Anti-Rollback Firmware Protection via Secure Element Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
NFC-enabled mobile devices are vulnerable to rollback attacks, where an attacker can downgrade the firmware to an older version, compromising security, especially when internal non-volatile memory is not available, and existing solutions like e-Fuse technology have limitations such as a fixed number of updates and scalability issues.
Innovation Solution
Implementing anti-rollback protection by storing the lowest acceptable firmware version number in a secure element environment, separate from the device's substrate, which allows comparison with the current firmware version to prevent downgrades, providing protection against both software and hardware attacks without relying on non-volatile memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If e-Fuse technology is used to store firmware version information, then anti-rollback protection is provided, but the number of updates is limited and physical access is required
Solution Approach 1:
The patent introduces a secure element as an intermediary component between the firmware and the version storage mechanism. This secure element contains a version register that stores the firmware version information, acting as a mediator that provides secure version tracking without requiring direct physical access to the firmware chip. The secure element communicates with the firmware through defined interfaces, enabling anti-rollback protection while maintaining update flexibility.
Solution Approach 2:
The patent segments the firmware system into separate functional components: the firmware itself, the secure element, and the version register. This segmentation allows the version information to be stored and managed independently in the secure element's version register, rather than being tied to the firmware chip's physical structure. This enables unlimited updates while maintaining anti-rollback protection.
2Reliability
If operating system level checks are implemented, then anti-rollback protection is provided, but the system is vulnerable to software attacks
Solution Approach 1:
The secure element acts as a trusted intermediary that stores version information in a protected environment isolated from the main operating system. The version register within the secure element provides a secure interface for version checking, preventing software attacks on the operating system from compromising the anti-rollback mechanism. The secure element's hardware-based protection ensures that version information cannot be manipulated by software vulnerabilities.
3Reliability
If version information is stored in internal non-volatile memory, then anti-rollback protection is provided, but the device cannot recover from memory loss or corruption
Solution Approach 1:
The secure element serves as a protected intermediary that safeguards version information from memory loss and corruption affecting the main device memory. The version register in the secure element maintains version data in a secure, protected environment that is separate from the device's internal non-volatile memory. This ensures that even if the device's internal memory is lost or corrupted, the version information remains intact and accessible for anti-rollback verification.
Data Source
AI summary
Methods, systems, computer-readable media, and apparatuses for providing anti-rollback protection in a device which has no internal non-volatile memory are presented. One embodiment is a device for providing anti-rollback protection. The device may obtain a firmware version number associated with a first firmware installation for the device, wherein the device is implemented on a substrate that includes no non-volatile memory. The device may obtain a lowest acceptable firmware version number, wherein the lowest acceptable firmware version number is stored in a secure element environment, wherein the secure element environment utilizes memory separated from the substrate. The device may compare the firmware version number and the lowest acceptable firmware version number, wherein if the firmware version number is less than the lowest acceptable firmware version number, then disallow the first firmware installation.