Remote File System Signing for Atomic A/B Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for securing the integrity and authenticity of file systems in remote stand-alone systems, particularly those using Linux, are complex, costly, and not compatible with atomic updates, and they require external infrastructure or hardware that complicates industrial implementation.
Innovation Solution
A device and method using a limited-lifetime volatile private key and public key pair for file system signing, integrated into the operating system, which regenerates keys with each atomic update, ensuring secure and efficient verification without external key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional secure boot tools are used to verify file system integrity, then kernel authenticity is guaranteed, but file system element verification is not possible
Solution Approach 1:
The patent merges the secure boot verification mechanism with file system verification by integrating the same cryptographic verification logic into both kernel loading and file system mounting processes. This allows a single secure boot tool to provide both kernel authenticity guarantee and file system element verification, resolving the contradiction between verification capability and system complexity.
2Reliability
If Merkle tree hash calculations are used for file system verification, then integrity verification is achieved, but compatibility with atomic updates is lost
Solution Approach 1:
The patent changes the verification parameter from static Merkle tree hashes embedded in the kernel to dynamic cryptographic signatures that can be regenerated with each atomic update. The secure boot tool uses asymmetric cryptography to create update-specific verification signatures, allowing the verification mechanism to adapt to each atomic update cycle while maintaining integrity verification.
Solution Approach 2:
The verification mechanism transitions from a static Merkle tree approach to a dynamic signature-based approach where verification data is regenerated for each atomic update. This dynamic behavior allows the system to maintain integrity verification while being fully compatible with atomic update cycles, as the verification parameters automatically update with each system update.
3Reliability
If external key management infrastructure is used for cryptographic verification, then security is improved, but implementation complexity and cost increase
Solution Approach 1:
The patent implements self-service key management where the secure boot tool autonomously generates, stores, and manages cryptographic key pairs without requiring external key management infrastructure. The tool creates private/public key pairs, uses the private key for signing updates, and verifies updates using the corresponding public key, all independently. This eliminates the need for external PKI infrastructure while maintaining strong cryptographic security.
Solution Approach 2:
The secure boot tool acts as an intermediary that provides complete key management functionality locally within the remote system. Rather than relying on external key management servers or hardware modules, the tool embeds all necessary cryptographic operations and key storage mechanisms directly in the system, simplifying deployment while maintaining security.
4Reliability
If persistent private keys are stored for file system signing, then verification capability is maintained, but security risks from key exposure increase
Solution Approach 1:
The patent implements disposable private keys that are generated for each atomic update cycle and then securely deleted. Each private key is used only once to sign its corresponding file system update, after which it is destroyed. This short-lived, single-use approach maintains verification capability for each update while eliminating the security risks associated with persistent key storage, as there is no long-term key exposure risk.
Data Source
AI summary
A device for securing a file system of a remote stand-alone system using an operating system associated with the file system having a double partition for A/B updates, the remote stand-alone system being updated by atomic update, and further including a secure boot tool, the device for securing being configured for signing the file system relying on an asymmetric two-key cryptography including a public key and a private key, the public key being integrated into the kernel of the operating system, and the lifetime of the private key being limited, the two public and private keys being regenerated by the device for securing each time a new atomic update of the remote stand-alone system is produced.