Firmware security

Patent metadata

Field	Value
Publication number	US-9418229-B2
Application number	US-201414525318-A
Country	US
Kind code	B2
Filing date	Oct 28, 2014
Priority date	Oct 28, 2013
Publication date	Aug 16, 2016
Grant date	Aug 16, 2016

Abstract

One embodiment provides an apparatus adapted to perform a secure firmware upgrade. The apparatus includes a first memory and a second memory. The first memory stores a private key for use in decrypting content and a unique identifier corresponding to the apparatus. The second memory includes a first version of firmware for the apparatus. The apparatus further includes a controller configured to perform an operation that includes receiving a first request to perform a firmware update operation for the apparatus. The operation also includes transmitting a second request for a second version of firmware to a remote server, the second request specifying the unique identifier corresponding to the apparatus. Additionally, in response to transmitting the second request, an encrypted firmware package is received from the remote server. The operation further includes decrypting the encrypted firmware package using the private key and installing the decrypted firmware package on the apparatus.

First claim

What is claimed is:

1. An apparatus, comprising:
a first memory comprising:
a device-specific token;
a private key for use in decrypting content; and
a unique identifier corresponding to the apparatus;

a second memory comprising a first version of firmware for the apparatus; and
a controller configured to perform an operation, comprising:
receiving a first request to perform a firmware update operation for the apparatus;
transmitting a second request for a second version of firmware to a remote server, the second request specifying the unique identifier corresponding to the apparatus;
in response to transmitting the second request, receiving an encrypted firmware package from the remote server;
further in response to transmitting the second request, receiving a second token from the remote server;
decrypting the encrypted firmware package using the private key; and
installing the decrypted firmware package on the apparatus, comprising:
initiating an installation of the decrypted firmware package on the apparatus;
during the installation of the decrypted firmware package, restarting the apparatus;
comparing, by a bootloader of the apparatus, the device-specific token with second token received from the remote server; and
upon determining that the device-specific token and the second token do not match, aborting the installation of the decrypted firmware package on the apparatus.

2. The apparatus of claim 1 , wherein the protected memory is a private memory that is only accessible by a bootloader of the apparatus.

3. The apparatus of claim 2 , wherein the protected memory is a read only memory, and wherein the protected memory is not accessible by any software application executing on the apparatus.

4. The apparatus of claim 1 , wherein the private key is generated according to an asymmetric cryptography technique.

5. The apparatus of claim 1 , wherein the private key and the unique identifier are written to the first memory by a manufacturer of the apparatus.

6. A system, comprising:
a processor; and
a memory containing a program that, when executed by the processor, performs an operation comprising:
receiving a request to add a first device to a device registry, the request specifying (i) a unique identifier corresponding to the first device and (ii) a key for use in encrypting data relating to the first device;
adding the unique identifier and key for the first device to the device registry;
receiving, from the first device, a request for an updated firmware package, the request specifying the unique identifier corresponding to the first device;
retrieving the key by accessing the device registry using the unique identifier;
encrypting a firmware package using the retrieved key; and
transmitting the encrypted firmware package to the first device for installation.

7. The system of claim 6 , wherein the received request further specifies a device-specific token corresponding to the first device, and the operation further comprising:
transmitting the device-specific token to the first device together with the encrypted firmware package.

8. The system of claim 6 , wherein the request to add a first device to a device registry is received from a manufacturer of the device.

9. The system of claim 6 , wherein the key is a public key generated according to an asymmetric cryptography technique, and wherein the first device is configured with a corresponding private key for use in decrypting the encrypted firmware package.

10. The system of claim 9 , wherein the public key and the private key are both generated by a manufacturer of the first device.

11. A method, comprising:
generating a public key and a private key for a first device;
generating a unique identifier corresponding to the first device;
storing the generated private key onto a first memory of the first device;
storing the generated unique identifier corresponding to the first device onto a second memory of the first device;
transmitting a request to add the first device to a device registry to a remote server, the request specifying (i) the unique identifier and (ii) the generated public key; and
installing control logic on the first device configured to:
retrieve a private key stored in the first memory;
decrypt a firmware package received from the remote server, using the retrieved private key; and
install the decrypted firmware package on the first device.

12. The method of claim 11 , wherein the first memory of the first device is a protected memory that is only accessible by a bootloader of the first device.

13. The method of claim 12 , wherein the protected memory is a read only memory, and wherein the protected memory is not accessible by any software application executing on the first device.

14. The method of claim 11 , further comprising:
generating a device-specific token corresponding to the first device;
storing the device-specific token onto the first memory of the first device; and
transmitting the device-specific token to the remote server for inclusion in the device registry.

15. The method of claim 14 , wherein a bootloader of the first device is configured to compare the device-specific token with second token received from the remote server as part of an installation of a firmware package, and, upon determining that the device-specific token and the second token do not match, is further configured to abort the installation of the firmware package on the first device.

16. The method of claim 12 , wherein a controller of the first device is configured to perform an operation, comprising:
receiving a first request to perform a firmware update operation for the first device, wherein a first version of firmware is installed on the first device;
transmitting a second request for a second version of firmware to the remote server, the second request specifying the unique identifier corresponding to the first device;
in response to transmitting the second request, receiving an encrypted firmware package from the remote server;
decrypting the encrypted firmware package using the private key burned onto a first memory of the first device; and
installing the decrypted firmware package on the first device.

17. The method of claim 11 , wherein logic on the remote server is configured to perform an operation comprising:
receiving the request to add the first device to a device registry;
adding the unique identifier and key for the first device to the device registry;
receiving, from the first device, a request for an updated firmware package, the request specifying the unique identifier corresponding to the first device;
retrieving the key by accessing the device registry using the unique identifier;
encrypting a firmware package using the retrieved key; and
transmitting the encrypted firmware package to the first device for installation.

18. The method of claim 11 , wherein the public key and the private key are generated according to an asymmetric cryptography algorithm.

Assignees

• Disney Entpr Inc

Inventors

• Lau Gary K
• Strange Gregory J
• Simkowiak Derek

Classifications

• G06F8/654

  using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F8/65

  Updates (security arrangements therefor G06F21/57) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title