Boot Loader Update Security via Dual Processor Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for updating a boot loader in electronic devices are insecure against power anomalies, requiring doubled non-volatile memory capacity and risking uncontrollable reboots due to corruption during the update process.
Innovation Solution
A method utilizing a dual-processor system with an emergency power supply to secure the boot process, involving phases of stopping the boot loader update, invalidating the boot loader, and enabling delayed booting to update the boot loader without needing a second memory segment, thus ensuring integrity and reducing resource requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a dual boot solution with two non-volatile memory segments is used to secure boot loader updates, then reliability is improved, but device complexity and memory capacity requirements worsen
Solution Approach 1:
The system segments the boot process into two distinct phases executed by different processors: the first processor executes the boot loader from non-volatile memory, while the second processor performs the update operation. This segmentation allows the boot loader and update mechanism to operate independently, securing the boot process without requiring duplicate memory segments.
Solution Approach 2:
The second processor acts as an intermediary that mediates the boot loader update process. It receives update data, validates it, and writes it to the non-volatile memory while the first processor continues to execute the existing boot loader. This intermediary mechanism enables secure updates without requiring a second boot loader copy in memory.
2Reliability
If the boot loader update process is made secure against power anomalies, then reliability is improved, but the updating process time worsens
Solution Approach 1:
The system performs preliminary validation of the update data by the second processor before writing it to the non-volatile memory. The update data is checked for integrity and correctness in advance, and only valid updates are committed. This preliminary action prevents the need for repeated update attempts, actually reducing total update time while improving reliability.
Solution Approach 2:
The first processor continues to execute the existing boot loader uninterrupted while the second processor performs the update operation in parallel. This continuity ensures that the device remains operational throughout the update process, and the update can be completed without interrupting the boot function, reducing overall update time.
3Device complexity
If a single copy of the boot loader is stored in non-volatile memory to reduce cost, then device complexity is reduced, but reliability worsens due to corruption risk during updates
Solution Approach 1:
The system implements a self-service mechanism where the second processor automatically detects corruption in the boot loader and initiates recovery procedures. When corruption is detected, the second processor can restore the boot loader from a backup copy stored in the same non-volatile memory or from external storage, eliminating the need for duplicate memory segments while maintaining reliability.
Solution Approach 2:
The system incorporates feedback mechanisms where the second processor continuously monitors the integrity of the boot loader in non-volatile memory. Validation checks are performed on the boot loader data, and if corruption is detected during or after the update process, the system receives feedback and automatically triggers error handling procedures to restore system integrity without requiring additional memory capacity.
Data Source
AI summary
A device comprises a first processor and a second processor, the first processor being able to execute a boot loader. The device implements a phase of boot-securing in the event of an electrical anomaly occurring while the boot loader is being updated, the phase of boot-securing being implemented by way of an emergency power supply source acting as a relay for a main power supply, the phase of boot-securing comprising the following steps: stopping (203) the current updating of the boot loader; and invalidating (205) the boot loader. The device implements a phase of delayed booting of the second processor, enabling to boot the device in a boot loader update mode if said stored boot loader is invalid.