Method for providing a firmware update of a device

Patent metadata

Field	Value
Publication number	US-11210079-B2
Application number	US-201816193658-A
Country	US
Kind code	B2
Filing date	Nov 16, 2018
Priority date	Nov 27, 2017
Publication date	Dec 28, 2021
Grant date	Dec 28, 2021

Abstract

A method provides a firmware update to an electronic device, to code signing for firmware updates of electronic devices, and a system therefor. In particular, the system and method for updates firmware that is authenticated through a public key infrastructure. The method includes an electronic device receiving a firmware update provided with a signature of a signing key, a signing certificate with a signature of a master key, and a revision number. The device verifies the signature of the master key on the signing certificate of the signing key, checks the revision number on the signing certificate of the signing key against a roll back counter, and verifies the signature of the signing key on the firmware update. The device then rejecting or accepting the received firmware update based on the outcome of the above verifying and checking.

First claim

The invention claimed is:

1. A method for providing a firmware update to a first device, comprising:
receiving together as a software package, at the first device, from a signing portal that provides software, the signing portal connected to a hardware security module (HSM) that contains an online portion that is designed to be always available and an offline portion that is designed to be only available when a new master key is created or when signing a signing certificate, the software package contains:
a firmware update signed with a signing key, the signing performed by the online portion of the HSM,
a signing certificate, the signing certificate being signed with the master key by an offline portion of the HSM, and
a revision number on the signing certificate,

verifying, at the first device, the signature on the firmware update using the public part of the signing key;
verifying, at the first device, the signature of the signing certificate using the public part of the master key;
checking, at the first device, the revision number on the signing certificate against a roll back counter; and
rejecting or accepting, at the first device, the received firmware update based on the outcome of the above verifying and checking.

2. The method according to claim 1 , wherein checking the revision number against the roll back counter comprises:
determining whether the revision number:
is equal to the roll back counter, and/or
is greater than the roll back counter, and/or
matches an expected consecutive number complying with a predetermined number series; and

updating the roll back counter if the revision number on the signing certificate is greater or matches an expected consecutive number.

3. The method according to claim 1 , further comprising:
verifying a signature on a revocation list; and
checking whether the signing certificate is listed as revoked on the revocation list.

4. The method according to claim 2 , wherein the predetermined number series is Fibonacci, prime numbers, or quadratic.

5. A computer implemented method for providing a firmware update to an electronic device, comprising:
at a signing portal, connected to a hardware security module (HSM) that contains an online portion that is designed to be always available and an offline portion that is designed to be only available when a new master key is created or when signing a signing certificate:
authenticating a firmware provider;
obtaining a firmware update from the authenticated firmware provider;
signing the firmware update by applying a signature with a private part of the signing key, generated by an online portion of the HSM;
providing a signing certificate with a revision number;
signing the signing certificate by applying a signature with a private part of the master key generated by an offline portion of the HSM;
providing the signed firmware update to the electronic device which verifies the signature on the firmware update using the public part of the signing key, verifies the signature of the signing certificate using the public part of the master key, checks the revision number on the signing certificate against a roll back counter, and rejects or accepts the received firmware update based on the outcome of the above verifying and checking.

6. The computer implemented method according to claim 5 , further comprising:
generating an updated signing key;
providing the public part of the updated signing key in the firmware update;
updating the revision number of the signing certificate and applying the signature of the master key to the signing certificate;
sending the firmware update to the electronic device;
providing an updated signing certificate; and
signing the updated signing certificate by applying the signature of the master key.

7. The computer implemented method according to claim 6 , further comprising:
revoking the signing certificate by updating the revocation list with the signing certificate; and
signing the updated revocation list by applying the signature of the master key.

8. The computer implemented method according to claim 5 , comprising:
generating an updated master key;
generating an updated master certificate of the updated master second key;
providing a domain signature to the updated master certificate by applying a domain root key;
providing a public part of the updated master key and the updated master certificate in the firmware update;
signing the firmware update by applying the signature of the signing key; and
sending the firmware update to the electronic device.

9. The computer implemented method according to claim 5 , comprising:
generating an updated master key;
generating a temporary master certificate of the updated master key;
providing a signature to the temporary master certificate by applying the master key;
providing a public part of the updated master key and the temporary master certificate in the firmware update; and signing the firmware update by applying the signature of the signing key.

10. The computer implemented method according to claim 9 , further comprising:
generating an updated master certificate of the updated master key; and
providing a domain signature to the updated master certificate by applying a domain root key.

11. The computer implemented method according to claim 8 , further comprising:
revoking the master certificate by updating the revocation list with the master certificate;
signing the updated revocation list by applying the signature of the domain root key;
generate a new signing certificate of the signing key; and
signing the new signing certificate by applying the signature of the updated master key.

12. A firmware update system, comprising:
a first electronic device comprising firmware, a Signature Management Module SMM, and a roll back counter;
a signing portal including a Hardware Security Module HSM including an online component storing one or more first keys, wherein the online component is designed to be designed to be always available and an offline component storing one or more second keys, wherein the offline component is designed to be only available when a new master key is created or when signing a signing certificate; and
the signing portal device configured to sign:
a software package by a private part of the signing key stored in the HSM online component, and
a signing certificate by a private part of the master key stored in the HSM offline component,

wherein the signing certificate comprises a revision number, and
wherein the SMM is configured to
verify the signature of the software package by the public part of the respective signing key, and
verify the signature of the signing certificate by the public part of the respective master key, and
check the revision number against the roll back counter, and
accept or reject the firmware update based on the outcome of the above verifying and checking.

13. The firmware update system according to claim 12 , wherein the HSM offline component further stores a domain/root key;
which domain key is used:
to provide a signature to a master certificate for each respective master key with a private part of the domain key; and
to provide a signature to a master certificate revocation list with the private part of the domain key.

14. The firmware update system according to claim 12 , further comprising a Certificate Revocation List CRL provided with the signature of the master key; and
wherein the SMM is further arranged for checking:
the signature of the CRL by the public part of the master key; and
whether the signing certificate is valid

Assignees

• Schneider Electric Ind Sas

Inventors

• Fassino Jean-Philippe
• Brun Jean-Michel

Classifications

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• G06F8/65 Primary

  Updates (security arrangements therefor G06F21/57) · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title