Configurable code signing system and method
A system is provided for configurably signing a secure data image that includes software code that interprets cryptographic atomic code. In the system, a code signing engine includes an interpreter that interprets atomic code signing operations presented in a recipe defined by a system administrator according to configuration parameter values supplied with the input image.
1. A method of generating a signed input image in a configurable code signing system, comprising:
defining a recipe associated with a recipe identifier, comprising:
defining an operation type associated with the recipe, the operation type defined from one or more input image signing requirements;
defining a plurality of data fields of the input image;
specifying a list of configuration parameters and associating each of the specified configuration parameters with at least one of the plurality of the data fields;
specifying a sequence of atomic operations operating on input image values of the configuration parameters to generate an output image having the signed input image;
wherein the sequence of atomic operations includes at least one of:
an atomic operation for returning a size of particular data;
a data field validation operation for validating the equality between particular data;
a concatenation atomic operation for concatenating particular data
an arithmetic atomic operation for computing an arithmetic result of at least one of a sum of, a difference of, a multiplication of, and a division of particular data;
an execution atomic operation for executing another recipe on particular data;
a byte atomic operation referencing at least one of the plurality of data fields and an offset within the one of the plurality of data fields wherein the byte atomic operation retrieves data of the input image at the offset;
a byte manipulation atomic operation for manipulating binary data, including at least one of a logical OR operation, a logical exclusive OR operation, a logical AND operation and a logical inverse operation; and
a cryptographic operation including a signing atomic operation for signing the input image at least in part according to the input image values of the configuration parameters;
accepting, in the configurable code signing system, a request to sign the input image, the request comprising:
the input image, comprising:
the plurality of data fields; and
software code and input image values of the configuration parameters disposed within the plurality of data fields;
an identifier of a signing configuration, the signing configuration including:
the recipe identifier; and
approved configuration parameter values;
reading the recipe identified by the recipe identifier;
parsing and interpreting the sequence of atomic operations of the recipe;
generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the input image values of the configuration parameters; and
providing the output image.
2. The method of claim 1 , wherein the output image is generated at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using values of standard configuration parameters, the standard configuration parameters being applicable to another operation type.
3. The method of claim 1 , wherein:
the input image further comprises a magic value; and
the sequence of operations generates the output image only if the input image configuration
parameter values match the approved configuration parameter values.
4. The method of claim 1 , wherein the sequence of operations generates the output image only if the input image configuration parameter values match the approved configuration parameter values.
5. The method of claim 1 , wherein:
the recipe comprises a reference to a second recipe, the second recipe having a second sequence of atomic operations, the second sequence of operations used to further generate the output image; and
generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the input image values of the configuration parameters comprises:
executing, from the reference to the second recipe, the parsed and interpreted second sequence of operations to generate a result used in executing the parsed and interpreted sequence of atomic operations.
6. The method of claim 1 , wherein
the parsing and interpreting of the sequence of atomic operations is performed by a recipe interpreter; and
the output image is generated by a code signing engine supporting execution of the interpreted sequence of atomic operations.
7. An apparatus for generating a signed input image in a configurable code signing system, comprising:
a processor;
a memory, communicatively coupled to the processor, the memory storing processor instructions comprising processor instructions for
defining a recipe associated with a recipe identifier, comprising:
defining an operation type associated with the recipe, the operation type defined from one or more input image signing requirements;
defining a plurality of data fields of the input image;
specifying a list of configuration parameters and associating each of the specified configuration parameters with at least one of the plurality of the data fields;
specifying a sequence of atomic operations operating on input image values of the configuration parameters to generate an output image having the signed input image;
wherein the sequence of atomic operations includes at least one of:
an atomic operation for returning a size of particular data;
a data field validation operation for validating the equality between particular data;
a concatenation atomic operation for concatenating particular data
an arithmetic atomic operation for computing an arithmetic result of at least one of a sum of, a difference of, a multiplication of, and a division of particular data;
an execution atomic operation for executing another recipe on particular data;
a byte atomic operation referencing at least one of the plurality of data fields and an offset within the one of the plurality of data fields wherein the byte atomic operation retrieves data of the input image at the offset;
a byte manipulation atomic operation for manipulating binary data, including at least one of a logical OR operation, a logical exclusive OR operation, a logical AND operation and a logical inverse operation; and
a signing atomic operation for signing the input image at least in part according to the input image values of the configuration parameters;
accepting, in the configurable code signing system, a request to sign the input image, the request comprising:
the input image, comprising:
the plurality of data fields; and
software code and input image values of the configuration parameters disposed within the plurality of data fields;
an identifier of a signing configuration, the signing configuration including:
the recipe identifier; and
approved configuration parameter values;
reading the recipe identified by the recipe identifier;
parsing and interpreting the sequence of atomic operations of the recipe;
generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the input image values of the configuration parameters; and
providing the output image.
8. The apparatus of claim 7 , wherein the output image is generated at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using values of standard configuration parameters, the standard configuration parameters being applicable to another operation type.
9. The apparatus of claim 7 , wherein:
the input image further comprises a magic value; and
the sequence of operations generates the output image only if the input image configuration parameter values match the approved configuration parameter values.
10. The apparatus of claim 7 , wherein the sequence of operations generates the output image only if the input image configuration parameter values match the approved configuration parameter values.
11. The apparatus of claim 7 , wherein:
the recipe comprises a reference to a second recipe, the second recipe having a second sequence of atomic operations, the second sequence of operations used to further generate the output image; and
generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the input image values of the configuration parameters comprises:
executing, from the reference to the second recipe, the parsed and interpreted second sequence of operations to generate a result used in executing the parsed and interpreted sequence of atomic operations.
12. The apparatus of claim 7 , wherein
the parsing and interpreting of the sequence of atomic operations is performed by a recipe interpreter; and
the output image is generated by a code signing engine supporting execution of the interpreted sequence of atomic operations.