Dual-Server Firmware Update Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for remotely updating firmware and software in devices, even trusted ones, are vulnerable to malicious code introduction due to potential hacking or accidental non-verified code downloads, which can lead to catastrophic malfunctions in critical systems.
Innovation Solution
A dual-server system where only one updating server can be modified at a time, with a verification processor ensuring that code updates are identical across both servers before being downloaded to remote devices, preventing unauthorized or unverified updates by using a logical AND function and tamper-resistant methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single updating server is used to download firmware and software to remote devices, then the system is simpler and easier to operate, but the system becomes vulnerable to malicious code introduction and hacking
Solution Approach 1:
The single updating server is segmented into multiple updating servers (first updating server and second updating server). Each server can independently load and provide code updates, but the system requires coordination between them through a verification processor to ensure security. This segmentation distributes the security risk and prevents a single point of failure or compromise.
Solution Approach 2:
A verification processor is introduced as an intermediary component between the updating servers and the download process. This verification processor monitors access to both updating servers, compares code updates from each server, and controls the download operation based on verification results. The intermediary adds security without requiring complete system redesign.
2Reliability
If access to multiple updating servers is allowed simultaneously, then system availability is improved, but the risk of unauthorized or unverified code downloads increases
Solution Approach 1:
The verification processor performs preliminary actions by monitoring access to updating servers before code downloads occur. When a user accesses the first updating server to load code updates, the verification processor proactively suspends access to the second updating server by that same user. This preliminary access control prevents potential conflicts and ensures that only verified code updates can be downloaded.
Solution Approach 2:
The verification processor implements a feedback mechanism where it continuously monitors the state of both updating servers and adjusts access permissions accordingly. When code updates are loaded on one server, the verification processor provides feedback by controlling access to the other server, ensuring that downloads only occur when both servers have identical, verified code updates.
3Reliability
If code updates are downloaded without verification, then the download process is faster and more efficient, but malicious or unverified code may be introduced to remote devices
Solution Approach 1:
The system performs preliminary verification of code updates by comparing them from both the first and second updating servers before allowing downloads. The verification processor checks whether code updates from both servers are identical and sets appropriate inputs to enable or prevent downloads. This preliminary verification ensures authenticity while maintaining efficiency by only performing comparisons when necessary.
Data Source
AI summary
A method includes monitoring access by a first user to a first updating server and a second updating server, suspending access by the first user to the second updating server when the first user accesses the first updating server to load code updates to the first updating server, comparing a first code update from the first updating server and a second code update from the second updating server, and downloading the first code update based on the comparing step. The downloading step occurs only when the first code update and the second code update are identical.