Portable Chip Loader Update Using Dual-Key Mailbox Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing portable chip devices face security challenges during software updates due to the use of symmetric keys stored permanently in flash loaders, which lack flexibility and security, and require additional memory and processors for asymmetric authentication.
Innovation Solution
Implementing a dual-key system with an asymmetric first key for authentication and a symmetric second key for update execution, using a 'mailbox' function to transfer secure data from the operating system to the loader, reducing the need for permanent storage of symmetric keys and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric authentication with first key is implemented, then security and flexibility of software updates are improved, but chip area requirements increase
Solution Approach 1:
The authentication system is segmented into two distinct keys with different functions: the first key (asymmetric) handles authentication and authorization, while the second key (symmetric) handles actual update execution. This segmentation allows each key to be optimized for its specific purpose, with the asymmetric key being more secure but larger, and the symmetric key being smaller and faster for execution.
Solution Approach 2:
The symmetric second key is extracted from permanent storage in the flash loader and instead stored temporarily in a mailbox memory during update execution. This extraction reduces the permanent storage requirements in the flash loader while maintaining security, as the second key is only present in memory when needed for update execution.
2Ease of operation
If symmetric key is stored permanently in flash loader, then update execution is simplified, but security risk increases due to permanent storage
Solution Approach 1:
The storage of the second key transitions from static (permanent storage in flash loader) to dynamic (temporary storage in mailbox memory). The second key is loaded into memory only when an update is being executed and is cleared afterward, creating a dynamic storage pattern that reduces security risks associated with permanent storage while maintaining ease of operation during active updates.
Solution Approach 2:
The second key is discarded from permanent storage in the flash loader and recovered temporarily in the mailbox memory only when needed for update execution. After the update process completes, the second key is discarded from memory, ensuring it does not remain stored permanently. This approach maintains operational simplicity while eliminating the security risk of permanent symmetric key storage.
3Adaptability or versatility
If additional processors are added for asymmetric authentication, then authentication capability is improved, but device complexity increases
Solution Approach 1:
The existing processor in the portable chip device is made multi-functional by implementing both asymmetric authentication (using the first key) and symmetric update execution (using the second key) within the same hardware. This eliminates the need for separate dedicated processors for each function, reducing device complexity while maintaining full authentication capability.
Data Source
AI summary
A portable chip device comprises a chip having an operating system and a loader, the loader being configured to load a software module onto the chip and/or to render the software module in the chip executable, a communications interface configured to communicate with an external reader, the portable chip device being configured to carry out a software module update by: receiving a second key in the loader via communication between the external reader and the communications interface, where the communication is encrypted with a first key, and storing the second key in the loader, the operating system being configured to provide the decryption of the communication encrypted with the first key, authenticating the external reader using the symmetric key stored in the loader, receiving software module update data in the loader via the communications interface, and executing the software module update with the software module update data.