Methods to digitally sign dynamic content
Methods and systems for managing endpoint devices are disclosed. The endpoint devices may be managed by verifying blueprints prior to use. To verify the blueprints, the blueprints may be normalized to reduce variability in blueprint content. Once normalized, static content may be identified. Signatures from the blueprints may be used to attempt to verify the integrity of the static content. If successfully verified, then both the static and dynamic content from the blueprints may be used to update the operation of the endpoint devices.
1 . A method for managing operation of an endpoint device, the method comprising:
obtaining a customized blueprint from a management entity, the customized blueprint comprising a payload that comprises static content defined by an author of a non-customized blueprint on which the customized blueprint is based;
performing a normalization process with respect to the customized blueprint to obtain a normalized customized blueprint;
performing a parameter handling process on the normalized customized blueprint to obtain a standardized blueprint;
performing a signature verification process for the standardized blueprint to check integrity of a static portion of the payload of the customized blueprint, the static portion comprising the static content; and
in a first instance of the performing where the integrity is compromised:
rejecting the customized blueprint.
2 . The method of claim 1 , further comprising:
in a second instance of the performing where the integrity is not compromised:
accepting the static portion of the payload.
3 . The method of claim 2 , further comprising:
based on the static portion of the payload being accepted, updating operation of the endpoint device based on the static portion of the payload and parameters of the payload provided by the management entity.
4 . The method of claim 2 , further comprising:
based on the static portion of the payload being accepted, performing a rule verification process for parameters of the payload provided by the management entity, the rule verification being performed using rules from the static portion of the payload.
5 . The method of claim 1 , wherein the customized blueprint further comprises:
variable content defined by the management entity as further part of the payload of the customized blueprint, and
a signature based on the static content and not the variable content.
6 . The method of claim 1 , wherein the normalization process comprises substituting portions of the customized blueprint with standardized portions based on a set of substitution rules.
7 . The method of claim 6 , wherein the substitution rules require, at least:
replacement of all separators with a first standardized symbol;
removal of blank lines;
collapsing of contiguous white spaces to a single space;
removal of comments;
removal of whitespaces that are not necessary for machine interpretation;
expression of dictionary and array attributes as multi-line; and
ordering of dictionary keys in alphabetical order.
8 . The method of claim 6 , wherein the normalization process is adapted to remove content perceived to facilitate human interpretation from yet another markup language (YAML) based files.
9 . The method of claim 1 , wherein the parameter handling process discriminates management entity made parameterized substitutions in the payload of the customized blueprint from original non-parameterized content from a non-customized blueprint that is signed by an author of the non-customized blueprint.
10 . The method of claim 9 , wherein the signature verification process uses a key associated with the author to check the integrity of the static portion of the payload of the customized blueprint, the static portion of the payload being the original content.
11 . A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for managing an endpoint device, the operations comprising:
obtaining a customized blueprint from a management entity, the customized blueprint comprising a payload that comprises static content defined by an author of a non-customized blueprint on which the customized blueprint is based;
performing a normalization process with respect to the customized blueprint to obtain a normalized customized blueprint;
performing a parameter handling process on the normalized customized blueprint to obtain a standardized blueprint;
performing a signature verification process for the standardized blueprint to check integrity of a static portion of the payload of the customized blueprint, the static portion comprising the static content; and
in a first instance of the performing where the integrity is compromised:
rejecting the customized blueprint.
12 . The non-transitory machine-readable medium of claim 11 , wherein the operations further comprise:
in a second instance of the performing where the integrity is not compromised:
accepting the static portion of the payload.
13 . The non-transitory machine-readable medium of claim 12 , wherein the operations further comprise:
based on the static portion of the payload being accepted, updating operation of the endpoint device based on the static portion of the payload and parameters of the payload provided by the management entity.
14 . The non-transitory machine-readable medium of claim 12 , wherein the operations further comprise:
based on the static portion of the payload being accepted, performing a rule verification process for parameters of the payload provided by the management entity, the rule verification being performed using rules from the static portion of the payload.
15 . The non-transitory machine-readable medium of claim 11 , wherein the customized blueprint further comprises:
variable content defined by the management entity as further part of the payload of the customized blueprint, and
a signature based on the static content and not the variable content.
16 . An endpoint device, comprising:
a processor; and
a memory coupled to the processor to store instructions, which when executed by the processor, cause operations to be performed, the operations comprising:
obtaining a customized blueprint from a management entity;
performing a normalization process with respect to the customized blueprint to obtain a normalized customized blueprint;
performing a parameter handling process on the normalized customized blueprint to obtain a standardized blueprint, the parameter handling process discriminates management entity made parameterized substitutions in a payload of the customized blueprint from original non-parameterized content from a non-customized blueprint that is signed by an author of the non-customized blueprint;
performing a signature verification process for the standardized blueprint to check integrity of a static portion of the payload of the customized blueprint; and
in a first instance of the performing where the integrity is compromised:
rejecting the customized blueprint.
17 . The endpoint device of claim 16 , wherein the operations further comprise:
in a second instance of the performing where the integrity is not compromised:
accepting the static portion of the payload.
18 . The endpoint device of claim 17 , wherein the operations further comprise:
based on the static portion of the payload being accepted, updating operation of the endpoint device based on the static portion of the payload and parameters of the payload provided by the management entity.
19 . The endpoint device of claim 17 , wherein the operations further comprise:
based on the static portion of the payload being accepted, performing a rule verification process for parameters of the payload provided by the management entity, the rule verification being performed using rules from the static portion of the payload.
20 . The endpoint device of claim 16 , wherein the customized blueprint comprises:
a payload comprising:
static content defined by an author of a non-customized blueprint on which the customized blueprint is based, and
variable content defined by the management entity; and
a signature based on the static content and not the variable content.