Code Signing System Patch Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing code signing systems struggle to verify the integrity of modified executable code, as modifications often invalidate digital signatures, preventing systems from ensuring the code's authenticity and origin.
Innovation Solution
A local certificate authority is implemented within the computer system to re-sign patched code, verifying its integrity and generating new digital signatures, while maintaining records of the original authorship through certificate extensions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If code is modified after signing to patch bugs or customize operation, then the code can be updated and improved, but the digital signature becomes invalid and the computer system can no longer verify the code's authenticity
Solution Approach 1:
The system performs preliminary actions by obtaining authorization from the original author before allowing code modification. The author's private key is used to generate an authorization code in advance, which serves as a credential that permits subsequent modifications while maintaining a chain of trust. This preliminary authorization prevents unauthorized modifications and ensures that any changes are sanctioned by the original code creator.
Solution Approach 2:
An intermediary authorization mechanism is introduced between the original signed code and the modified code. The authorization code, generated using the author's private key, acts as a mediator that bridges the trust gap created by modification. This intermediary credential allows the system to verify that modifications are permitted while the code is being updated, preserving both adaptability and reliability.
2Ease of operation
If a party other than the author modifies the signed code, then code customization and patching can be performed, but the modifying party lacks access to the cryptographic key necessary to restore the digital signature
Solution Approach 1:
The system extracts the essential authorization function from the author's private key without requiring the key itself to be exposed. The private key is used solely to generate an authorization code, which is then stored and used by third parties for code modification. This extraction separates the key management burden from the modification process, allowing third parties to patch code without needing access to sensitive cryptographic materials.
Solution Approach 2:
Instead of requiring third parties to possess the original private key, the system creates a copy in the form of an authorization code. This authorization code is a cryptographic artifact generated from the private key that contains sufficient information to authorize modifications but does not reveal the private key itself. The copy enables ease of operation for third parties while maintaining security by not exposing the original cryptographic secret.
3Reliability
If the computer system verifies the digital signature on executable instructions, then code authenticity is ensured, but modified code cannot be executed because the signature is invalid
Solution Approach 1:
The system performs preliminary verification by checking the authorization code against the original author's public key before allowing modification. This preliminary action establishes a chain of trust that connects the modified code back to the authenticated author. By verifying the authorization credential in advance, the system ensures that subsequent execution of modified code maintains authenticity guarantees without blocking productive modifications.
Solution Approach 2:
The authorization code serves as an intermediary credential that mediates between the original signed code and the modified code. When code is modified, the authorization code is embedded or associated with the modified version, allowing the verification system to trace the modification back to an authorized source. This intermediary mechanism enables both verification of authenticity and execution of modified code by providing a cryptographic bridge that preserves trust.
Data Source
AI summary
A computer system obtains a request to apply a signed patch to a piece of signed executable code. The computer system determines whether the signed patch is allowed to be applied to the signed executable based on a set of patch policies. If the patch policies allow the patch to be applied, the patch is applied to the signed executable code. The computer system generates a new digital signature for the modified executable code thereby allowing the resulting signed patched executable code to be verified and executed by the computer system.