Safe mode loader for operating system of an embedded device

Abstract

A method for providing a safe backup for an operating system (OS) of an embedded device that is in communication with a server, wherein embedded device comprises the OS and a loader, wherein the loader is a component of the embedded device that is separate from the OS, the method includes detecting that there has been an interruption in a normal operation of the OS, and engaging a safe mode of the loader, wherein the safe mode sustains connectivity between the embedded device and the server, and diagnoses an error that caused the interruption.

Description

SAFE MODE LOADER FOR OPERATING SYSTEM OF AN EMBEDDED DEVICEDESCRIPTIONFIELD OF USE

[0001] The present disclosure relates, generally, to integrated circuit chips, and, more particularly, to maintaining host device connectivity of embedded integrated circuit chips.BACKGROUND

[0002] Digital devices (Laptop, Handsets, etc.) allow for an operating system (OS) upgrade process, especially where there is a network connection available. The reasons for upgrading an OS are numerous: major bug fixing, adding new features, upgrading the OS with new standards and new crypto algorithms, ESG. OS upgrades involve two parts: a loader, responsible for managing a secure channel with the downloading server and responsible to download a new OS image to be installed on the targeted component; the second concerns giving the OS the capability to take back all previous data and applications of the previous OS. In a device that relies on a subscriber identity module (SIM), typically an Embedded Universal Integrated Circuit Card (eUlCC) OS handles both of these concerns. If the eUlCC OS was to encounter a fatal error, it would not be able to sustain connectivity for the host device. In this case, there would be no way to report the issue to a remote entity and possibly no or very limited way to diagnose the technical issue.SUMMARY

[0003] An aspect of the present disclosure is directed toward a method for providing a safe backup for an operating system of an embedded device that is in communication with a server, wherein embedded device comprises an operating system (OS) and a loader, wherein the loader is a component of the embedded device that is separate from the OS, the method comprising detecting that there has been an interruption in a normal operation of the OS, and engaging a safe mode of the loader, wherein the safe mode is configured to sustain connectivity between the embedded device and the server, and diagnose an error that caused the interruption.

[0004] As a separate component, this Loader would be ideally suited to implement a limited backup of the activity if the main OS was to encounter a fatal error. Thus, a loader according to the present disclosure could provide improved product resilience, end-user experience, and diagnosis capabilities. This would serve to extends the lifetime of the embedded device.

[0005] In an aspect of the disclosure, the safe mode is further configured to report the diagnoses to the server.

[0006] In an aspect of the disclosure, the safe mode is further configured to repair the issue.

[0007] In an aspect of the disclosure, repairing the issue comprises downloading and install a new main operating system image.

[0008] In an aspect of the disclosure, the loader is configured to sustain connectivity with the server by acting as a IIICC for the embedded device.

[0009] In an aspect of the disclosure, the loader is configured with a default or temporary connectivity parameter so as to maintain connectivity with the server.

[0010] An aspect of the disclosure is directed toward a system for providing a safe backup for an operating system of an embedded device by a loader that is in communication with a server, the system comprising the embedded device and the server, the embedded device comprising a loader and an operating system (OS), wherein the loader is a component of the embedded device that is separate from the OS, wherein the loader is configured to detect that there has been an interruption in a normal operation of the operating system, and engage a safe mode, wherein the safe mode is configured to sustain connectivity between the embedded device and the server, and diagnose an error that caused the interruption.

[0011] In an aspect of the disclosure, the safe mode is further configured to report the diagnosis to the server.

[0012] In an aspect of the disclosure, the safe mode is further configured to repair the issue.

[0013] In an aspect of the disclosure, repairing the issue comprises downloading and installing a new main operating system image.

[0014] In an aspect of the disclosure, the loader is configured to sustain connectivity with the server by acting as a IIICC for the embedded device.

[0015] In an aspect of the disclosure, the loader is configured with a default or temporary connectivity parameter so as to maintain connectivity with the server.

[0016] An aspect of the disclosure is directed toward an embedded device comprising an operating system (OS) and a loader, wherein the loader is a separate component from the OS, wherein the loader is configured to detect that there has been an interruption in a normal operation of the embedded device, and engage a safe mode, wherein the safe modeis configured to sustain connectivity between the embedded device and a server, and diagnose the error that caused the interruption.

[0017] In an aspect of the disclosure, the safe mode is further configured to report the diagnosis to the server.

[0018] In an aspect of the disclosure, the safe mode is further configured to repair the issue.

[0019] In an aspect of the disclosure, repairing the issue comprises downloading and installing a new main operating system image.

[0020] In an aspect of the disclosure, the loader is configured to sustain connectivity with the server by acting as a IIICC for the embedded device.

[0021] In an aspect of the disclosure, the loader is configured with a default or temporary connectivity parameter so as to maintain connectivity with the server.DESCRIPTION OF THE DRAWINGS

[0022] For a better understanding of the various described embodiments, reference should be made to the Detailed Description below, in conjunction with the following drawings in whichh like reference numerals refer to corresponding parts throughout the figures.

[0023] FIG. 1 is an exemplary illustration of a device according to the present disclosure;

[0024] FIG. 2 is an exemplary illustration of a device with an integrated circuit inlay according to the present disclosure;

[0025] FIG. 3 is an exemplary high-level block diagram of an architecture of the integrated circuit according to the present disclosure; FIG. 4 is anexemplary high-level block diagram of a memory of the integrated circuit according to the present disclosure;

[0026] FIG. 4 is an exemplary flow diagram of a method according to the present disclosure;

[0027] FIG. 5 is an exemplary network diagram according to the present disclosure; and

[0028] Fig. 6 is an exemplary diagram of a failure-mode server connection according to the present disclosure.DETAILED DESCRIPTION

[0029] Several aspects of the disclosure with reference to the appended drawings are now explained. Whenever the shapes, relative positions and other aspects of the parts described are not explicitly defined, the scope of the invention is not limited only to the parts shown, which are meant merely for the purpose of illustration. Also, while numerous details are set forth, it is understood that some aspects of the disclosure may be practiced without these details. In other instances, well-known circuits, structures, and techniques have not been shown in detail so as not to obscure the understanding of this description.

[0030] The following description includes references to various methods executed by a processor of an integrated circuit chip. As is common in the field, there may be phrases herein that indicate these methods or method steps are performed by software instructions or software modules. As a person skilled in the art knows, such descriptions should be taken to mean that a processor, in fact, executes the methods, software instructions, and software modules.

[0031] It is further noted that, unless otherwise indicated, the steps of provided methods may be conducted in a different order than the order in which they are provided, where a person of skill in the art would find it tobe appropriate. Additionally, unless otherwise noted that steps and / or procedures are mandatory, it may be possible to omit certain steps where they may be extraneous. Thus, while certain steps and / or procedures may be indicated as "optional," this does not imply that the remaining steps are mandatory unless otherwise noted.

[0032] Aspects of the present disclosure are directed toward a safe loader that acts as a failsafe to an operating system (OS) of an embedded device. This loader, in addition to protecting and guaranteeing a complete download of an OS, offers a safe mode for the OS to maintain connectivity. In addition, the safe loader provides secure logging of what happened to the OS and applications in case of major failure. Such logs can help a support team to rapidly find the issue and to solve it.

[0033] With more and more complexity put on embedded systems, there remains a need for a plan for a complete recovery even in case of major failure or attacks on the OS and supported applications. An Embedded Universal Integrated Circuit Card (eUlCC) product supporting an OS upgrade process thus may involve a software component called a Loader that may be responsible for securely downloading a new OS image to be installed on the targeted component. Consequently, this Loader component would be a software component running on the same chip as the main OS image while remaining distinct from the main OS image.

[0034] The safe loader of the present disclosure detects when the OS or applications are failing, especially during an upgrade of the OS. It is able to log enough information on the exact root cause of the failure (attacks, NVM issues, bugs) to be retrieved later during examination of the failing pieces or transmitted during a "safe" connection. In case of major failure, the safe loader can even ask a connection by itself and be able to transmit the secure logging detailing the failure. Through this newly established connection a new OS can be reloaded to restart the system.

[0035] FIG. 1 represents a drawing of an exemplary integrated circuit chip 101 , such as one that may be embedded in a device, such as, forexample, an electronic device. The electronic device may be constituted by e.g., a smart phone, a vehicle, a virtual reality device, an augmented reality device, an loT type device, a set-top box, a tablet computer, a desktop computer, a laptop computer, a video player, an audio player, a media-player, a game console, a netbook, a Personal Digital Assistant (or PDA) and / or any other computer device. Such a set of devices is given as mere device examples that may be used without being exhaustive.

[0036] In another example, the device may be an "enabled" device, such as, for instance, a smart card 104 that may include the integrated circuit chip 101 as an inlay within the structure of the card. The technology may be used for any integrated circuit chip applications, such as, for instance, passports, security badges, credit cards, etc. The terminology “smart card” may be used herein to refer to such a system.

[0037] FIG. 2 shows that the device 201 may also contain an antenna 205 connected to the integrated circuit chip 203 by which the integrated circuit chip 203 communicates with a backend server, such as via a communication channel.

[0038] FIG. 3 is a high-level block diagram of an architecture of the integrated circuit chip 303. The integrated circuit chip 303 contains a processor 301 , a memory structure 304, which stores data and programs executable by the processor 301 , and a loader 311 . The memory structure 304 may contain one or more of each of a random-access memory (RAM) 305, read-only memory (ROM) 307, and non-volatile programmable memory (NVM) 309. The memory devices 305, 307, and 309 are connected to the processor 301 via a bus 313.

[0039] The integrated circuit chip 303 further contains an input / output interface 317 for communicating to external devices, e.g., a server and / or a terminal, via the antenna 320. For contactless communication, the input / output interface 317 may communicate with a terminal over the ISO 14443 protocol. In any case, the embedded device may connect by any of known means, be it wired or wireless, to the server.

[0040] Alternatively or additionally, the integrated circuit chip 303 may include electrical contacts (not shown) for communicating over a contact interface to a backend server, for example, according to the ISO-7816 protocol or the Universal Serial Bus (USB) protocol.

[0041] The server may be remote and accessible through possibly one, two or more communication networks, such as an Intranet network and / or an Internet network, that allow to define or form a corresponding communication channel.

[0042] Alternatively or additionally, the server or a software component may be local. For example, the server is embedded within a device (not represented), such as a secure element that is connected or communicatively coupled to the embedded device.

[0043] Alternatively or additionally, instead of being constituted by a physical server, it may be constituted by a software component, such as a library, or a hardware component included in (or connected to) the device carries out the functions that are described infra and that are performed by the server.

[0044] The server memory(ies) store(s) preferably, besides an OS, one or several applications to be executed, so that the server provides one or several corresponding services. For instance, an application stored by the server and / or the embedded device is an application to carry out the method of the safe loader.

[0045] FIG. 4 is a block diagram illustrating data and programs stored in a memory 403 that corresponds to the memory 305 of FIG. 3. In a preferred embodiment, the data and programs illustrated as stored in the memory 403 are stored in an NVM 409 that corresponds to the NVM 309 of FIG. 3. However, other memory organizations are possible.

[0046] The memory 403 contains programs 401 and the loader 411 . The programs 401 are computer program instructions that cause theprocessor 301 to perform certain actions. The programs 401 include an operating system 405 and applications programs 407.

[0047] The operating system 405, in turn, contains a variety of operating system functions 409. The operating system functions 409 may include, for example, a virtual machine for executing the application programs 407 and memory management functions.

[0048] The loader 411 , which is described in greater detail below, performs functions related to receiving a firmware upgrade and managing the processes related to implementing the upgrade. The loader 411 of the present disclosure is a software component that is separated from the operating system image 405. That is to say, the loader 411 is provided as a separate and / or distinct component. The loader 411 thus would be ideally suited to implement, for instance, a limited backup of the activity if the main OS 405 was to encounter a fatal error.

[0049] Fig. 5 demonstrates a "safe mode" operated by the loader 411 to allow a safe back up for the OS 405. The embedded device may detect an ongoing and / or future interruption in normal operation of the device, as in step 502. The interruption may be unplanned or planned. For instance, interruptions may be due to security issues, bugs, obsolescence of the OS 405, etc. The interruption may occur during an upgrading of the current OS 405 of the embedded device, which is to say, when the embedded device is in the process of obtaining and implementing changes to the OS 405. Such a process may leave the OS 405 particularly vulnerable to faults. The detection may be by a component of the connected device, such as the loader 411 . Alternatively, the detection may be made externally to the connected device, and thus instruction to enter safe mode may be sent to the connected device, such as to the loader 411.

[0050] The safe mode may be activated, for example, upon detection of an ongoing and / or future interruption in normal operation of the device as in Step 506.

[0051] The loader 411 implementing the Safe Mode may maintain connectivity with the server, as in step 510, which is to say that the loader 411 may reestablish and / or sustain host device connectivity. For instance, the loader 411 may act as a UICC. In such a case, the loader may be configured with a default or temporary connectivity parameters so as to maintain connectivity.

[0052] The loader 411 may diagnose the error encountered by the main OS 405, as in Step 513. For example, the loader may retrieve error logs left by the main OS 405. The loader may be in communication with the main OS 405 during, before, and / or after a fault so as to conduct said diagnosis. In this way, the logging of information may be done, at least partly, by the OS 405 itself. The OS 405 may be able to log enough information on the root cause of the failure, which may then later be retrieved by the loader 411 and / or transmitted once the loader 411 has established a "safe" connection. Alternatively and / or additionally, the loader 411 may conduct an analysis of the main OS 405 code and / or data.

[0053] Beyond improving end-user experience, sustaining connectivity would also allow the device to, while in safe mode, report the error diagnosis information that may have been determined by the loader 411 . For example, the error diagnoses information may be reported to a dedicated remote entity.

[0054] Additionally, the connectivity while in safe mode would allow the device to attempt to repair the issue, as in Step 519. For example, the loader 411 may download and / or install a new main OS image. This may serve to fix the issue that lead to the engagement of safe mode, as the loader 411 also supports the OS upgrade process. Once the issue has been resolved, it may be desirable to disengage safe mode so as to return the device to normal operation. Safe mode may be disengaged by, for example, instructing the device to reset.

[0055] FIG. 6 demonstrates an aspect of the system where there is a fault with the embedded device 602, and specifically of the OS 606. The OS606 and the loader 609 may both be stored within the device 602, such as within a memory 612 as previously described, but may be separate components therein. The fault of the OS 606 may lead to a loss of connection between the OS 606 and an external server 615. Thus, when the fault is detected, such as by the loader 609, the connection to the embedded device 602, which previously may have been with the OS 606, will be initiated with the loader 609. The loader 609 may then perform the safe mode operation as described previously.

[0056] While certain aspects have been described and shown in the accompanying drawings, it is to be understood that such are merely illustrative of and not restrictive on the broad invention, and that the invention is not limited to the specific constructions and arrangements shown and described, since various other modifications may occur to those of ordinary skill in the art. The description is thus to be regarded as illustrative instead of limiting.

Claims

CLAIMSWhat is claimed is:1 . A method for providing a failsafe for an operating system (OS) of an embedded device that is in communication with a server, wherein the embedded device comprises an OS and a loader, wherein the loader is a component of the embedded device that is separate from the OS, the method comprising: detecting that there has been an interruption in a normal operation of the OS, and engaging a safe mode of the loader, wherein the safe mode is configured to sustain connectivity between the embedded device and the server, and diagnose an error that caused the interruption.

2. The method of claim 1 , wherein the safe mode is further configured to report the diagnosis to the server.

3. The method according to claim 1 , wherein the safe mode is further configured to repair the issue.

4. The method according to claim 3, wherein repairing the issue comprises downloading and installing a new main OS image.

5. The method according to claim 1 , wherein the loader is configured to sustain connectivity with the server by acting as a universal integrated circuit card for the embedded device.

6. The method according to claim 5, wherein the loader is configured with a default or temporary connectivity parameter so as to maintain connectivity with the server.

7. The method according to claim 1 , wherein the normal operation is an OS upgrade procedure.

8. A system for providing a failsafe for an operating system (OS) of an embedded device by a loader that is in communication with a server, the system comprising the embedded device and the server, the embedded device comprising a loader and an OS, wherein the loader is a component of the embedded device that is separate from the OS, wherein the loader is configured to detect that there has been an interruption in a normal operation of the operating system, and engage a safe mode, wherein the safe mode is configured to sustain connectivity between the embedded device and the server, and diagnose an error that caused the interruption.

9. The system according to claim 7, wherein the safe mode is further configured to report the diagnosis to the server.

10. The system according to claim 6, wherein the safe mode is further configured to repair the issue.

11. The system according to claim 8, wherein repairing the issue comprises downloading and installing a new main OS image.

12. The system according to claim 6, wherein the loader is configured to sustain connectivity with the server by acting as a universal integrated circuit card for the embedded device.

13. The system according to claim 12, wherein the loader is configured with a default or temporary connectivity parameter so as to maintain connectivity with the server.

14. An embedded device comprising an operating system (OS) and a loader, wherein the loader is a separate component from the OS, wherein the loader is configured todetect that there has been an interruption in a normal operation of the embedded device, and engage a safe mode, wherein the safe mode is configured to sustain connectivity between the embedded device and a server, and diagnose the error that caused the interruption.

15. The embedded device according to claim 12, wherein the safe mode is further configured to report the diagnosis to the server.

16. The embedded device according to claim 14, wherein the safe mode is further configured to repair the issue.

17. The embedded device according to claim 16, wherein repairing the issue comprises downloading and installing a new main OS image.

18. The embedded device according to claim 14, wherein the loader is configured to sustain connectivity with the server by acting as a universal integrated circuit card for the embedded device.

19. The embedded device according to claim 18, wherein the loader is configured with a default or temporary connectivity parameter so as to maintain connectivity with the server.

Images