驱动程序签名定义.pdfVIP

Digital Signatures for Kernel Modules on Systems Running Windows Vista July 25, 2007 Abstract For Windows Vista? and later versions of the Windows ? family of operating systems: Kernel-mode software must have a digital signature before it will load on x64- based computer systems. Boot-start drivers should contain an embedded signature. Certain configurations of x86 systems require kernel-mode software to have digital signatures to access next-generation premium content depending on content protection policy. This paper describes how to manage the signing process for kernel-mode software for Windows Vista. This information applies for the following operating systems: Windows Vista Windows Server? 2008 The current version of this paper is maintained on the Web at: /whdc/winlogo/drvsign/kmsigning.mspx References and resources discussed here are listed at the end of this paper. Contents Introduction 3 Digital Signatures as a Best Practice 4 Kernel-Mode Code-Signing Options 4 The Kernel-Mode Code-Signing Process . 6 How to Obtain a Software Publishing Certificate 6 Guidance for Safeguarding Code-Signing Keys 7 Using Cross-Certificates with Kernel-Mode Code Signing 7 Verification During Driver Installation and Loading 8 Generating Test Certificates 9 Creating a Signed Catalog File 10 How to Create a Catalog File 10 How to Create a Catalog File By Using Inf2Cat 11 How to Create a Catalog File Manually 12 How to Sign a Catalog File 12 Signing the Self-Extracting Download file 13 How to Install a Signed Catalog File 14 Adding an Embed