System Version Upgrade Security via Hardware-Software Storage Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems fail to ensure the security of software system versions against malicious programs that can roll back to exploit vulnerabilities by modifying or closing the system version identification, leading to potential security breaches.
Innovation Solution
A method and apparatus that utilize two non-volatile storage spaces, one accessible by software and the other only by hardware, to compare and manage system version identifications, ensuring that the current version is always higher than or equal to the backup version, thereby preventing rollback attacks and guaranteeing system security through hardware-controlled updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software level upgrade protection is used, then system security is improved, but it can be bypassed by modifying system version identification
Solution Approach 1:
The patent divides the storage of version identification into two separate storage spaces: a first storage space accessible by both software and hardware, and a second storage space accessible only by hardware. This segmentation ensures that even if software modifies the version identification in the first storage space, the hardware can still read the authentic version from the second storage space and prevent rollback attacks.
Solution Approach 2:
The patent introduces hardware as an intermediary between the software and the version identification data. The hardware component acts as a trusted mediator that reads the backup version identification from the second storage space and compares it with the current version, thereby mediating the security verification process and preventing software from bypassing version checks.
2Ease of operation
If system version identification is made accessible to software for updates, then ease of operation is improved, but security control is weakened
Solution Approach 1:
The patent applies different accessibility qualities to different storage spaces: the first storage space has software-accessible quality allowing easy reading and writing for normal operations, while the second storage space has hardware-only quality that prevents software modification but allows hardware verification. This local quality differentiation enables both ease of operation and security control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of the disclosure provide a method and apparatus for upgrading a system version of a system. The method can include: acquiring, using circuitry, from a first storage space a current system version identification corresponding to a current system version; acquiring, using circuitry, from a second storage space a backup system version identification corresponding to a backup system version; comparing, using circuitry, the current system version identification with the backup system version identification; and configuring the system based on the comparison.