Firmware Verification Using Segmented Key Pairs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The limited storage space in electronic devices poses a challenge for updating firmware, as it restricts the number of security keys that can be discarded, necessitating a method to verify and manage firmware validity effectively.
Innovation Solution
A method and apparatus for verifying firmware involve using public keys to authenticate firmware certificates and signatures, ensuring the validity of firmware by comparing hash values and managing key pairs and fingerprints to ensure secure installation, thereby addressing storage limitations and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple security keys are stored for firmware verification, then firmware security and update capability are improved, but storage space is consumed
Solution Approach 1:
The security key management is segmented into multiple key pairs (first key pair and second key pair) with distinct functions. The first key pair handles initial firmware verification while the second key pair handles updated firmware verification. This segmentation allows secure firmware updates without storing all possible security keys simultaneously, thus maintaining security while managing storage space efficiently.
2Productivity
If firmware verification process is simplified, then installation speed is improved, but security verification completeness may be compromised
Solution Approach 1:
The system performs preliminary actions by pre-storing the first public key in the electronic device before firmware updates occur. The first key pair is established in advance, allowing the device to immediately verify firmware signatures without requiring complex real-time key management. This preliminary setup enables both fast verification and complete security checks.
Solution Approach 2:
The patent introduces an intermediary verification mechanism using hash values. Instead of directly comparing entire firmware images, the system computes hash values of the firmware and compares these compact representations. This intermediary step significantly reduces verification time and computational overhead while maintaining complete security verification through the cryptographic hash function.
Data Source
AI summary
A method for verifying firmware includes verifying a firmware certificate of the firmware using a first public key, verifying validity of a second public key included in the firmware certificate in response to successful verification of the firmware certificate, verifying the firmware using the second public key in response to successful verification of validity of the second public key, and in response to successful verification of validity of the firmware, installing the firmware in memory of an electronic device to operate hardware of the electronic device according to the firmware.