METHOD, SYSTEM AND COMPUTER PROGRAM FOR DEPLOYING SOFTWARE PACKAGES WITH INCREASED SECURITY

• US 20070047735A1
• Filed: 08/21/2006
• Published: 03/01/2007
• Est. Priority Date: 08/23/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Secchi, Marco, Pichetti, Luigi, Ferri, Luca, Velati, Marcello, Celli, Massimiliano
• Granted Patent: US 8,230,222 B2
• Time in Patent Office: Days
• US Class Current: 380/30
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]

Abstract

A software distribution method (300) with security add-on is proposed. Particularly, any software package to be deployed to selected target endpoints is encrypted (312-315) with a symmetric key (generated dynamically). The symmetric key is in turn encrypted (318-321) with a public key of each target endpoint. A multi-segment software package (embedding the encrypted software package and the encrypted symmetric keys) is then deployed (324-336, 360) to all the target endpoints. In this way, each target endpoint can decrypt (343-348) the encrypted symmetric key with a corresponding private key; it is then possible to decrypt (363-366) the encrypted software package with the symmetric key so obtained. As a result, the endpoint is able to apply (369) the decrypted software package. Therefore, the application of the software package can be restricted to the desired target endpoints only.

Claims

1. A method for deploying software packages adapted to enforce software configurations in a data processing system including a plurality of target entities, each target entity being associated with a corresponding pair of private key and public key, wherein the method includes the steps of:

providing a software package to be deployed to a set of selected target entities,

associating a symmetric key with the software package,

encrypting at least a portion of the software package with the symmetric key,

for each selected target entity encrypting the symmetric key with the corresponding public key, and

deploying the encrypted software package and the encrypted symmetric keys to the selected target entities to enable each selected target entity to decrypt the corresponding encrypted symmetric key with the associated private key, to decrypt the encrypted software package with the decrypted symmetric key, and to apply the decrypted software package for enforcing the corresponding software configuration.

2. The method according to claim 1 wherein the step of deploying the encrypted software package and the encrypted symmetric keys includes:

distributing all the encrypted symmetric keys with an indication of the corresponding selected target entities to each selected target entity.

3. The method according to claim 2, wherein the step of distributing all the encrypted symmetric keys with the indication of the corresponding selected target entities includes:

building a further software package including all the encrypted symmetric keys with the indication of the corresponding selected target entities, and

distributing the further software package to each selected target entity.

4. The method according to claim 3, wherein for each selected target entity the further software package includes a command for decrypting the corresponding encrypted symmetric key with the associated private key, the command being conditioned to an identification of the selected target entity.

5. The method according to claim 3, wherein the step of deploying the encrypted software package and the encrypted symmetric keys further includes:

building a multi-segment software package including the further software package and the encrypted software package, and

distributing the multi-segment software package to each selected target entity.

6. The method according to claim 5, wherein for each selected target entity the step of distributing the multi-segment software package includes:

downloading the further software package, and

downloading the encrypted software package in response to a successful decryption of the corresponding encrypted symmetric key with the associated private key.

7. The method according to claim 6, further including the steps for each selected target entity of:

storing the decrypted symmetric key before downloading the encrypted software package, and

retrieving the decrypted symmetric key after downloading the encrypted software package.

8. The method according to claim from 1, wherein the software package includes an instruction section and a data section, the at least a portion of the software package consisting of the data section.

9. (canceled)

10. (canceled)

11. A computer program product including a computer-usable medium embodying a computer program, the computer program when executed on a data processing system causing the system to perform a method for deploying software packages adapted to enforce software configurations in the system, the system including a plurality of target entities each one being associated with a corresponding pair of private key and public key, wherein the method includes the steps of:

providing a software package to be deployed to a set of selected target entities,

associating a symmetric key with the software package,

encrypting at least a portion of the software package with the symmetric key,

for each selected target entity encrypting the symmetric key with the corresponding public key, and

deploying the encrypted software package and the encrypted symmetric keys to the selected target entities to enable each selected target entity to decrypt the corresponding encrypted symmetric key with the associated private key, to decrypt the encrypted software package with the decrypted symmetric key, and to apply the decrypted software package for enforcing the corresponding software configuration.

12. A system for deploying software packages adapted to enforce software configurations in a data processing system including a plurality of target entities, each target entity being associated with a corresponding pair of private key and public key, wherein the system includes:

means for providing a software package to be deployed to a set of selected target entities,

means for associating a symmetric key with the software package,

means for encrypting at least a portion of the software package with the symmetric key,

means for encrypting the symmetric key with the corresponding public key for each selected target entity, and

means for deploying the encrypted software package and the encrypted symmetric keys to the selected target entities to enable each selected target entity to decrypt the corresponding encrypted symmetric key with the associated private key, to decrypt the encrypted software package with the decrypted symmetric key, and to apply the decrypted software package for enforcing the corresponding software configuration.