Secure Update System Using Periodic Key Rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for securing computing devices against bogus software or firmware updates are vulnerable to attacks where an attacker can obtain and misuse cryptographic keys, leading to potential network compromise by distributing malicious updates.
Innovation Solution
The system periodically updates the central office public key in field upgradeable units, ensuring that even if an attacker obtains the private key, they cannot use it to distribute bogus updates before the public key is updated, and implements a secure memory structure with a state machine to control updates, preventing unauthorized changes to non-volatile memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored securely in field upgradeable units, then authentication of updates is reliable, but attackers may eventually compromise the keys through brute-force or mole attacks
Solution Approach 1:
The system performs preliminary actions by periodically updating cryptographic keys before they can be compromised. The key update mechanism proactively replaces keys in field upgradeable units before attackers can successfully exploit them through brute-force or mole attacks, thereby maintaining security without requiring perfect key protection
Solution Approach 2:
The system makes the cryptographic key static-to-dynamic transition by implementing periodic key rotation. Instead of using fixed long-term keys, the system dynamically updates keys over time, transforming the key management approach from static storage to dynamic renewal, which prevents permanent compromise even if keys are eventually attacked
2Object-affected harmful factors
If the central office public key is updated frequently to prevent key compromise, then security against attacks is improved, but the complexity of key management increases
Solution Approach 1:
The system implements periodic key updates at predetermined intervals rather than continuous or on-demand updates. This periodic action balances security needs with operational simplicity, ensuring keys are renewed frequently enough to prevent compromise while maintaining a predictable, manageable update schedule that reduces complexity
Solution Approach 2:
The system incorporates feedback mechanisms where field upgradeable units report their key status and authentication results to the central office. This feedback loop enables automated key management decisions, reducing manual intervention and simplifying the overall key management process while maintaining high security through responsive key rotation
3Reliability
If a secure memory structure with state machine is implemented to control updates, then unauthorized changes are prevented, but the device complexity increases
Solution Approach 1:
The memory structure is segmented into distinct regions with specific access permissions and functions. By dividing memory into separate segments with defined boundaries and access control rules, the system achieves high security through structured organization while keeping each segment's complexity manageable and well-defined
Solution Approach 2:
The state machine acts as an intermediary layer between update requests and memory operations. It mediates all access to the secure memory structure, enforcing security rules and controlling state transitions without requiring complex security logic in every memory access operation, thereby simplifying the overall system while maintaining strong security
Data Source
AI summary
Devices and methods for securely upgrading devices, such as field upgradeable units, are disclosed. In response to receiving an update object, a device may determine whether a predefined location of memory includes a predetermined value. Based on the value in the predefined location, the device may store the received update object in a verification portion of the memory. After verifying the authenticity of the update object, the device may copy the update object from the verification portion of the memory to an inactive portion. The inactive portion of the memory can be swapped with an active portion of the memory, such that the inactive portion becomes active.