Network Device Software Loading via Version File Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network devices cannot effectively prevent loading of software with vulnerabilities, as existing electronic fuse (eFUSE) solutions have limited storage capacity and are primarily used for basic input/output system (BIOS) protection, failing to secure other software loads.
Innovation Solution
A software loading method that utilizes a version file with security verification to determine secure software versions, allowing for multiple software versions to be protected without relying on small-capacity eFUSE storage, by comparing version identifiers and using secure storage areas like trusted platform modules or electronic fuses to prevent rollback attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If eFUSE is used to store software version numbers, then software loading protection can be implemented, but the storage capacity is insufficient to protect multiple software versions
Solution Approach 1:
The patent segments the version storage function by introducing a separate version file that lists multiple software version numbers, while using eFUSE only to store a pointer or reference to this version file. This segmentation allows the version information to be stored externally with adequate capacity while maintaining the security benefits of eFUSE for the loading protection mechanism itself.
Solution Approach 2:
The patent introduces a version file as an intermediary between the eFUSE and the software version numbers. The eFUSE stores a reference to the version file, which in turn contains the actual version information. This intermediary structure resolves the contradiction by allowing extensive version storage capacity outside the eFUSE while maintaining eFUSE's security role in the loading verification process.
2Reliability
If eFUSE is used for version storage, then loading protection can be achieved, but the system cannot protect multiple software programs with different versions
Solution Approach 1:
The patent makes the version file universal by storing multiple software version numbers within it, allowing a single version file to serve multiple software programs. The eFUSE stores a reference to this universal version file, enabling the system to protect multiple software versions without requiring separate eFUSE entries for each software, thereby achieving multi-software protection capability.
3Reliability
If conventional eFUSE storage is used, then basic BIOS protection can be implemented, but protection for other software loading processes is not achievable
Solution Approach 1:
The patent extends the protection scope by making the version file universal for multiple software types. Instead of limiting eFUSE to BIOS protection only, the system uses eFUSE to store a reference to a version file that can contain version information for various software programs, enabling the same mechanism to protect both BIOS and other software loading processes.
Solution Approach 2:
The patent moves the version information storage from the constrained eFUSE dimension to an external version file dimension, allowing the system to protect multiple software types by storing their version information in the version file while using eFUSE only for the security-critical loading verification function.
Data Source
AI summary
This application discloses a software loading method, applied to a network device on which software is deployed. In the method, a software version identifier is indicated by using a version file, and when loading software, the network device compares a version identifier of to-be-loaded software with the version identifier in the version file, to determine whether a version of current to-be-loaded software is a secure version. This implements protection of a software loading process.