Test Key Signed Build Authorization via Update Capsule
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for Trusted Computing Group's Core Root of Trust for Measurement (CRTM) updates are limited, as they only accept production key signed builds, making it difficult for developers to transition to test key signed or unsigned builds, especially during debugging processes.
Innovation Solution
A method is implemented where a target system transmits unique data to an update provider, receives a signed update capsule file, validates the signature, and matches the validation data with the unique data to authorize the use of a test key signed build for firmware updates, allowing transition from production to test key signed builds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If systems only accept production key signed builds to maintain security and immutability of CRTM, then security and reliability are improved, but adaptability and ease of debugging are worsened
Solution Approach 1:
The patent introduces an intermediary authorization mechanism that mediates between production key signed builds and test key signed builds. The update capsule file acts as a mediator, containing both the firmware image and authorization data that enables test key signed builds to be accepted without compromising the security architecture. This intermediary structure allows the system to temporarily accept test builds while maintaining the production key security model.
Solution Approach 2:
The patent changes the authorization parameter from strictly requiring production key signatures to accepting test key signatures when accompanied by valid authorization data in an update capsule file. This parameter change allows the system to switch between production and test modes by changing the signature verification parameter, enabling debugging while maintaining security through controlled parameter adjustment.
2Reliability
If systems only accept production key signed builds, then security is improved, but ease of operation for debugging is worsened
Solution Approach 1:
The update capsule file serves as an intermediary that simplifies the debugging operation. Instead of requiring complex key management operations, the developer simply provides the update capsule file which contains both the test build and the authorization data. The system automatically processes the authorization, making the debugging operation easy while maintaining security through the intermediary authorization mechanism.
3Adaptability or versatility
If the system accepts test key signed builds during debugging, then adaptability and ease of debugging are improved, but security risks increase
Solution Approach 1:
The patent implements beforehand cushioning by requiring authorization data to be included in the update capsule file before the test key signed build can be accepted. This prior authorization requirement acts as a cushion against security risks, ensuring that only authorized test builds can be installed. The authorization data serves as a protective layer that mitigates security risks while enabling test build acceptance.
Solution Approach 2:
The authorization data in the update capsule file acts as an intermediary security layer between the test key signed build and the system's security requirements. This intermediary verification mechanism reduces security risks by adding an additional validation step that ensures only properly authorized test builds can modify the CRTM, thereby protecting against unauthorized or malicious test builds.
4Reliability
If production keys are used to sign all builds, then security is improved, but device complexity increases due to key management requirements
Solution Approach 1:
The patent extracts the authorization verification logic from the complex key management process and consolidates it into the update capsule file structure. By taking out the authorization data and placing it within the update capsule, the system simplifies key management complexity while maintaining security. The update capsule becomes a self-contained unit that carries its own authorization credentials, reducing the need for external key management infrastructure.
Data Source
AI summary
Methods, apparatuses, and computer program products for authorizing use of a test key signed build are provided. Embodiments include transmitting to an update provider system, unique data associated with a target system; receiving from the update provider system, a signed update capsule file; determining, by the target system, that a signature within the signed update capsule file is valid; in response to determining that the signature is valid, determining that the validation data within the signed update capsule file matches the unique data associated with the target system; and in response to determining that the validation data matches the unique data, determining that the target system is authorized to use a test key signed build to update the firmware of the target system.