Firmware Update Authentication via HSM Key Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic devices in operational technologies face challenges in authenticating firmware updates due to obsolete signature verification capabilities and lack of Internet access for certificate management, which can lead to potential system damage or security exposure.
Innovation Solution
A method and system that utilize a Hardware Security Module (HSM) with both online and offline components to verify firmware updates through a signing key and master key, including a revision number, and a Certificate Revocation List (CRL), allowing for periodic key replacement and revocation to ensure authenticity and security without relying on Internet connectivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional electronic signature verification is used in electronic devices, then the device can verify signatures of firmware updates, but the verification capability becomes obsolete over time when multiple signature versions are created and the device is updated infrequently
Solution Approach 1:
The patent implements a dynamic signature verification system where the electronic device can adapt to different signature versions. The verification module is designed to handle multiple signature algorithms and versions, allowing it to dynamically select and use the appropriate verification method based on the firmware update being installed. This resolves the contradiction by making the verification capability both reliable (maintaining security) and adaptable (compatible with multiple signature versions).
Solution Approach 2:
The system changes the parameter of signature verification by incorporating support for multiple signature algorithms and versions within the verification module. This allows the device to verify signatures using different cryptographic methods depending on which version is present, thereby maintaining reliability across varying signature formats without requiring frequent device updates.
2Reliability
If the electronic device is updated frequently to maintain signature verification capability, then the device can verify current signatures, but operational downtime increases which is unacceptable in industrial applications
Solution Approach 1:
The patent applies preliminary action by pre-configuring the electronic device with multiple signature verification capabilities and algorithms during manufacturing. This preliminary preparation ensures that when a firmware update with a different signature version arrives, the device can immediately verify it without requiring an update to its verification module. This eliminates the need for frequent updates and associated downtime, resolving the contradiction between maintaining verification reliability and avoiding operational interruptions.
3Reliability
If the electronic device is isolated from the Internet for security assurance, then the device security is improved, but the device cannot access Certificate Authorities for certificate management
Solution Approach 1:
The patent introduces an intermediary approach by implementing a self-contained certificate management system within the electronic device that does not require Internet access to Certificate Authorities. The device includes embedded root certificates and a verification module that can independently validate firmware signatures against these embedded certificates. This intermediary solution maintains security assurance through isolated operation while enabling certificate management functionality through pre-configured verification capabilities.
4Productivity
If the signature key is used for an extended period, then the system operates efficiently, but the signature key may become compromised
Solution Approach 1:
The patent implements periodic action by designing a system that automatically rotates signature keys at predetermined intervals or after a specific number of firmware updates. The verification module is configured to recognize and verify signatures from multiple key versions, and the system periodically updates the trusted signature keys stored in the device. This periodic key rotation maintains productivity by allowing continuous operation between updates while improving reliability by limiting the exposure window of each signature key.
Data Source
AI summary
A method provides a firmware update to an electronic device, to code signing for firmware updates of electronic devices, and a system therefor. In particular, the system and method for updates firmware that is authenticated through a public key infrastructure. The method includes an electronic device receiving a firmware update provided with a signature of a signing key, a signing certificate with a signature of a master key, and a revision number. The device verifies the signature of the master key on the signing certificate of the signing key, checks the revision number on the signing certificate of the signing key against a roll back counter, and verifies the signature of the signing key on the firmware update. The device then rejecting or accepting the received firmware update based on the outcome of the above verifying and checking.