Cryptographically enforcing strict separation of environments

Patent metadata

Field	Value
Publication number	US-9325506-B2
Application number	US-201414494380-A
Country	US
Kind code	B2
Filing date	Sep 23, 2014
Priority date	Sep 23, 2014
Publication date	Apr 26, 2016
Grant date	Apr 26, 2016

Abstract

A system and method are disclosed for enforcing site or organization localized provisioning policy using cryptography. In an exemplary method, a signing key is used to generate a signature for an application. The signature of the application is verified using a verifying key in order to determine whether the application adheres to the site or organization localized provisioning policy. The verifying may be performed during initialization of a computing device or during runtime of an operating system at the computing device.

First claim

What is claimed is:

1. A method performed by a computing system for enforcing strict separation of software, the method comprising:
receiving, at a server, an application that includes a first signature, the first signature generated by a first signing key,
wherein the first signing key is a member of a first cryptographic key pair that comprises a first verifying key and the first signing key, and
wherein the first verifying key is accessible to one or more computing devices that are members of a first computing environment;

removing, at the server, the first signature from the application;
generating, at the server, a signed application by associating a second signature with the application,
wherein the second signature is generated by a second signing key that is a member of a second cryptographic key pair that comprises a second verifying key and the second signing key,
wherein the second verifying key is accessible to one or more computing devices that are members of a second computing environment, and
wherein the first computing environment and the second computing environment are different computing environments selected from the group comprising: a development environment, a quality assurance environment, a testing environment, and a production environment;

loading the signed application into memory at a computing device; and at least one of:
determining that the signed application is verified if the computing device is a member of the second computing environment, or
determining that the signed application is not verified if the computing device is not a member of the second computing environment.

2. The method of claim 1 , wherein the first computing environment and the second computing environment correspond to different security domain computing environments.

3. The method of claim 1 , wherein the first computing environment and the second computing environment correspond to different business unit computing environments.

4. The method of claim 1 , wherein the computing device verifies the signed application during initialization of the computing device.

5. The method of claim 4 , wherein the initialization comprises using one or more verifying keys, wherein at least one of the one or more verifying keys is the second verifying key;
the initialization further comprising:
executing a firmware code to load a boot loader;
using the one or more verifying keys, verifying a signature associated with a boot loader;
upon verifying the signature associated with the boot loader, executing the boot loader to load an operating system kernel;
using the one or more verifying keys, verifying a signature associated with the operating system kernel; and
upon verifying of the signature associated with the operating system kernel, executing the operating system kernel,
wherein one of: i) the boot loader or ii) the operating system kernel, is the signed application.

6. The method of claim 1 , wherein a package manager uses the second verifying key to verify the second signature.

7. The method of claim 1 , wherein the computing device is a member of a plurality of computing environments and has access to verifying keys for each one of the plurality of computing environments for which the computing device is a member.

8. The method of claim 1 , wherein the first cryptographic key pair and the second cryptographic key pair enforce site or organization localized provisioning policy at the first computing environment and the second computing environment.

9. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
receiving an application that includes a first signature, the first signature generated by a first signing key,
wherein the first signing key is a member of a first cryptographic key pair that comprises a first verifying key and the first signing key, and
wherein the first verifying key is accessible to one or more computing devices that are members of a first computing environment;

removing the first signature from the application;
generating a signed application by associating a second signature with the application,
wherein the second signature is generated by a second signing key that is a member of a second cryptographic key pair that comprises a second verifying key and the second signing key,
wherein the second verifying key is accessible to one or more computing devices that are members of a second computing environment, and
wherein the first computing environment and the second computing environment are different computing environments selected from the group comprising: a development environment, a quality assurance environment, a testing environment, and a production environment;
wherein the signed application is loaded into memory at a computing device that determines at least one of:
that the signed application is verified if the computing device is a member of the second computing environment, or
that the signed application is not verified if the computing device is not a member of the second computing environment.

10. The non-transitory machine-readable medium of claim 9 , wherein the first computing environment and the second computing environment correspond to different security domain computing environments.

11. The non-transitory machine-readable medium of claim 9 , wherein the first computing environment and the second computing environment correspond to different business unit computing environments.

12. The non-transitory machine-readable medium of claim 9 , wherein the computing device verifies the signed application during initialization of the computing device.

13. The non-transitory machine-readable medium of claim 12 , wherein the initialization comprises using one or more verifying keys, wherein at least one of the one or more verifying keys is the second verifying key;
the initialization further comprising:
executing a firmware code to load a boot loader;
using the one or more verifying keys, verifying a signature associated with a boot loader;
upon verifying the signature associated with the boot loader, executing the boot loader to load an operating system kernel;
using the one or more verifying keys, verifying a signature associated with the operating system kernel; and
upon verifying of the signature associated with the operating system kernel, executing the operating system kernel,
wherein one of: i) the boot loader or ii) the operating system kernel, is the signed application.

14. The non-transitory machine-readable medium of claim 9 , wherein a package manager uses the second verifying key to verify the second signature.

15. A system comprising:
a server including one or more hardware processors coupled to a non-transitory memory and configured to read instructions from the non-transitory memory to cause the server to perform operations comprising:
receiving an application that includes a first signature, the first signature generated by a first signing key,
wherein the first signing key is a member of a first cryptographic key pair that comprises a first verifying key and the first signing key, and
wherein the first verifying key is accessible to one or more computing devices that are members of a first computing environment;

removing the first signature from the application;
generating a signed application by associating a second signature with the application,
wherein the second signature is generated by a second signing key that is a member of a second cryptographic key pair that comprises a second verifying key and th

Assignees

• Red Hat Inc

Inventors

• Jones Peter
• Cantrell David

Classifications

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• G06F21/575

  Secure boot · CPC title

• H04L9/3247 Primary

  involving digital signatures · CPC title

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F9/4406

  Loading of operating system · CPC title