Key revocation for edge devices

Patent metadata

Field	Value
Publication number	US-12519633-B2
Application number	US-202117548431-A
Country	US
Kind code	B2
Filing date	Dec 10, 2021
Priority date	Dec 31, 2020
Publication date	Jan 6, 2026
Grant date	Jan 6, 2026

Abstract

Described herein are techniques of remotely performing key revocation on a device that cannot communicate outside of a local network of the device. The techniques involve including key revocation instructions in software update instructions that are sent to the device. The device may verify the software update instructions using one or more keys to determine whether they are safe for execution on the device. For example, the device may verify that the software update instructions have been sent by a trusted software provider. The device may execute the key revocation instructions included in the software update instruction to revoke use of a key of the key(s), and initiate use of a new key in place of the revoked key.

First claim

What is claimed is:

1 . A method for performing a key revocation on an edge device, the method comprising:
generating, by a processor, a first software provider signature using a first software provider key corresponding to a first device key stored on the edge device; generating, by the processor, a second software provider signature using a second software provider key corresponding to a third device key that is to be used in place of the first device key after revocation; transmitting, by the processor without connectivity to the edge device, to a host system within a local network of the edge device, instructions for updating software installed on the edge device, wherein:
the instructions for updating the software include:
instructions for revocation of the first device key and initiating use of the third device key in place of the first device key; and
a software image,

the instructions for updating the software are signed with both the first software provider signature generated by the software provider system and a user signature generated by a user system separate from the software provider system using a user key corresponding to a second device key stored on the edge device, and
the software image is signed with the second software provider signature;
receiving, by the host system, the instructions from the processor; transmitting, by the host system to the edge device, the instructions; receiving, by the edge device from the host system, the instructions; performing, by the edge device, internal to the edge device and exclusive of communications to the host system, a verification operation of the instructions to verify the first software provider signature and the user signature using the first device key and the second device key stored on the edge device, the performing of the verification operation comprising:
verifying the first software provider signature of the instructions using the first device key corresponding to the first software provider key; and
verifying the user signature of the instructions using the second device key corresponding to the user key; and
after verifying both the first software provider signature and the user signature, executing by the edge device, internal to the device and exclusive of communications to the host system, the instructions, wherein execution of the instructions causes the edge device to:
revoke use of the first device key; and
initiate use of the third device key in place of the first device key.

2 . The method of claim 1 , wherein the device does not have Internet connectivity.

3 . The method of claim 1 , wherein the device cannot communicate with a third party verification authority.

4 . The method of claim 2 , wherein the device is an edge device.

5 . The method of claim 1 , wherein performing the verification operation of the instructions to verify the first software provider signature and the user signature using the first device key and the second device key stored on the device comprises:
verifying, using a first bootloader of the device, the instructions using the first device key; and verifying, using a second bootloader of the device, the instructions using the second device key.

6 . The method of claim 5 , wherein executing the instructions comprises executing the instructions using the second bootloader.

7 . The method of claim 1 , wherein the third device key is stored in the device prior to receipt of the instructions for revoking the first device key.

8 . The method of claim 1 , wherein revocation of a given device key can be performed up to a predetermined number of times.

9 . The method of claim 1 , further comprising:
receiving, from the host system within the local network of the device, a second set of instructions for updating software installed on the device, wherein the second set of instructions includes instructions for revocation of the second device key; and executing the second set of instructions, wherein execution of the second set of instructions causes the device to:
revoke use of the second device key; and
initiate use of a fourth device key in place of the second device key.

10 . A system for performing key revocation on an edge device, the system comprising:
a wireless communication circuit without having connectivity to the edge device to a host system within a local network, the edge device having a first device key corresponding to a first software provider key generated by the system and a second device key corresponding to a user key generated by a user system separate from the system; and a processor configured to:
generate a first software provider signature using the first software provider key generated by the system and corresponding to the first device key;
generate a second software provider signature using a second software provider key corresponding to a third device key that is to be used in place of the first device key after revocation;
transmit, using the wireless communication circuit to the host device within the local network of the edge device, instructions for updating software installed on the edge device, wherein:
the instructions for updating the software include a software image,
the instructions for updating the software are signed with:
the first software provider signature generated using the first software provider key generated by the system; and
a user signature generated by the user system separate from the system using the user key corresponding to the second device key, and

the software image is signed with the second software provider signature;
the host device, configured to receive the instructions from the wireless communication circuit; and the edge device, configured to wirelessly receive the instructions from the host device, perform, internal to the edge device and exclusive of communications to the host system, a verification operation of the instructions to verify the first software provider signature and the user signature, and execute, internal to the edge device and exclusive of communications to the host system, the instructions to revoke use of the first device key of the edge device and initiate use of the second device key in place of the first device key.

11 . The system of claim 10 , wherein the processor is further configured to sign the instructions using the first software provider key generated by the system.

12 . The system of claim 10 , wherein the processor is further configured to sign the software image using the second software provider key.

13 . The system of claim 10 , wherein the processor is further configured to generate the instructions by including, in the instructions, key revocation instructions and the software image.

14 . The method of claim 1 , wherein:
the first software provider key is a first private key generated by the software provider system and the first device key is a public key corresponding to the first private key generated by the software provider system; and the second software provider key is a second private key generated by the software provider system and the third device key is a public key corresponding to the second private key generated by the software provider system.

15 . The method of claim 1 , wherein:
the user key of the user system is a private key of the user system; and the second device key is a public key corresponding to the private key of the user system.

16 . The method of claim 1 , further comprising, after executing the instructions, verifying the second software provider signature of the software i

Assignees

• Analog Devices Inc

Inventors

• Simon Jonathan Noah
• Poo Tze Lei

Classifications

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title