System, device, and method of enabling identified systems when security sensitive functions have previously been enabled

Abstract

Systems, apparatuses, and methods are disclosed that enable identification of when a security sensitive function has been previously enabled. Therein, an electronic device includes a data store having a current content. Upon detecting an event indicative of an enablement of a security sensitive function of the electronic device, a value previously unknown to the electronic device is obtained, and based on the value and the current content of the data store, the current content of the data store is updated to a new current content of the data store according to an update function, wherein the current content of the data store can only be updated using the update function without privileged access. The value is further obtained in a management module, and, in the management module, based on the value and a known original content of the data store, an expected new current content of the data store is determined according to the update function. Upon determining that the new current content of the data store is different from the expected new current content of the data store, a verification module generates a security notification.

Description

Technical Field

[0001] This invention relates to the identification of possible tampering with electronic devices used for the first time, and more particularly to the identification of security-sensitive functions in electronic devices that have been previously enabled. Background Technology

[0002] Ensuring the integrity of electronic devices during manufacturing, and continuing until the camera is delivered to the end user so that the end user can be certain the device has not been tampered with, is crucial. Manufacturers may not have complete control over the supply chain from manufacturing to final delivery to the end user, making this difficult to guarantee. Therefore, it may be challenging to ensure that no external party can access and tamper with the device before it reaches the end user. This is particularly important for networked electronic devices such as connected cameras, as tampering with such devices could allow external parties to access the device after it is connected to a network (such as the internet), or compromise its integrity and / or security in other ways. Summary of the Invention

[0003] One object of the present invention is to provide a method and system for notifying when a security-sensitive function of an electronic device has been previously enabled, and a method and electronic device for enabling notification when a security-sensitive function of an electronic device has been previously enabled, to overcome or mitigate problems in existing methods and systems.

[0004] According to a first aspect, a method is provided for notifying when a security-sensitive function of an electronic device has been previously enabled, wherein the electronic device includes a data storage having current content. In the electronic device, an event indicating the activation of a security-sensitive function is detected. Upon detecting an event indicating the activation of a security-sensitive function, a previously unknown value is acquired in the electronic device, and based on this value and the current content of the data storage, the current content of the data storage is updated to a new current content using an update function, wherein the current content of the data storage can only be updated using the update function without privileged access. The new current content of the data storage is then forwarded from the electronic device to a verification module. The value is further acquired in a management module, and based on the value and the known original content of the data storage, the expected new current content of the data storage is determined in the management module according to the update function. The management module then forwards the expected new current content of the data storage to the verification module. In the verification module, the new current content of the data storage is compared with the expected new current content of the data storage. When the new current content of the data storage is determined to be different from the expected new current content of the data storage, the verification module generates a security notification.

[0005] An event indicating the activation of a security-sensitive function of an electronic device is any event from which it can be inferred that a security-sensitive function of the electronic device has been activated. Such a security-sensitive function can be any type of function that, when activated by an external party, may compromise the security of the electronic device.

[0006] The new current content refers to the content of the data storage after being updated using the update function. The update function and the value obtained make the new current content virtually always different from the current content. "Virtually always" means that the probability that the new current content will be the same as the current content after the update is so small that it has no practical effect. In this disclosure, when it is indicated that the new current content after being updated according to the update function will be different from the current content, it is intended to also cover update functions where the new current content could be the same as the current content, but this is so unlikely that it has no practical effect.

[0007] The original content is known to mean: the contents of the data storage during the time when the activation of security-sensitive functions of the electronic device has not occurred.

[0008] By updating the current content of the data storage based on the value at the time the security-sensitive function of the electronic device is detected and the current content of the data storage, no event indicating the activation of the security-sensitive function of the electronic device can be detected if the current content of the data storage is not updated according to the update function. Therefore, once an event indicating the activation of the security-sensitive function of the electronic device is detected for the first time, the current content of the data storage will be different from the original content. Furthermore, since the current content of the data storage can only be updated using the update function without privileged access, and since the data storage has known original content, the current content of the data storage cannot be updated to the original content again after the update without privileged access to the data storage. Thus, it is possible to determine from the new current content of the data storage whether the detection of the event indicating the activation of the security-sensitive function is the first time such an event has been detected, or whether the security-sensitive function of the electronic device was previously enabled. Specifically, since the expected new current content is determined according to the update function based on the value and the known original content, if the current content of the data storage is the same as the known original content, the new current content will only be the same as the expected new current content. This will not happen if the event indicating the activation of a security-sensitive function of an electronic device has already been detected in the electronic device.

[0009] Updating the current content of a data storage device to a new current content may include: concatenating a value with the current content of the data storage device, and hashing the concatenation using a known hash function. The current content of the data storage device is then updated such that the hashed concatenation of the value and the current content of the data storage device constitutes the new current content of the data storage device. If the known original content of the data storage device is "empty," determining the expected new current content of the data storage device in the management module may include: hashing the value using a known hash function, and determining the expected new current content of the data storage device as the hashed value. Otherwise, determining the expected new current content of the data storage device in the management module may include: obtaining the known original content of the data storage device, hashing the concatenation of the value and the known original content of the data storage device using a known hash function, and determining the expected new current content of the data storage device as the hashed concatenation of the value and the known original content of the data storage device.

[0010] "Empty" means that using a function to update the data store will result in the new current content being the same as performing the function on a value only. Empty can, for example, mean that the current content of the data store is "" (an empty string), or NULL, such as one or more "0"s. Empty can also mean that the current content of the data store is marked as uninitialized, and then a function can be configured such that the new current content is the same as performing the function on a value only.

[0011] By using the update function (which includes concatenating the value and the current content of the data store), hashing the concatenation, and updating the data store so that the new current content is the hashed concatenation, the new current content of the data store will be different from the current content before the update.

[0012] Retrieving a value in the management module may include determining the value within the management module. The value can then be forwarded from the management module to the electronic device, such that retrieving the value in the electronic device includes receiving the value from the management module.

[0013] By defining a value in the management module, the defined value can be controlled in the management module, and thus it can be ensured in the management module that the value was not previously known in the electronic device.

[0014] Events that indicate the activation of security-sensitive functions of an electronic device may consist of one of the following: setting the root password, setting the administrator password, etc.

[0015] According to a second aspect, a system is provided for notifying when a security-sensitive function of an electronic device has been previously enabled. The system includes: an electronic device, a management module, and a verification module. The electronic device includes a data storage having current content and device circuitry. The device circuitry is configured to perform: a detection function configured to detect an event indicating the activation of a security-sensitive function of the electronic device; a device value acquisition function configured to acquire a previously unknown value of the electronic device when the event indicating the activation of a security-sensitive function of the electronic device is detected by the detection function; an update function configured to update the current content of the data storage to a new current content of the data storage based on the value and the current content of the data storage, wherein the current content of the data storage can only be updated using the update function without privileged access; and a device forwarding function configured to forward the new current content of the data storage to the verification module. The management module includes: a management module circuit configured to perform a management module value acquisition function, which is configured to acquire a value; an expected new current content determination function configured to determine the expected new current content of the data storage based on the value and the known original content of the data storage, according to an update function; and a management module forwarding function configured to forward the expected new current content of the data storage to the verification module. The verification module includes a verification module circuit configured to perform a comparison function configured to compare the new current content of the data storage with the expected new current content of the data storage; and a notification generation function configured to generate a security notification when it is determined that the new current content of the data storage received from the electronic device differs from the expected new current content of the data storage.

[0016] Based on the aforementioned characteristics of the method in the first aspect, the second aspect also applies where applicable. To avoid excessive repetition, please refer to the above content.

[0017] According to a third aspect, a non-transitory computer-readable storage medium is provided, on which instructions are stored, which, when executed on a system according to a second aspect, are used to implement the method according to a first aspect.

[0018] Based on the aforementioned characteristics of the method in the first aspect, it also applies to the third aspect when applicable. To avoid excessive repetition, please refer to the above content.

[0019] According to a fourth aspect, a method is provided in an electronic device for enabling a notification when a security-sensitive function of the electronic device has previously been enabled, wherein the electronic device includes a data storage having current content. An event indicating the activation of a security-sensitive function of the electronic device is detected. Upon detecting the event indicating the activation of a security-sensitive function of the electronic device, a previously unknown value of the electronic device is acquired, and the current content of the data storage is updated to a new current content of the data storage based on the value and the current content of the data storage, according to an update function, wherein the current content of the data storage can only be updated using the update function without privileged access.

[0020] By updating the current content of the data storage based on the current content and the value at the time the activation event of the security-sensitive function of the electronic device is detected, the current content of the data storage is updated according to the update function. Without updating the current content of the data storage according to the update function, no event indicating the activation of the security-sensitive function of the electronic device can be detected. Therefore, once an event indicating the activation of the security-sensitive function of the electronic device is detected for the first time, the current content of the data storage will be different from the original content. Furthermore, since the current content of the data storage can only be updated using the update function without privileged access, the updated current content of the data storage cannot be updated back to the original content without privileged access to the data storage. Thus, it is possible to determine from the new current content of the data storage (i.e., the updated content) whether the detection of the event indicating the activation of the security-sensitive function is the first time such an event has been detected, or whether the security-sensitive function of the electronic device was previously enabled. Specifically, based on the knowledge of the update function and the original content of the data storage, it is possible to determine whether the current content of the data storage is equal to the known original content. This would not be the case if the event indicating the activation of the security-sensitive function of the electronic device had previously been detected in the electronic device. Alternatively, it can be determined from the new current content of the data storage whether the detection of the event indicating the activation of a security-sensitive function is the first time such an event has been detected, or whether the security-sensitive function of the electronic device was previously enabled. Specifically, it can only be determined that the event indicating the activation of a security-sensitive function of the electronic device was not previously detected in the electronic device if the current content is equal to the known original content.

[0021] Based on the aforementioned characteristics of the method in the first aspect, it also applies to the fourth aspect when applicable. To avoid excessive repetition, please refer to the above content.

[0022] According to a fifth aspect, an electronic device is provided, including a data storage having current content and device circuitry. The device circuitry is configured to perform a detection function, configured to detect an event indicating the activation of a security-sensitive function of the electronic device; a value acquisition function, configured to acquire a previously unknown value of the electronic device upon detecting the event indicating the activation of a security-sensitive function; and an update function, configured to update the current content of the data storage to a new current content of the data storage based on the value and the current content of the data storage, according to the update function, upon detecting the event indicating the activation of a security-sensitive function of the electronic device. The current content of the data storage can only be updated using the update function without privileged access.

[0023] Based on the aforementioned characteristics of the method in the first aspect, it also applies to the fifth aspect when applicable. To avoid excessive repetition, please refer to the above content.

[0024] According to a sixth aspect, a non-transitory computer-readable storage medium is provided, on which instructions are stored, which, when executed on a system according to a fifth aspect, are used to implement the method according to a fourth aspect.

[0025] Based on the aforementioned characteristics of the method in the first aspect, the sixth aspect also applies where applicable. To avoid excessive repetition, please refer to the above content.

[0026] According to a seventh aspect, a method is provided for notifying when a security-sensitive function of an electronic device has been previously enabled, wherein the electronic device includes a data storage having current content. An event indicating the enabling of a security-sensitive function of the electronic device is detected in the electronic device. Upon detecting an event indicating the enabling of a security-sensitive function of the electronic device, the current content of the data storage is forwarded to a verification module, a previously unknown value of the electronic device is acquired, and the current content of the data storage is updated to a new current content of the data storage based on that value and the current content of the data storage according to an update function, wherein the current content of the data storage can only be updated using the update function without privileged access. When the verification module determines that the current content of the data storage received from the electronic device is different from the original content of the data storage, a security notification is generated.

[0027] By updating the current content of the data storage based on its current content and the value at the time the activation event of a security-sensitive function of the electronic device is detected, the current content of the data storage is updated according to the update function. Without updating the current content of the data storage according to the update function, no event indicating the activation of a security-sensitive function of the electronic device can be detected. Therefore, once an event indicating the activation of a security-sensitive function of the electronic device is detected for the first time, the current content of the data storage will differ from the original content. Furthermore, since the current content of the data storage can only be updated using the update function without privileged access, the updated current content of the data storage cannot be updated back to the original content without privileged access to the data storage. Thus, it is possible to determine from the new current content of the data storage whether the detection of the event indicating the activation of a security-sensitive function is the first time such an event has been detected, or whether the security-sensitive function of the electronic device was previously activated. Specifically, it can only be determined that the event indicating the activation of a security-sensitive function of the electronic device was not previously detected in the electronic device if the current content is equal to the known original content.

[0028] Based on the aforementioned characteristics of the method in the first aspect, it also applies to the seventh aspect, where applicable. To avoid excessive repetition, please refer to the above content.

[0029] Further applicability of the invention will become apparent from the detailed description given below. However, it should be understood that the detailed description and specific examples illustrating preferred embodiments of the invention are given by way of illustration only, as various variations and modifications within the scope of the invention will become apparent to those skilled in the art from this detailed description.

[0030] Therefore, it should be understood that the present invention is not limited to the specific components of the described system or the operation of the described method, as such apparatus and methods can vary. It should also be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. It must be noted that, as used in the specification and appended claims, the articles “a,” “an,” “the,” and “the” are intended to indicate the presence of one or more elements unless the context clearly indicates otherwise. Thus, for example, “a unit” or “the unit” can include several means, etc. Furthermore, “comprising,” “including,” “containing,” and similar wording do not exclude other elements or steps. Attached Figure Description

[0031] The above and other aspects of the invention will now be described in more detail with reference to the accompanying drawings. The drawings should not be considered limiting, but rather for explanation and understanding. The same reference numerals denote the same elements throughout.

[0032] Figure 1 This is a schematic block diagram of an implementation of a system for notifying when a security-sensitive function of an electronic device has been previously enabled.

[0033] Figure 2 This is a flowchart of an implementation of a method for notifying when a security-sensitive function of an electronic device has been previously enabled.

[0034] Figure 3 This is a flowchart of another implementation of a method for notifying when a security-sensitive function of an electronic device has been previously enabled.

[0035] Figure 4 This is a schematic block diagram of an implementation of an electronic device for enabling notifications when a security-sensitive function of the electronic device has been previously enabled.

[0036] Figure 5 This is a flowchart of an implementation of a method for enabling notifications when a security-sensitive function of an electronic device has been previously enabled. Detailed Implementation

[0037] The invention will now be described more fully with reference to the accompanying drawings, which illustrate presently preferred embodiments of the invention. However, the invention may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided for thoroughness and completeness and to convey the scope of the invention to those skilled in the art.

[0038] The dashed lines in the diagram indicate that the features are optional.

[0039] Figure 1 This is a schematic block diagram of an implementation of a system 100 for notifying when a security-sensitive function of electronic device 110 has been previously enabled. The system includes: electronic device 110, management module 130, and authentication module 150. Electronic device 110 may be, for example, a networked electronic device, such as a networked camera, which should be connected to a network, such as the Internet. Management module 130 and authentication module 150 may reside in the same device or in different devices. For example, management module 130 and authentication module 150 may reside in the same or different cloud-based servers, or even within electronic device 110.

[0040] Events indicating the activation of security-sensitive functions of electronic device 110 may include, for example, the setting of a root password or an administrator password. Further events indicating the activation of security-sensitive functions include enabling debugging software functions, enabling hardware debugging functions (such as JTAG), scan chains, boundary scans, or other DFT logic. Further embodiments include access to networks, cloud services, and similar login tokens.

[0041] Electronic device 110 includes a data storage 114 containing current content and device circuitry 112. Device circuitry 112 is configured to perform the functions of electronic device 110.

[0042] Specifically, device circuit 112 is configured to perform detection function 122, which is configured to detect events indicating the activation of security-sensitive functions of indicator electronic device 110.

[0043] The device circuit 112 is further configured to perform a device value acquisition function 124, which is configured to acquire previously unknown values ​​of the electronic device 110 when an event indicating the activation of a security-sensitive function of the electronic device 110 is detected by the detection function 122.

[0044] The device circuit 112 is further configured to execute an update function 126, which is configured to update the current contents of the data storage 114 to the new current contents of the data storage 114 when an event indicating the activation of a security-sensitive function of the electronic device 110 is detected by the detection function 122. The update is based on the value and the current contents of the data storage 114, and is performed according to the update function. Furthermore, the electronic device 110 and / or the data storage 114 should ensure that, without privileged access, the current contents of the data storage 114 can only be updated using the update function.

[0045] Data storage 114 may be implemented, for example, via a permanent (or non-resettable) Platform Configuration Register (PCR), which may reside in a Trusted Platform Module (TPM) (not shown) or the like in electronic device 110. The TPM may be a hardware TMP of a so-called firmware TPM (fTPM), which is a software implementation of the TPM's functionality. Generally, the PCR may reside in a dedicated hardware block (security subsystem). Alternatively, the PCR may reside in other types of secure element hardware.

[0046] The update function should be irreversible; that is, after an update is performed according to the update function, it should be infeasible to perform a further update to make the contents of the data storage the same as before the update. Furthermore, the update function should be collision-resistant; that is, the update function should ensure that for a sufficiently long acquired value, the new current content should almost always be different from the current content. "Almost always" means that the probability that the new current content is the same as the current content after the update is so small that it has no practical effect. The acquired value for electronic device 110 should be previously unknown and should be long enough that the new current content is indeed always different from the current content when updated according to the collision-resistant update function. For example, 16 bytes is sufficient.

[0047] Update function 126 can be configured to update the current content of the data store by expanding the current content of the data store with a value. In this case, update function 126 concatenates the value and the current content of data store 114, and hashes the concatenation of the value and the current content of data store 114 using a known hash function. Data store 114 is then updated such that the hashed concatenation of the value and the current content of data store 114 is the new current content of data store 114. The known hash function should be collision-resistant and can be, for example, SHA-2, SHA-3, BLAKE2, SM3, or GHOST. Other alternative schemes are included, such as also including a counter in the concatenation, where the counter increments each time the data store is updated. The order of the hashed parameters can be...

[0048] The device circuit 112 is further configured to execute the device forwarding function 128, which is configured to forward the new current content of the data storage 114 to the verification module 150.

[0049] The management module 130 includes a management module circuit 132 configured to perform the functions of the management module 130.

[0050] Specifically, management module circuit 132 is configured to execute management module value acquisition function 142, which is configured to acquire a value. Management module value acquisition function 142 can be configured to determine a value, i.e., the value is determined within management module 130. The value can be, for example, a random number, i.e., any number that can only be used once in cryptographic communication. Management module circuit 132 can then be further configured to execute a value forwarding function (not shown), which is configured to forward the value to electronic device 110. Device value acquisition function 124 is then configured to receive a value from management module 130.

[0051] The management module circuit 132 is further configured to perform a new current content determination function 144, which is configured to determine the new current content of the data storage 114 based on the known original content of the value and data storage 114 according to the update function.

[0052] The management module circuit 132 can be further configured to perform a known original content acquisition function (not shown), which is configured to acquire the known original content of the data storage 114.

[0053] The expected new current content determination function can be further configured to hash the concatenation of the value and the known original content of the data store 114 using a known hash function, and determine the expected new current content of the data store 114 as the concatenation of the hash of the value and the known original content of the data store 114.

[0054] If the original content of data storage 114 is known to be empty, the expected new current content determination function 144 can be configured to hash the value using a known hash function and determine the expected new current content of data storage 114 as the hashed value. "Empty" means that updating the data storage using the function will result in the new current content being the same as performing the function on the value alone. "Empty" can, for example, mean that the current content of the data storage is "" (an empty string) or NULL, such as one or more "0"s. "Empty" could also mean that the current content of the data storage is marked as uninitialized, and then the function can be configured such that the new current content is the same as performing the function on the value alone.

[0055] The management module circuit 132 is further configured to execute the management module forwarding function 146, which is configured to forward the expected new current content of the data storage 114 to the verification module 150.

[0056] The verification module 150 includes a verification module circuit 152, which is configured to perform a comparison function 162, which is configured to compare the new current content of the data storage 114 with the expected new current content of the data storage 114.

[0057] The verification module circuit 152 is further configured to execute a notification generation function 164, which is configured to generate a security notification when it is determined that the new current content of the data storage 114 is different from the expected new current content of the data storage 114.

[0058] Device circuitry 112, management module circuitry 132, and verification module circuitry 152 may each include a processor (not shown), such as a central processing unit (CPU), microcontroller, or microprocessor. The processor may be configured to execute program code. The program code may, for example, be configured to perform the functions of electronic device 110, management module 130, and verification module 150, respectively.

[0059] Electronic device 110, management module 130, and verification module 150 may further include their respective memories (not shown). The memory may be one or more of a buffer, flash memory, hard disk drive, removable media, volatile memory, non-volatile memory, random access memory (RAM), or another suitable device. In a typical arrangement, the memory may include non-volatile memory for long-term data storage and volatile memory used as system memory. The memory can exchange data with associated circuitry via a data bus. Accompanying control lines and an address bus between the memory and associated circuitry may also be present.

[0060] The functions of electronic device 110, management module 130, and verification module 150 can be embodied in executable logic routines (e.g., lines of code, software programs, etc.) stored on their respective non-transitory computer-readable media (e.g., memory), and executed by device circuitry 112, management module circuitry 132, and verification module circuitry 152 (e.g., using a processor), respectively. Furthermore, the functions of electronic device 110, management module circuitry 132, and verification module circuitry 152 can be independent software applications or part of a software application that performs additional tasks related to electronic device 110, management module 132, and verification module 150. The described functions can be considered as methods configured to be executed by a processing unit (e.g., a processor). Similarly, while the described functions can be implemented in software, such functions can also be implemented via dedicated hardware or firmware, or a combination of hardware, firmware, and / or software.

[0061] Figure 2 This is a flowchart of an implementation of a method 200 for notifying when a security-sensitive function of an electronic device 110 has been previously enabled, wherein the electronic device 110 includes a data storage 114 having current content. The method may be implemented as per [reference to a specific implementation]. Figure 1 The system described is implemented in system 100.

[0062] Method 200 allows for untrusted delivery of electronic device 110 from the manufacturer to the customer. Furthermore, method 200 is beneficial, for example, if electronic device 110 allows factory default functions to erase all changes in a non-secure writable file system.

[0063] As an example, method 200 can be performed by a user at a customer's location where electronic device 110 has been delivered, in connection with the initial boot of electronic device 110. In this case, electronic device 110 can be connected to a network, such as the Internet. A management client (e.g., in the case of cloud-based servers) can be implemented. Figure 1 The described management module 130 can retrieve information related to the public key infrastructure (PKI) of the electronic device 110. When the electronic device 110 is connected to the network and started, it can boot into a state waiting for the root password (or administrator password) to be set. The password management function within the management client will then request the user to set the root password. The user can then set the root password. This setting of the root password is an event indicating that security-sensitive functions of the electronic device 110 have been enabled.

[0064] Method 200 includes a first set of steps performed in electronic device 110. An event indicating the activation of a security-sensitive function of electronic device 110 is detected in electronic device 110, S210. Upon detecting an event indicating the activation of a security-sensitive function of electronic device 110, electronic device 110 acquires a previously unknown value in S220, updates the current content of data storage 114 to the new current content of data storage 114 in S230, and forwards the new current content of data storage 114 to verification module 150 in S240. The current content of data storage 114 is updated to the new current content of data storage 114 based on the value and the current content of data storage 114, according to the update function in S230. When event S210 is detected, update S230 needs to be performed in electronic device 110. Therefore, if event S210 indicating the activation of a security-sensitive function of electronic device 110 is detected, update S230 will always occur. Furthermore, without privileged access, the current contents of data storage 114 can only be updated using the update function. Therefore, without privileged access, other updates to data storage 114 are impossible, and the contents of data storage 114 cannot be tampered with by an unauthorized user. Privileged access can be authenticated, for example, via the private key of electronic device 110.

[0065] Updating the current content of data storage 114 to its new current content S230 based on the value and the current content of data storage 114 according to the update function may include: concatenating the value and the current content of data storage 114, and hashing the concatenation of the value and the current content of data storage 114 using a known hash function. The current content of data storage 114 is then updated such that the hashed concatenation of the value and the current content of data storage 114 becomes the new current content of data storage 114. Alternative methods for updating the current content of data storage 114 to its new current content S230 are of course possible.

[0066] Method 200 may further include checking in electronic device 110 that the new current content of data storage 114 is different from the current content of data storage 114 before the update to ensure that the update is successful. If the known original content of data storage 114 is that data storage 114 is empty, the check may consist of checking that data storage 114 is not empty after the update to ensure that the update is successful.

[0067] Method 200 further includes a second set of steps performed in management module 130. A value is acquired in management module 130 S250, the expected new current content of data storage 114 is determined based on the value and the known original content of data storage 114 according to an update function S260, and the expected new current content of data storage 114 is forwarded from management module 130 to verification module 150. It should be noted that acquiring the value in management module 130 S250 does not need to be performed after the new current content is forwarded from electronic device 110 S240. Rather, the acquisition of the value can be performed at any earlier time.

[0068] In management module 130, determining the expected new current content of data storage 114 should use the same update function used in electronic device 110 to update the current content to the new current content. Therefore, determining the expected new current content of data storage 114 may include: a concatenation of the value and the known original content of data storage 114, and then hashing the concatenation using a known hash function. The expected new current content of data storage 114 is then determined as a concatenation of the hashed value and the known original content of data storage 114.

[0069] A request may come from the management module 130 before the electronic device 110 forwards the new current content of the data storage 114 to the verification module 150. Furthermore, the value obtained in the electronic device 110 may be a value determined in the management module 130, such as a random number. By determining the value in the management module 130, the determined value can be controlled within the management module 130, and therefore, it can be ensured in the management module 130 that the value was not previously known in the electronic device 110.

[0070] Forwarding the new current content of data storage 114 to verification module 150 may further include signing the new current content using the private key of electronic device 110 via the TPM of electronic device 110. Verification module 150 can then use the public key corresponding to the private key of electronic device 110, which has been previously received and authenticated by a certificate issued by a Certificate Authority (CA). Therefore, verification module 150 can verify that the new current content of data storage 114 was indeed received from electronic device 110 using the private key of electronic device 110 used for signing.

[0071] Previously unknown values ​​in electronic device 110 can also be used to verify that the reading of the new current content of data storage 114 received in verification module 150 is actually a reading of data storage 114 in response to an S210 event currently detected indicating the activation of a security-sensitive function of electronic device 110. This can be done by adding the value obtained in electronic device 110 to the new current content of data storage 114, and having the TPM of electronic device 110 sign the new current content of data storage 114 plus the obtained value with the private key of electronic device 110, and forwarding the signature to management module 130. The obtained value is previously unknown to electronic device 110, for example, in the form of a random number determined in management module 130, and forwarded to electronic device 110, and can be further forwarded from management module 130 to verification module 150. Verification module 150 can then check by comparing the obtained value received from management module 130 with the obtained value in the new current content of data storage 114 plus the obtained value received from electronic device 110.

[0072] In addition to the update function that knows the current content of the update data storage 114 used by electronic device 110, the known original content of the data storage 114 of electronic device 110 must be obtained in management module 130 in order to determine the expected new current content. Depending on how the original content is known, the known original content can be obtained in management module 130 in different ways. For example, the original content may be known that data storage 114 is initially always empty. Management module 130 can then assume that data storage 114 was initially empty. The known original content of data storage 114 can further depend on hardware type, version, etc. In this case, management module 130 may include a table indicating the known original content for each hardware type, version, etc., and then obtain the indication of the hardware type, version, etc. of electronic device 110 and identify the known original content from the table. The hardware type, version, etc., can be retrieved from electronic device 110 in management module 130, preferably signed by the TPM of electronic device 110 with the private key of electronic device 110. In cases where the known original content of data storage 114 is specific to each individual electronic device 110, management module 130 may need to retrieve the known original content of data storage 114 from the database after retrieving information indicating the individual electronic device 110 from the electronic device 110.

[0073] Method 200 further includes a third set of steps performed in the verification module 150. The new current content of the data storage 114 received from the electronic device 110 in the verification module 150 is compared with the expected new current content of the data storage 114 received from the management module 130, S280. If it is determined that the new current content of the data storage 114 differs from the expected new current content of the data storage 114, a security notification is generated in the verification module 150, S290. The security notification can then be sent from the verification module 150 to the management module 130, which can notify the user of the electronic device 110 that the security-sensitive functions of the electronic device 110 have been previously enabled. Alternatively, the security notification can be sent directly to the user from the verification module 150.

[0074] Figure 3 This is a flowchart of another embodiment of a method 300 for notifying when a security-sensitive function of an electronic device 110 has been previously enabled, wherein the electronic device 110 includes a data storage 114 having current content.

[0075] Method 300 allows for untrusted delivery of electronic device 110 from the manufacturer to the customer. Furthermore, method 300 is beneficial, for example, if electronic device 110 allows factory default functions to erase all changes in a non-secure writable file system.

[0076] Method 300 uses and involves Figure 2 The described method 200 shares the same concept, namely, upon detecting an event indicating the activation of a security-sensitive function of electronic device 110, the current content of data storage 114 is updated according to an update function, wherein, without privileged access, the current content of data storage 114 can only be updated using the update function, and the previous activation of a security-sensitive function of electronic device 110 can be detected based on the current state of data storage 114. Method 300 can be used in conjunction with... Figure 1 The system described, 100, is implemented in a system similar to the one described, and the system may, but must not, include the management module 130. Method 300 can also be used in conjunction with... Figure 2 In the same scenario described.

[0077] Method 300 includes a first set of steps in electronic device 110. An event indicating the activation of a security-sensitive function of electronic device 110 is detected in electronic device 110 (S310). Upon detection of the event, the current content of data storage 114 is forwarded to verification module 150 (S320). Then, a previously unknown value of electronic device 110 is acquired (S330), and the current content of data storage 114 is updated to the new current content of data storage 114 based on the value and the current content of data storage 114, according to the update function (S340). An update (S340) needs to be performed in electronic device 110 upon detection of event S310. Therefore, if the event S310 indicating the activation of a security-sensitive function of electronic device 110 is detected, update (S340) will always occur. Without privileged access, the current content of data storage 114 can only be updated using the update function.

[0078] Method 300 further includes a second set of steps in verification module 150. In step S320, the current contents of data storage 114 received from electronic device 110 are compared with the known original contents. (S350) Figure 2 As disclosed in method 200, the known original content can be obtained in different ways within the verification module 150. When it is determined that the current content of the data storage 114 received from the electronic device 110 differs from the known original content, a security notification S360 is generated by the verification module 150. The security notification can then be sent from the verification module 150 to the management module 130, which can notify the user of the electronic device 110 that security-sensitive functions of the electronic device 110 have been previously enabled. Alternatively, the security notification can be sent directly to the user from the verification module 150.

[0079] Method 300 and related Figure 2 The difference between the described methods 200 is that instead of forwarding the new current content of data storage 114 (i.e., after updating according to the update function) from electronic device 110 to verification module 150 in S240, the current content is forwarded to verification module S320 before updating according to update function S340. Since the update according to update function S340 must occur when an event indicating the activation of security-sensitive functions of electronic device 110 in S310 is detected in electronic device 110, if such an event had not been previously detected, the current content of data storage 114 would only be equal to the known original content. Therefore, the current content of data storage 114 received from electronic device 110 can be compared with the known original content of data storage 114 in verification module 150 to determine whether security-sensitive functions of electronic device 110 were previously enabled.

[0080] The steps of method 300 can be further adapted to involve Figure 2 The corresponding steps of method 200 are described.

[0081] Method 300 may further include checking in the electronic device 110 that the new current content of the data storage 114 is different from the current content of the data storage 114 before the update to ensure that the update is successful. If the known original content of the data storage 114 is that the data storage 114 is empty, the check may consist of checking that the data storage 114 is not empty after the update to ensure that the update is successful.

[0082] A request may come from the management module 130 before forwarding the current contents of data storage 114 to the verification module 150 in S320. Furthermore, the value obtained in the electronic device 110 may be a value determined in the management module 130, such as a random number. By determining the value in the management module 130, the determined value can be controlled in the management module 130, and therefore it can be ensured in the management module 130 that the value was not previously known in the electronic device 110.

[0083] Forwarding the current content of data storage 114 to verification module 150 in step S320 may further include signing the current content using the private key of electronic device 110 via the TPM of electronic device 110. Verification module 150 can then use the public key corresponding to the private key of electronic device 110, which has been previously received and authenticated by a certificate issued by a Certificate Authority (CA). Therefore, verification module 150 can verify that the current content of data storage 114 was indeed received from electronic device 110 using the private key of electronic device 110 used for signing.

[0084] Previously unknown values ​​in electronic device 110 can also be used to verify that the reading of the current content of data storage 114 received in verification module 150 is actually a reading of data storage 114 in response to an S310 event that indicates the activation of a security-sensitive function of electronic device 110. This can be done by adding the value obtained in electronic device 110 to the current content of data storage 114, having the TPM of electronic device 110 sign the current content of data storage 114 with the obtained value using the private key of electronic device 110, and forwarding the signature directly or via management module 130 to verification module 150. Management module 130 can then forward the obtained value to verification module 150. Verification module 150 can then check by comparing the obtained value received from management module 130 with the obtained value in the current content of signed data storage 114 plus the obtained value received from electronic device 110.

[0085] The known original content of the data storage 114 of the electronic device 110 must be obtained in the verification module 150 in order to compare it with the current content received from the electronic device 110. Depending on how the original content is known, the known original content can be obtained in different ways in the management module 150. For example, the original content may be known that the data storage 114 is initially always empty. The verification module 150 can then assume that the data storage 114 was initially empty. The known original content of the data storage 114 can further depend on the hardware type, version, etc. In this case, the verification module 150 may include a table indicating the known original content for each hardware type, version, etc., and then obtain the indication of the hardware type, version, etc. of the electronic device 110 and identify the known original content from the table. The hardware type, version, etc., can be retrieved from the electronic device 110 in the management module 130, preferably signed by the TPM of the electronic device 110 with the private key of the electronic device 110. In cases where the known original content of data storage 114 is specific to each individual electronic device 110, management module 130 may need to retrieve the known original content of data storage 114 from the database after retrieving information indicating the individual electronic device 110 from the electronic device 110.

[0086] Figure 4 This is a schematic block diagram of an implementation of an electronic device 110 that enables notifications when a security-sensitive function of the electronic device 110 has been previously enabled. Events indicating the activation of security-sensitive functions of the electronic device 110 may include, for example, the setting of a root password or an administrator password. Further events indicating the activation of security-sensitive functions include enabling debugging software functions, enabling hardware debugging functions (such as JTAG access), scan chains, boundary scans or other DFT logic, accessing networks, cloud services, and similar login tokens. The electronic device 110 includes a data storage 114 with current content and device circuitry 112. Device circuitry 112 is configured to perform the functions of device 110.

[0087] Specifically, device circuit 112 is configured to perform detection function 122, which is configured to detect events indicating the activation of security-sensitive functions of indicator electronic device 110.

[0088] Device circuit 112 is further configured to execute device value acquisition function 124, which is configured to acquire previously unknown values ​​of electronic device 110 when an event indicating the activation of a security-sensitive function of electronic device 110 is detected by a detection function. Device value acquisition function 124 may be configured to receive values, for example, from management module 130.

[0089] The device circuit 112 is further configured to execute an update function 126, which is configured to update the current contents of the data storage 114 to the new current contents of the data storage 114 when an event indicating the activation of a security-sensitive function of the electronic device 110 is detected by the detection function 122. The update is based on the value and the current contents of the data storage 114, and is performed according to the update function. Furthermore, the electronic device 110 and / or the data storage 114 should ensure that, without privileged access, the current contents of the data storage 114 can only be updated using the update function.

[0090] Data storage 114 may be implemented, for example, via a permanent (or non-resettable) platform configuration register (PCR), which may reside in a trusted platform module (TPM) (not shown) or the like in electronic device 110. The TPM may be a hardware TMP of a so-called firmware TPM (fTPM), which is a software implementation of the TPM functionality. Generally, the PCR may reside in a dedicated hardware block (security subsystem). Alternatively, the PCR may reside in other types of secure element hardware.

[0091] The update function 126 can be configured to concatenate the value and the current content of the data store 114, hash the concatenation of the value and the current content of the data store 114 using a known hash function, and update the data store 114 such that the hashed concatenation of the value and the current content of the data store 114 becomes the new current content of the data store 114.

[0092] Electronic device 110 typically enables notifications of previously enabled security-sensitive functions of the electronic device. To implement notifications, device circuitry 112 may be further configured to execute device forwarding function 128, which is configured to forward new current content of data storage 114 to a separate module, such as those involving... Figure 1 The management module 130 is described. (If applicable...) Figure 1 As further described, the management module 130 may include, together with the verification module 150, functionality for generating notifications.

[0093] Device circuitry 112 may include processor 116, such as a central processing unit (CPU), microcontroller, or microprocessor. Processor 116 may be configured to execute program code. The program code may, for example, be configured to perform the functions of electronic device 110.

[0094] Electronic device 110 may further include memory 120. Memory 120 may be one or more of a buffer, flash memory, hard disk drive, removable media, volatile memory, non-volatile memory, random access memory (RAM), or another suitable device. In a typical arrangement, memory 120 may include non-volatile memory for long-term data storage and volatile memory serving as system memory for electronic device 112. Memory 120 may exchange data with device circuitry 112 via a data bus. Accompanying control lines and an address bus between memory 120 and circuitry 112 may also be present.

[0095] The functionality of electronic device 110 may be embodied in the form of executable logic routines (e.g., lines of code, software programs, etc.) stored on a non-transitory computer-readable medium (e.g., memory 120) of device 110 and executed by device circuitry 112 (e.g., using processor 116). Furthermore, the functionality of electronic device 110 may be a standalone software application or part of a software application that performs additional tasks associated with electronic device 110. The described functionality can be considered as a method configured to be executed by a processing unit (e.g., processor 116 of electronic device 112). Similarly, while the described functionality may be implemented in software, such functionality may also be executed via dedicated hardware or firmware, or a combination of hardware, firmware, and / or software.

[0096] The functions of electronic device 110 can be further adapted to involve Figure 1 The corresponding functions of the described electronic device 110.

[0097] Figure 5This is a flowchart illustrating an implementation of a method 500 for enabling notification when a security-sensitive function of electronic device 110 has been previously enabled. Events indicating the enabling of a security-sensitive function of electronic device 110 may include, for example, the setting of a root password or an administrator password. Further events indicating the enabling of a security-sensitive function include enabling debugging software functions, enabling hardware debugging functions (such as JTAG access), scan chains, boundary scans, or other DFT logic, accessing networks, cloud services, and similar login tokens. Upon detecting an event indicating the enabling of a security-sensitive function of electronic device 110 in S210, electronic device 110 obtains a previously unknown value in S520, updates the current content of data storage 114 to the new current content of data storage 114 in S530, and forwards the new current content of data storage 114 to authentication module 150 in S540. Based on the value and the current content of data storage 114, according to the update function, the current content of data storage 114 is updated to the new current content of data storage 114 in S530. Upon detection of the S510 event, an update is required in electronic device 110. Therefore, if an event indicative of the activation of a security-sensitive function of electronic device 110 is detected by S510, an update will always occur. Furthermore, without privileged access, the current contents of data storage 114 can only be updated using the update function. Therefore, without privileged access, other updates to data storage 114 are impossible, and the contents of data storage 114 cannot be tampered with by an unauthorized user. Privileged access can be authenticated, for example, via the private key of electronic device 110.

[0098] Based on the value and the current content of data storage 114, updating the current content of data storage 114 to a new current content of data storage 114 according to the update function S530 may include: concatenating the value and the current content of data storage 114, and hashing the concatenation of the value and the current content of data storage 114 using a known hash function. The current content of data storage 114 is then updated such that the hashed concatenation of the value and the current content of data storage 114 becomes the new current content of data storage 114. Alternative methods for updating the current content of data storage 114 to a new current content of data storage 114 in S530 are of course possible.

[0099] Method 500 may further include checking in the electronic device 110 that the new current content of the data storage 114 is different from the current content of the data storage 114 before the update to ensure that the update is successful. If the known original content of the data storage 114 is that the data storage 114 is empty, the check may consist of checking that the data storage 114 is not empty after the update to ensure that the update is successful.

[0100] Method 500 may further include forwarding the new current content of data storage 114 to verification module 150 in step S540. A request from management module 130 may precede forwarding the new current content of data storage 114 to verification module 150. Furthermore, the value obtained in electronic device 110 may be a value determined in management module 130, such as a random number. By determining the value in management module 130, the determined value can be controlled in management module 130, and therefore, it can be ensured in management module 130 that the value is not previously known in electronic device 110.

[0101] Step S540, which forwards the new current content of data storage 114 to verification module 150, may further include signing the new current content using the private key of electronic device 110 via the TPM of electronic device 110. Verification module 150 can then use the public key corresponding to the private key of electronic device 110, which has been previously received and authenticated via a certificate issued by a Certificate Authority (CA). Therefore, verification module 150 can verify that the new current content of data storage 114 was indeed received from electronic device 110 using the private key of electronic device 110 used for signing.

[0102] Previously unknown values ​​in electronic device 110 can also be used to verify that the reading of the new current content of data storage 114 received in verification module 150 is actually a reading of data storage 114 in response to an S510 event currently detected indicating the activation of security-sensitive functions of electronic device 110. This can be done by adding the value obtained in electronic device 110 to the new current content of data storage 114, and having the TPM of electronic device 110 sign the new current content of data storage 114 plus the obtained value with the private key of electronic device 110, and forwarding the signature to management module 130. The obtained value is previously unknown in electronic device 110, for example, in the form of a random number determined in management module 130, and can be further forwarded from management module 130 to verification module 150. Verification module 150 can then check by comparing the obtained value received from management module 130 with the obtained value in the new current content of data storage 114 plus the obtained value received from electronic device 110.

[0103] The steps of method 500 can be further adapted to involve Figure 2 The corresponding steps of method 200 are described.

[0104] Those skilled in the art will recognize that the present invention is not limited to the embodiments described above. Rather, many modifications and variations are possible within the scope of the appended claims. These modifications and variations can be understood and implemented by those skilled in the art in practicing the claimed invention through a study of the drawings, the disclosure, and the appended claims.

Claims

1. A method for activating a notification when a security-sensitive function of an electronic device has been previously enabled, wherein, The electronic device includes a data storage device with current content, and the method includes: In the electronic device: Detect events that indicate the activation of security-sensitive functions of the electronic device; Upon detecting the event indicating the activation of a security-sensitive function of the electronic device: obtaining a previously unknown value of the electronic device, wherein the value is a random number; and based on the value and the current content of the data storage, updating the current content of the data storage to a new current content of the data storage according to an update function, wherein the current content of the data storage can only be updated using the update function without privileged access, and wherein the update function is irreversible and conflict-resistant.

2. The method of claim 1, further comprising notifying when a security-sensitive function of the electronic device has been previously enabled, the method further comprising: In the electronic device: upon detecting an event indicating the activation of a security-sensitive function of the electronic device: the new current content of the data storage is forwarded to the verification module; In the management module: obtain the value; based on the value and the known original content of the data storage, determine the expected new current content of the data storage according to the update function; And forward the expected new current content of the data storage to the verification module; In the verification module: the new current content of the data storage is compared with the expected new current content of the data storage; and when it is determined that the new current content of the data storage is different from the expected new current content of the data storage, a security notification is generated.

3. The method according to claim 2, wherein, In the electronic device, updating the current content of the data storage to the new current content of the data storage includes: The value is linked to the current content of the data storage; Hash the concatenation of the value and the current content of the data storage using a known hash function; and Update the current content of the data storage such that the concatenation of the value and the hash of the current content of the data storage is the new current content of the data storage.

4. The method according to claim 3, wherein, In the management module, determining the expected new current content of the data storage includes: In the case where the known original content of the data storage is that the data storage was originally empty: the value is hashed using the known hash function; and the expected new current content of the data storage is determined to be the hashed value; Otherwise: obtain the known original content of the data storage; hash the concatenation of the value and the known original content of the data storage using the known hash function; and determine the expected new current content of the data storage as the concatenation of the hash of the value and the known original content of the data storage.

5. The method according to claim 2, wherein, In the management module, obtaining the value includes determining the value, and the method further includes: in the management module, forwarding the value to the electronic device, and wherein, in the electronic device, obtaining the value includes: receiving the value from the management module.

6. The method according to claim 1, wherein, The event that indicates the activation of the security-sensitive functions of the electronic device consists of either the setting of the root password or the setting of the administrator password.

7. The method according to claim 1, wherein the method comprises: In the electronic device: upon detecting an event indicating the activation of a security-sensitive function of the electronic device: the current contents of the data storage are forwarded to the verification module; In the verification module: when it is determined that the current content of the data storage received from the electronic device is different from the known original content of the data storage, a security notification is generated.

8. An electronic device comprising: A data storage device containing the current content; as well as The device circuitry is configured to perform: The detection function is configured to detect events that indicate the activation of security-sensitive functions of the electronic device; A device value acquisition function is configured to acquire a previously unknown value of the electronic device upon detecting an event indicating the activation of a security-sensitive function of the electronic device, wherein the value is a random number; and An update function is configured to, upon detecting an event indicating the activation of a security-sensitive function of the electronic device, update the current content of the data storage to a new current content based on the value and the current content of the data storage, wherein the current content of the data storage can only be updated using the update function without privileged access, and wherein the update function is irreversible and conflict-resistant.

9. A system for notifying when a security-sensitive function of an electronic device has been previously enabled, the system comprising: The electronic device according to claim 8; Management module; as well as Verification module, The device circuitry is further configured to perform a device forwarding function, configured to forward the new current content of the data storage to the verification module. The management module includes: a management module circuit configured to execute: a management module value acquisition function, configured to acquire the value; an expected new current content determination function, configured to determine the expected new current content of the data storage based on the value and the known original content of the data storage, according to the update function; and a management module forwarding function, configured to forward the expected new current content of the data storage to the verification module. Furthermore, the verification module includes: a verification module circuit configured to perform: a comparison function configured to compare the new current content of the data storage with the expected new current content of the data storage; and a notification generation function configured to generate a security notification when it is determined that the new current content of the data storage is different from the expected new current content of the data storage.

10. The system according to claim 9, wherein, The update function is further configured as follows: The value is linked to the current content of the data storage; The concatenation of the value and the current content of the data storage is hashed using a known hash function; as well as Update the data storage such that the concatenation of the hash of the value and the current content of the data storage is the new current content of the data storage.

11. The system according to claim 10, wherein, The known original content of the data storage is that the data storage was originally empty, wherein the expected new current content determination function is configured as follows: The value is hashed using the known hash function; and The expected new current content of the data storage is determined to be the hashed value.

12. The system according to claim 10, wherein, The management module circuit is further configured to execute: The known original content acquisition function is configured to acquire the known original content of the data storage. Furthermore, the expected new current content determination function is configured as follows: The concatenation of the value and the known original content of the data storage is hashed using the known hash function; and The expected new current content of the data storage is determined as the concatenation of the value and the hash of the known original content of the data storage.

13. The system according to claim 9, wherein, The management module value acquisition function is configured to determine the value, wherein the management module circuit is further configured to execute a value forwarding function, the value forwarding function is configured to forward the value to the electronic device, and wherein the device value acquisition function is configured to receive the value from the management module.

14. The system according to claim 9, wherein, The event that indicates the activation of the security-sensitive functions of the electronic device consists of either the setting of the root password or the setting of the administrator password.

15. A non-transitory computer-readable storage medium storing instructions that, when executed on a system according to claim 9, are used to implement the method according to claim 2, or when executed on an electronic device according to claim 8, are used to implement the method according to claim 1.

Images