Secure Element OS Update via Bootstrap Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for updating the operating system of secure elements, such as smart cards, lack reliability and security, particularly requiring multiple restarts and relying solely on software fingerprints for security, which is inadequate for high-security applications.
Innovation Solution
A secure element with a microprocessor, non-volatile memory, and communication interface that includes a bootstrap program for secure and reliable OS updates, involving authentication of the update device, mutual authentication between the secure element and the update device, and encrypted communication to prevent unauthorized access and ensure the integrity of the new OS version.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If authentication based solely on software fingerprint is used, then the update process is simple, but security is insufficient for high-security applications
Solution Approach 1:
The authentication process is segmented into multiple independent steps: generating authentication data from the variable and stored key, receiving authentication data from the update device, and verifying the match. This multi-step segmented authentication provides robust security without requiring complex hardware changes.
Solution Approach 2:
The variable is prepared in advance before the authentication process begins, and the authentication data is generated beforehand based on this variable and the stored key. This preliminary preparation enables efficient verification during the actual update process while maintaining high security standards.
2Reliability
If the secure element requires multiple restarts for updating, then security verification can be performed, but productivity and ease of operation deteriorate
Solution Approach 1:
The secure element performs authentication and verification operations autonomously using its own stored key and the variable provided during operation. The system self-verify the update package integrity and authenticate the update device without requiring external verification equipment or multiple restart cycles.
Solution Approach 2:
The authentication and verification processes are integrated into the normal operation of the secure element, allowing updates to proceed continuously during a single operational session. The useful action of updating remains continuous rather than being interrupted by multiple restarts, maintaining both security and productivity.
3Ease of manufacture
If the bootstrap program is stored in a modifiable manner, then ease of manufacture improves, but security and reliability worsen due to potential modifications
Solution Approach 1:
The bootstrap program is prepared and stored in a protected, unmodifiable state during the manufacturing process. This preliminary establishment of the program in a secure, read-only format ensures its integrity is maintained throughout the device's operational life, preventing any unauthorized modifications while maintaining manufacturing simplicity.
4Reliability
If encrypted communication is implemented, then security against interception improves, but cryptographic resource consumption increases
Solution Approach 1:
Encryption and authentication are applied locally at critical points in the communication process: the variable is encrypted before transmission, and authentication data is verified using the stored key. This localized application of cryptographic operations provides necessary security against interception while minimizing overall resource consumption compared to continuous encryption of all communications.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The element (30) has a microprocessor (31) executing a boot program (38) during startup of the element. The program comprises instructions for execution of a startup step to determine if a non-volatile memory (34) stores an active operating system (35) and to launch execution of the operating system. The program executes two authentication steps based on authentication data. The program executes a storage step of an operating system (25) received from an updater device (10) in the memory and an activation step of the latter operating system when instructions are executed by the microprocessor. An independent claim is also included for a terminal.