Double-Encrypted Firmware Update Security Against Jailbreaking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for updating firmware in computing devices are susceptible to untethered jailbreaking, as they rely on a single encryption key stored on the device, allowing malicious actors to generate and store jailbreak images for re-booting, which can be used for unauthorized access.
Innovation Solution
Implementing a double-encryption scheme where firmware is encrypted with a first crypto-key and then a second crypto-key, with the secure element decrypting the double-encrypted firmware using the second crypto-key before storage and the host processor decrypting it using the first crypto-key upon execution, ensuring only authorized firmware updates can re-boot the device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single encryption key is used for firmware, then the firmware update process is simple, but the device is vulnerable to untethered jailbreaking
Solution Approach 1:
The encryption key is segmented into two separate keys: a first encryption key stored in the host processor and a second encryption key stored in a secure element. The firmware is encrypted with both keys in sequence, creating a multi-layered security structure where each key provides a separate layer of protection against jailbreaking
Solution Approach 2:
A secure element is introduced as an intermediary component between the host processor and the firmware storage. This secure element holds the second encryption key and participates in the decryption process, acting as a mediator that prevents direct access to the firmware encryption key and blocks jailbreak attempts
2Reliability
If double-encryption is implemented, then security against jailbreaking is improved, but the decryption process becomes more complex
Solution Approach 1:
The decryption process is segmented into two distinct stages: first, the secure element decrypts the firmware image using the second encryption key to produce an intermediate decrypted image; second, the host processor decrypts this intermediate image using the first encryption key to produce the final firmware. This segmentation distributes the computational complexity across different components
Solution Approach 2:
The secure element performs part of the decryption process autonomously using its stored second encryption key, reducing the burden on the host processor. The host processor then completes the decryption using the first encryption key, creating a self-service decryption system where each component handles its portion of the decryption task
Data Source
AI summary
Embodiments of a method are disclosed. One embodiment is a method for securely updating firmware in a computing device, in which the computing device includes a host processor and a non-volatile memory. The method involves receiving a double-encrypted firmware image from an external firmware source, wherein the double-encrypted firmware image is generated from firmware that is encrypted a first time using a first crypto-key and then encrypted a second time using a second crypto-key. The method also involves receiving the second crypto-key from an external key source, decrypting the double-encrypted firmware image using the second crypto-key to produce an encrypted firmware image, storing the encrypted firmware image in the non-volatile memory of the computing device, reading the encrypted firmware image from the non-volatile memory of the computing device, decrypting the encrypted firmware image using the first crypto-key, and executing the firmware on the computing device.