Segmented Software Update Authentication via Hash Tree
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Connected devices with limited memory, power, and network resources face challenges in traditional software update processes, which require significant temporary memory, network resources, and processing power, especially for devices like low-power IoT devices that need to operate for extended periods without recharging.
Innovation Solution
The software update process is optimized by dividing the update into portions, generating hash values and a hash tree, creating an update header with a signature and root hash value, and transmitting only the necessary portions to the device for authentication and application, reducing memory and network requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a complete software update package is downloaded and assembled in memory before authentication, then the update can be applied reliably, but the memory requirements increase significantly
Solution Approach 1:
The update package is divided into multiple portions or blocks, each with its own hash value. Instead of requiring the entire update to be stored in memory simultaneously, the system processes segments individually, computing and verifying hash values for each portion as it is received and applied.
Solution Approach 2:
A hash tree structure serves as an intermediary between the update portions and the authentication process. The hash tree contains hash values of individual portions and their hierarchical combinations, allowing verification of update integrity without storing the complete update package in memory. This intermediary structure enables incremental verification.
2Reliability
If the entire software update package is downloaded before processing, then complete updates can be applied, but network resources and transmission time increase
Solution Approach 1:
The update package is segmented into multiple smaller portions that can be downloaded, processed, and verified independently. This allows the device to receive and validate update segments incrementally over the network, rather than requiring the complete package to be transmitted before any processing begins.
Solution Approach 2:
Hash values for each update portion are computed and included in the hash tree structure before transmission. This preliminary preparation enables the receiving device to verify update portions as they arrive, without needing to wait for the entire update package to be downloaded, thus reducing overall update time.
3Productivity
If the complete update package is processed at once, then the update can be applied efficiently, but processing power requirements increase for resource-constrained devices
Solution Approach 1:
The update processing workload is divided into smaller tasks corresponding to individual portions or blocks of the update package. Each segment can be processed independently with lower computational requirements, allowing resource-constrained devices to apply updates incrementally without requiring high peak processing power.
Solution Approach 2:
The patent replaces computationally intensive operations with hash-based verification. Instead of requiring complex validation of the entire update package, the system uses cryptographic hash functions to verify integrity of individual portions, significantly reducing the processing power needed while maintaining security and reliability.
Data Source
AI summary
Techniques related to a technique comprising dividing an update into a number of portions, generating, for the first portion, a first portion hash value, generating, for the second portion, a second portion hash value, generating a first branch hash value comprising a hash of a concatenation of the first portion hash value and the second portion hash value, generating a root hash value by concatenating the first branch hash value and a second branch hash value, generating a signature based on the root hash value and a private key, generating an update header comprising the signature, the root hash value, and a hash tree comprising first and second portion hash values, the first branch hash value, and the root hash value, transmitting the update header to a client device for authentication, and transmitting one or more of the number of portions to the client device.