Anti-rollback Protection for Non-persistent Software
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems lack an effective mechanism for preventing rollback of non-persistent firmware or software to vulnerable previous versions, which can compromise system security and allow malicious code execution, as anti-rollback solutions impact system usability and functionality.
Innovation Solution
Implementing an anti-rollback protection mechanism that includes storing a fallback version of software or firmware with a list of vulnerable versions, denying installation or update of vulnerable versions, and automatically recovering to the fallback version if a vulnerability is detected, ensuring only secure versions are loaded and maintained.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-rollback protection is implemented for non-persistent firmware or software, then system security is improved by preventing rollback to vulnerable versions, but device complexity increases due to additional protection mechanisms
Solution Approach 1:
The system performs preliminary actions by storing a fallback version of the software/firmware before installation, and maintaining a list of vulnerable versions in advance. When installation is attempted, the system checks whether the version is in the vulnerable versions list before allowing installation, thereby preventing rollback to vulnerable versions without requiring complex real-time analysis during installation.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a vulnerable versions list that mediates between the installation process and security requirements. This list acts as a reference that the installation system checks against, allowing security enforcement without requiring deep integration of security analysis into the installation process itself.
2Reliability
If anti-rollback protection mechanisms are added to prevent vulnerable version installation, then system security is improved, but ease of operation deteriorates due to potential installation failures and usability impact
Solution Approach 1:
The system creates a copy of the software/firmware in a fallback version before installation. This fallback copy serves as a backup that can be deployed if the main installation fails or if rollback to a vulnerable version is detected. The copying mechanism ensures that operational continuity is maintained while security is enforced, as the fallback version can be installed without requiring complex user intervention.
Solution Approach 2:
The system performs self-service by automatically checking whether a version is vulnerable and automatically installing the fallback version if needed. This automated behavior eliminates the need for users to manually manage security updates or understand vulnerability lists, thereby maintaining ease of operation while enforcing security requirements.
3Reliability
If fallback version storage and vulnerability checking are implemented, then system security is improved through automatic recovery, but loss of time increases due to additional verification steps during installation
Solution Approach 1:
The system performs preliminary actions by pre-storing the fallback version and pre-compiling the vulnerable versions list before the installation process begins. This allows the installation system to simply check against pre-prepared data rather than performing complex security analysis in real-time, thereby minimizing the time loss during installation while maintaining automatic recovery capability.
Data Source
AI summary
A method and apparatus for anti-rollback protection for a non-persistent software in a system. A software install package includes a main version of software and a fallback version of the software. The fallback version of the software includes a vulnerable versions list that includes a list of vulnerable versions of the software determined up to a release date of the fallback version of the software. The fallback version of the software is stored in the system. The main version of the software is installed if the main version of the software is not listed in the vulnerable versions list. The fallback version may be updated automatically if the new fallback version higher than the existing fallback version is received. The fallback version is stored in a fallback versions' repository by an operating system or installer. The fallback version may include an allowed versions list.