Kernel Module Secure Boot via Chameleon Hash Collision
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure boot processes in electronic devices require kernel developers to intervene in updating kernel modules, even for third-party developed modules, which delays important security updates and restricts the agility of kernel module updates.
Innovation Solution
A computer-implemented method using a chameleon hash collision function to create a secured updated kernel module by combining the updated kernel module with collision data, allowing third-party entities to update kernel modules without the need for kernel developer intervention while maintaining security through cryptographic hash functions and Merkle trees.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If kernel modules are updated through traditional secure boot processes requiring kernel developer intervention, then security verification is maintained, but update speed and responsiveness to security issues deteriorate
Solution Approach 1:
The patent segments the secure boot verification process by separating the root of trust verification from individual kernel module updates. The root public key in read-only memory verifies the firmware module signature, which contains the kernel private key that signs the kernel. This segmentation allows third-party kernel modules to be verified through the established trust chain without requiring kernel developer intervention for each update.
Solution Approach 2:
The patent implements preliminary action by pre-establishing the trust chain during firmware initialization. The root public key is written in read-only memory before device operation, and the firmware module signatures are pre-verified. This preliminary setup creates a self-sustaining trust mechanism that enables rapid kernel module updates without compromising security verification.
2Productivity
If third-party entities are allowed to update kernel modules independently, then update agility improves, but security control and verification may deteriorate
Solution Approach 1:
The patent introduces the firmware module as an intermediary that bridges the root of trust and kernel modules. The firmware module contains the kernel private key and signs kernel modules, acting as a mediator that enables third-party updates while maintaining security control through cryptographic verification. This intermediary layer allows independent updates without direct kernel developer involvement while preserving security through the established trust chain.
Data Source
AI summary
A computer-implemented method for providing a secured updated kernel module of an electronic device, wherein the method comprises the following steps: inserting by a computer a chameleon hash of a kernel module, a kernel module private key of the kernel module and an updated kernel module of the kernel module in a chameleon hash collision function thereby obtaining a collision data, combining by the computer, the updated kernel module with the collision data obtaining thereby a secured updated kernel module. Additionally, it is further described a computer-implemented method for secure updating at least one kernel module of an electronic device, a system comprising a server and an electronic device, computer programs and a computer-readable medium.