Configurable code signing system and method
A system is provided for configurably signing a secure data image that includes software code that interprets cryptographic atomic code. In the system, a code signing engine includes an interpreter that interprets atomic code signing operations presented in a recipe defined by a system administrator according to configuration parameter values supplied with the input image.
1. A method of generating a signed input image in a configurable code signing system, comprising:
defining a recipe associated with a recipe identifier, comprising:
defining an operation type associated with the recipe, the operation type defined from one or more input image signing requirements;
defining a plurality of data fields of the input image;
specifying a list of configuration parameters and associating each of the specified configuration parameters with at least one of the plurality of the data fields;
specifying a sequence of atomic operations operating on input image values of the configuration parameters to generate an output image having the signed input image;
wherein the sequence of atomic operations includes:
a byte atomic operation referencing at least one of the plurality of data fields and an offset within the one of the plurality of data fields wherein the byte atomic operation retrieves data of the input image at the offset;
a cryptographic operation including a signing atomic operation for signing the input image at least in part according to the input image values of the configuration parameters;
accepting, in the configurable code signing system, a request to sign the input image, the request comprising:
the input image, comprising:
the plurality of data fields; and
software code and input image values of the configuration parameters disposed within the plurality of data fields;
an identifier of a signing configuration, the signing configuration including:
the recipe identifier; and
approved configuration parameter values;
reading the recipe identified by the recipe identifier;
parsing and interpreting the sequence of atomic operations of the recipe;
generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the input image values of the configuration parameters; and
providing the output image.
2. The method of claim 1 , wherein the output image is generated at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using values of standard configuration parameters, the standard configuration parameters being applicable to another operation type.
3. The method of claim 1 , wherein:
the input image further comprises a magic value; and
the sequence of operations generates the output image only if the input image configuration parameter values match the approved configuration parameter values.
4. The method of claim 1 , wherein the sequence of operations generates the output image only if the input image configuration parameter values match the approved configuration parameter values.
5. The method of claim 1 , wherein:
the sequence of atomic operations further comprises:
a further atomic operation selected from a group of atomic operations comprising:
a first atomic operation for returning a size of first data;
a data field validation atomic operation for validating that third data and fourth data are equal;
a concatenation atomic operation for concatenating fifth data and sixth data;
an arithmetic atomic operation for computing an arithmetic result of at least one of seventh data and eighth data, including at least one of a sum operation, a difference operation, a multiplication operation, and a division operation;
a byte manipulation atomic operation for manipulating binary data, including at least one of a logical OR operation, a logical exclusive OR operation, a logical AND operation and a logical inverse operation; and
an execute atomic operation for executing another recipe on tenth data; and
a further cryptographic operation including at least one of an encryption operation and a hashing operation.
6. The method of claim 1 , wherein:
the recipe comprises a reference to a second recipe, the second recipe having a second sequence of atomic operations, the second sequence of operations used to further generate the output image; and
generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the input image values of the configuration parameters comprises:
executing, from the reference to the second recipe, the parsed and interpreted second sequence of operations to generate a result used in executing the parsed and interpreted sequence of atomic operations.
7. The method of claim 1 , wherein
the parsing and interpreting of the sequence of atomic operations is performed by a recipe interpreter; and
the output image is generated by a code signing engine supporting execution of the interpreted sequence of atomic operations.
8. An apparatus for generating a signed input image in a configurable code signing system, comprising:
a processor;
a memory, communicatively coupled to the processor, the memory storing processor instructions comprising processor instructions for
defining a recipe associated with a recipe identifier, comprising:
defining an operation type associated with the recipe, the operation type defined from one or more input image signing requirements;
defining a plurality of data fields of the input image;
specifying a list of configuration parameters and associating each of the specified configuration parameters with at least one of the plurality of the data fields;
specifying a sequence of atomic operations operating on input image values of the configuration parameters to generate an output image having the signed input image;
wherein the sequence of atomic operations includes:
a byte atomic operation referencing at least one of the plurality of data fields and an offset within the one of the plurality of data fields wherein the byte atomic operation retrieves data of the input image at the offset;
a signing atomic operation for signing the input image at least in part according to the input image values of the configuration parameters;
accepting, in the configurable code signing system, a request to sign the input image, the request comprising:
the input image, comprising:
the plurality of data fields; and
software code and input image values of the configuration parameters disposed within the plurality of data fields;
an identifier of a signing configuration, the signing configuration including:
the recipe identifier; and
approved configuration parameter values;
reading the recipe identified by the recipe identifier;
parsing and interpreting the sequence of atomic operations of the recipe;
generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the input image values of the configuration parameters; and
providing the output image.
9. The apparatus of claim 8 , wherein the output image is generated at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using values of standard configuration parameters, the standard configuration parameters being applicable to another operation type.
10. The apparatus of claim 8 , wherein:
the input image further comprises a magic value; and
the sequence of operations generates the output image only if the input image configuration parameter values match the approved configuration parameter values.
11. The apparatus of claim 8 , wherein the sequence of operations generates the output image only if the input image configuration parameter values match the approved configuration parameter values.
12. The apparatus of claim 8 , wherein:
the sequence of atomic operations further comprises:
a further atomic operation selected from a group of atomic operations comprising:
a first atomic operation for returning a size of first data;
a data field validation atomic operation for validating that third data and fourth data are equal;
a concatenation atomic operation for concatenating fifth data and sixth data;
an arithmetic atomic operation for computing an arithmetic result of at least one of seventh data and eighth data, including at least one of a sum operation, a difference operation, a multiplication operation, and a division operation;
a byte manipulation atomic operation for manipulating binary data, including at least one of a logical OR operation, a logical exclusive OR operation, a logical AND operation and a logical inverse operation; and
an execute atomic operation for executing another recipe on tenth data; and
a further cryptographic operation including at least one of an encryption operation and a hashing operation.
13. The apparatus of claim 8 , wherein:
the recipe comprises a reference to a second recipe, the second recipe having a second sequence of atomic operations, the second sequence of operations used to further generate the output image; and
generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the input image values of the configuration parameters comprises:
executing, from the reference to the second recipe, the parsed and interpreted second sequence of operations to generate a result used in executing the parsed and interpreted sequence of atomic operations.
14. The apparatus of claim 8 , wherein
the parsing and interpreting of the sequence of atomic operations is performed by a recipe interpreter; and
the output image is generated by a code signing engine supporting execution of the interpreted sequence of atomic operations.
15. An apparatus for generating a signed input image in a configurable code signing system, comprising:
means for defining a recipe associated with a recipe identifier, comprising:
means for defining an operation type associated with the recipe, the operation type defined from one or more input image signing requirements;
means for defining a plurality of data fields of the input image;
means for specifying a list of configuration parameters and associating each of the specified configuration parameters with at least one of the plurality of the data fields;
means for specifying a sequence of atomic operations operating on input image values of the configuration parameters to generate an output image having the signed input image;
wherein the sequence of atomic operations includes:
a byte atomic operation referencing at least one of the plurality of data fields and an offset within the one of the plurality of data fields wherein the byte atomic operation retrieves data of the input image at the offset;
a signing atomic operation for signing the input image at least in part according to the input image values of the configuration parameters;
means for accepting, in the configurable code signing system, a request to sign the input image, the request comprising:
the input image, comprising:
the plurality of data fields; and
software code and input image values of the configuration parameters disposed within the plurality of data fields;
an identifier of a signing configuration, the signing configuration including:
the recipe identifier; and
approved configuration parameter values;
means for reading the recipe identified by the recipe identifier;
means for parsing and interpreting the sequence of atomic operations of the recipe;
means for generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the input image values of the configuration parameters; and
means for providing the output image.
16. The apparatus of claim 15 , wherein the output image is generated at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using values of standard configuration parameters, the standard configuration parameters being applicable to another operation type.
17. The apparatus of claim 15 , wherein:
the input image further comprises a magic value; and
the sequence of operations generates the output image only if the input image configuration parameter values match the approved configuration parameter values.
18. The apparatus of claim 15 , wherein the sequence of operations generates the output image only if the input image configuration parameter values match the approved configuration parameter values.
19. The apparatus of claim 15 , wherein:
the sequence of atomic operations further comprises:
a further atomic operation selected from a group of atomic operations comprising:
a first atomic operation for returning a size of first data;
a data field validation atomic operation for validating that third data and fourth data are equal;
a concatenation atomic operation for concatenating fifth data and sixth data;
an arithmetic atomic operation for computing an arithmetic result of at least one of seventh data and eighth data, including at least one of a sum operation, a difference operation, a multiplication operation, and a division operation;
a byte manipulation atomic operation for manipulating binary data, including at least one of a logical OR operation, a logical exclusive OR operation, a logical AND operation and a logical inverse operation; and
an execute atomic operation for executing another recipe on tenth data; and
a further cryptographic operation including at least one of an encryption operation and a hashing operation.
20. The apparatus of claim 15 , wherein:
the recipe comprises a reference to a second recipe, the second recipe having a second sequence of atomic operations, the second sequence of operations used to further generate the output image; and
generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the input image values of the configuration parameters comprises:
executing, from the reference to the second recipe, the parsed and interpreted second sequence of operations to generate a result used in executing the parsed and interpreted sequence of atomic operations.