Software revocation infrastructure

• US 9,298,923 B2
• Filed: 09/04/2013
• Issued: 03/29/2016
• Est. Priority Date: 09/04/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Salowey, Joseph, Pritikin, Max
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US14/017,896
• Publication Number:
  US 20150067323A1
• Time in Patent Office: 937 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

In one implementation, software components include an identity of a revocation authority. Prior to loading of the software in a given platform, the revocation authority is checked for any revocation messages. The revocation authority creates software component specific messages for any software components to be revoked, rather than using certificate revocation or individual licenses. The messages include mitigation information, such as instructions for automatically configuring already installed software without requiring an update or change in code.

Claims

1. A method comprising:

distributing, over a network, multiple instances of a signed software component to multiple devices, the instances including an identification of a revocation authority;

noting, by a processor of the revocation authority, a vulnerability in a version of the signed software component;

identifying, by the processor of the revocation authority, a first signature that was used to sign the version of the signed software component;

receiving a request, at the processor of the revocation authority, for a revocation message of the signed software component; and

transmitting, by the processor of the revocation authority, the revocation message in response to the request, the revocation message including mitigation information only for the version of the signed software component that is signed by the first signature on one or more of the devices and including a second signature;

wherein the mitigation information includes information to reduce or remove the vulnerability;

wherein the revocation message disables the version of the signed software component until the vulnerability has been mitigated.

2. The method of claim 1 wherein distributing comprises distributing the signed software component comprises transmitting over the network.

3. The method of claim 1 wherein distributing comprises distributing with the instances including an expiration for revocation, and wherein the requests are received only for instances that are not past the expiration for the revocation.

4. The method of claim 1 wherein distributing comprises distributing with the instances including a revocation distribution mechanism, and wherein receiving comprises receiving the requests formatted according to the revocation distribution mechanism.

5. The method of claim 1 wherein receiving comprises receiving the requests as requests for a list including the revocation message.

6. The method of claim 1 wherein receiving comprises receiving the requests as look-ups from a list of revocation messages, including the revocation message, served by the revocation authority.

7. The method of claim 1 wherein transmitting comprises transmitting the revocation message in a list of other revocation messages, the other revocation messages being for other signed software components than the signed software component.

8. The method of claim 1 wherein transmitting comprises transmitting with the mitigation information for the configuration by filtering operation of the signed software component.

9. The method of claim 1 wherein transmitting comprises transmitting with the mitigation information for the configuration by changing behavior of the signed software component without installing an update of the signed software component, the change in behavior comprising disabling the signed software component, turning off part of the signed software component, altering an interface, altering a port, or combinations thereof.

10. The method of claim 1 further comprising:

receiving the revocation message from a third-party and re-signing the revocation message with the second signature, the second signature corresponding to a certificate of an authority trusted to redistribute revocation messages.

11. The method of claim 1 wherein transmitting comprises transmitting to an administrator for the device.

12. The method of claim 1 wherein transmitting comprises transmitting to the device, the mitigation information useable automatically by the device for the configuration.

13. The method of claim 1 wherein transmitting comprises transmitting the revocations message altered for an operating system of the one device.

14. Logic encoded in one or more non-transitory computer-readable media that includes code for execution and when executed by a processor is operable to perform operations comprising:

activating, by the processor, a software component on a platform, the software component including a first signature and having a version;

verifying, by the processor, that the first signature is valid and rooted in a trusted signing certificate;

checking, by the processor, for expiration of the software component;

checking, by the processor, for revocation of the version of the software component by a revocation authority, wherein the first signature is used to identify the version of the software component, wherein revocation disables the software component from loading;

receiving mitigation information, from the revocation authority, when the version is revoked, the mitigation information including includes information to reduce or remove a vulnerability in the version of the software component;

implementing, by the processor, the mitigation information for the software component; and

loading, by the processor, the software component.

15. The logic of claim 14 wherein activating, verifying, checking, receiving and implementing are performed prior to loading or installing the software component on the platform.

16. The logic of claim 14 further comprising verifying a second signature of the mitigation information after receiving the mitigation information.

17. The logic of claim 14 wherein processing the mitigation information comprises automatically configuring the software component without changing instruction code of the software component.

18. The logic of claim 14 wherein receiving the mitigation information comprises receiving a revocation message for the version of the software component and not for a certificate or a license.

19. Logic encoded in one or more non-transitory computer-readable media that includes code for execution and when executed by a processor is operable to perform operations comprising:

receiving, by a processor of a revocation authority, a message indicating that a version of software has a vulnerability;

identifying, by the processor of a revocation authority, a signature used to sign the version of software;

receiving, by the processor of a revocation authority, a request formatted pursuant to a distribution mechanism identified in metadata of the version of software

distributing, by the processor of a revocation authority, to a device, a signed revocation message comprising mitigation information for the vulnerability of the version of software signed by the signature, the mitigation information including one or more instructions for automatic mitigation by a platform loading the version of software signed by the signature;

wherein the revocation message disables the device from loading the version of software signed by the signature;

wherein the one or more instructions include instructions to reduce or remove the vulnerability in the version of the software component without changing code of the software.