Configurable code signing system and method
A system is provided for configurably signing a secure data image that includes software code that interprets cryptographic atomic code. In the system, a code signing engine includes an interpreter that interprets atomic code signing operations presented in a recipe defined by a system administrator according to configuration parameter values supplied with the input image.
1. A method of generating a signed input image in a configurable code signing system, the method comprising:
defining a recipe associated with a recipe identifier, and comprising:
defining an operation type associated with the recipe, the operation type defined from one or more input image signing requirements;
defining a plurality of data fields of the input image, each configuration parameter associated with at least one of said plurality of data fields;
specifying a sequence of atomic operations operating on input image values of the configuration parameters to generate an output image having the signed input image;
wherein the sequence of atomic operations includes:
a byte atomic operation referencing at least one of the plurality of data fields and an offset within the one of the plurality of data fields wherein the byte atomic operation retrieves data of the input image at the offset;
a cryptographic operation including a signing atomic operation for signing the input image at least in part according to the input image values of the configuration parameters;
accepting, in the configurable code signing system, a request to sign the input image, the request comprising the input image and an identifier of a signing configuration that has a recipe identifier and approved configuration parameter values
reading the recipe identified by the recipe identifier;
parsing and interpreting the sequence of atomic operations of the recipe;
generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the configuration parameters; and
providing the output image.
2. The method of claim 1 , wherein the output image is generated at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using values of standard configuration parameters, the standard configuration parameters being applicable to another operation type.
3. The method of claim 1 , wherein:
the input image further comprises a magic value; and
the sequence of operations generates the output image only if the input image configuration
parameter values match the approved configuration parameter values.
4. The method of claim 1 , wherein the sequence of operations generates the output image only if the input image configuration parameter values match the approved configuration parameter values.
5. The method of claim 1 , wherein:
the sequence of atomic operations further comprises:
a further atomic operation selected from a group of atomic operations comprising:
a first atomic operation for returning a size of first data;
a data field validation atomic operation for validating that third data and fourth data are equal;
a concatenation atomic operation for concatenating fifth data and sixth data;
an arithmetic atomic operation for computing an arithmetic result of at least one of seventh data and eighth data, including at least one of a sum operation, a difference operation, a multiplication operation, and a division operation;
a byte manipulation atomic operation for manipulating binary data, including at least one of a logical OR operation, a logical exclusive OR operation, a logical AND operation and a logical inverse operation; and
an execute atomic operation for executing another recipe on tenth data; and
a further cryptographic operation including at least one of an encryption operation and a hashing operation.
6. The method of claim 1 , wherein:
the recipe comprises a reference to a second recipe, the second recipe having a second sequence of atomic operations, the second sequence of operations used to further generate the output image; and
generating the output image having the signed input image at least in part by executing the parsed and interpreted sequence of atomic operations of the recipe using the input image values of the configuration parameters comprises:
executing, from the reference to the second recipe, the parsed and interpreted second sequence of operations to generate a result used in executing the parsed and interpreted sequence of atomic operations.
7. The method of claim 1 , wherein
the parsing and interpreting of the sequence of atomic operations is performed by a recipe interpreter; and
the output image is generated by a code signing engine supporting execution of the interpreted sequence of atomic operations.