the processor instructions further comprise processor instructions for:
if the executed module is not the latest version of the module as determined by the signing system from the version identifier of the executed module:
receiving a newer version of the module and at least a subset of configuration parameters for executing the newer version of the module from the signing system;
executing at least a subset of the operations of the received newer version of the module on the software image according to the at least a subset of the configuration parameters to generate a modified software image;
generating a second hash of the modified software image;
transmitting a second signing request to the signing system, the second signing request comprising the second hash of the modified software image and the second pointer to the signing configuration; and
receiving a signature generated from the modified software image.
18. The apparatus of claim 13 , wherein:
the module request is transmitted from a client having a crypto-token;
the module request further comprises:
a crypto-token identifier;
a crypto-token signature; and
before transmitting the received the module and configuration parameters, the signing system verifies the client according to the crypto token identifier and the crypto-token signature.
19. The apparatus of claim 13 , wherein:
the software image comprises a first version identifier;
the at least a subset of the configuration parameters comprises a second version identifier;
the processor instructions further comprise instructions for:
determining, by the executing module, whether the first version identifier equals the second version identifier; and
performing steps (f)-(g) according to the determination.
20. The apparatus of claim 13 , wherein:
the configuration parameters further comprise at least one key identifiers or more code signing digital certificate to be inserted into the modified software image.