Tamper-Resistant Element Secure Firmware Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Securely transferring firmware to a primary platform from a server while ensuring that certificates or public keys associated with an image delivery server have not been revoked, particularly in resource-constrained tamper-resistant elements where certificate revocation checks are challenging due to limited resources and insecure communication channels.
Innovation Solution
A system that uses a tamper-resistant element within a computing device to establish a secure session with a server, employing cryptographic algorithms like elliptic curve Diffie-Hellman key exchange and elliptic curve digital signature algorithms to verify the validity of certificates through OCSP stapling, ensuring that firmware is only loaded if the certificates have not been revoked by comparing timestamp values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate revocation checks are performed in resource-constrained tamper-resistant elements, then security reliability is improved, but computational resource consumption increases
Solution Approach 1:
The patent performs certificate revocation checks in advance before firmware loading occurs. The primary platform checks whether a certificate has been revoked by obtaining a certificate status from a certificate authority before the firmware image is loaded onto the secondary platform. This preliminary action prevents potentially harmful firmware from being loaded while operating within the resource constraints of the tamper-resistant element.
Solution Approach 2:
The patent introduces a certificate status verification mechanism as an intermediary step between the firmware image delivery and the actual loading process. The primary platform acts as an intermediary that checks certificate revocation status through a certificate authority before allowing the firmware to be loaded. This intermediary check ensures security without requiring continuous intensive computational resources during the firmware execution phase.
2Reliability
If secure session establishment with server is performed, then firmware transfer security is improved, but communication complexity increases
Solution Approach 1:
The patent segments the secure communication process into distinct phases: first establishing a secure session with the image delivery server, then performing certificate revocation checks, and finally loading the firmware image. By segmenting these operations, the system manages communication complexity through structured steps rather than monolithic processing, making the security verification process more manageable and efficient.
Solution Approach 2:
The patent performs secure session establishment and certificate verification as preliminary actions before the actual firmware transfer and loading. The primary platform establishes the secure communication channel and verifies certificate validity in advance, so that when the firmware image is received and loaded, the security infrastructure is already in place. This reduces the complexity burden during the critical firmware loading phase.
3Measurement precision
If timestamp values are compared to determine certificate validity, then revocation detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent performs the timestamp comparison and certificate validity determination as a preliminary check before the firmware loading process begins. By completing this time-sensitive verification operation in advance, the system ensures accurate revocation detection while minimizing the time impact on the overall firmware loading process. The primary platform has already verified the certificate status before initiating the firmware transfer and loading operations.
Data Source
AI summary
A tamper resistant element (TRE) in a device can operate a primary platform and support a “Smart Secure Platform”. The TRE may not keep time when electrical power is removed from the TRE. The device can receive (i) a certificate for an image delivery server (IDS) with a first timestamp and (ii) a signed second timestamp from a certificate authority, comprising a signature according to the Online Certificate Status Protocol (OCSP) with stapling. The device can forward the certificate and second timestamp to the TRE. The device can receive a ciphertext and an encrypted image from the IDS, where the ciphertext includes a third timestamp from a Time Stamp Authority (TSA), and forward the data to the TRE. The TRE can conduct a key exchange to decrypt the ciphertext. The TRE can compare the second and third timestamps to verify the certificate has not been revoked.