Secure software updates

• US 10,432,593 B2
• Filed: 03/07/2018
• Issued: 10/01/2019
• Est. Priority Date: 07/26/2005
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Wysocki, Christopher R., Ward, Alan
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US15/914,999
• Publication Number:
  US 20180302385A1
• Time in Patent Office: 573 Days
• CPC Class Codes: G06F 21/101 by binding digital rights to specific entities
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

Improved techniques to update software in electronic devices that are already in use are disclosed. In one embodiment, software can be updated in a secure and controlled manner using cryptography. The authenticity of the updated software as well as its appropriateness for the particular electronic device can be confirmed prior to update. The software can also be updated on a per module basis. In one embodiment, a server hosts software updates for various electronic devices, and supplies the appropriate software update to the electronic devices via a data network.

Claims

1. A method for updating software modules installed on electronic devices, the method comprising, at a computing device:

storing a latest version identifier for a latest version of a software module stored on a server device;

establishing a connection with an electronic device;

obtaining, from the electronic device, a current version identifier for the software module installed on the electronic device;

comparing the latest version identifier to the current version identifier to determine whether an update is available for the software module; and

in response to determining that the update is available;

transmitting, to the server device, a request for the latest version of the software module stored on the server device,

receiving, from the server device, the latest version of the software module, wherein the latest version of the software module is encrypted using a unique encryption key associated with the electronic device,

providing the latest version of the software module to the electronic device for installation at the electronic device, and

updating a configuration of the electronic device to cause the electronic device to install the latest version of the software module in response to closing the connection with the computing device.

2. The method of claim 1, wherein the unique encryption key is a counterpart to a private key that is used by the electronic device to decrypt the latest version of the software module.

3. The method of claim 2, wherein the private key is stored at the electronic device.

4. The method of claim 1, wherein the computing device and the server device communicate using a first data link, and the electronic device and the computing device communicate using a second data link that is distinct from the first data link.

5. The method of claim 4, wherein the second data link is at least one of a wired connection or a wireless communication protocol.

6. The method of claim 1, wherein the request for the latest version of the software module stored on the server device includes:

(i) the latest version identifier, and

(ii) the unique encryption key.

7. The method of claim 1, wherein the latest version identifier and the current version identifier are included in a list that is maintained by the computing device, and the list includes a second current version identifier for the software module installed on a second electronic device that is distinct from the electronic device.

8. At least one non-transitory computer readable storage medium configured to store instructions that, when executed by at least one processor included in a computing device, cause the computing device to update software modules installed on electronic devices, by carrying out steps that include:

storing a latest version identifier for a latest version of a software module stored on a server device;

establishing a connection with an electronic device;

obtaining, from the electronic device, a current version identifier for the software module installed on the electronic device;

comparing the latest version identifier to the current version identifier to determine whether an update is available for the software module; and

in response to determining that the update is available;

transmitting, to the server device, a request for the latest version of the software module stored on the server device,

receiving, from the server device, the latest version of the software module, wherein the latest version of the software module is encrypted using a unique encryption key associated with the electronic device,

providing the latest version of the software module to the electronic device for installation at the electronic device, and

updating a configuration of the electronic device to cause the electronic device to install the latest version of the software module in response to closing the connection with the computing device.

9. The at least one non-transitory computer readable storage medium of claim 8, wherein the unique encryption key is a symmetric encryption key.

10. The at least one non-transitory computer readable storage medium of claim 9, wherein the symmetric encryption key is known to both the computing device and the electronic device.

11. The at least one non-transitory computer readable storage medium of claim 8, wherein the computing device and the server device communicate using a first data link, and the electronic device and the computing device communicate using a second data link that is distinct from the first data link.

12. The at least one non-transitory computer readable storage medium of claim 11, wherein the second data link is at least one of a wired connection or a wireless communication protocol.

13. The at least one non-transitory computer readable storage medium of claim 8, wherein the request for the latest version of the software module stored on the server device includes (i) the latest version identifier.

14. The at least one non-transitory computer readable storage medium of claim 8, wherein the latest version identifier and the current version identifier are included in a list that is maintained by the computing device, and the list includes a second current version identifier for the software module installed on a second electronic device that is distinct from the electronic device.

15. A computing device configured to update software modules installed on electronic devices, the computing device comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the computing device to;

store a latest version identifier for a latest version of a software module stored on a server device;

establish a connection with an electronic device;

obtain, from the electronic device, a current version identifier for the software module installed on the electronic device;

compare the latest version identifier to the current version identifier to determine whether an update is available for the software module; and

in response to determining that the update is available;

transmit, to the server device, a request for the latest version of the software module stored on the server device,

receive, from the server device, the latest version of the software module, wherein the latest version of the software module is encrypted using a unique encryption key associated with the electronic device,

provide the latest version of the software module to the electronic device for installation at the electronic device, and

update a configuration of the electronic device to cause the electronic device to install the latest version of the software module in response to closing the connection with the computing device.

16. The computing device of claim 15, wherein the unique encryption key is a counterpart to a private key that is used by the electronic device to decrypt the latest version of the software module.

17. The computing device of claim 16, wherein the private key is stored at the electronic device.

18. The computing device of claim 15, wherein the computing device and the server device communicate using a first data link, and the electronic device and the computing device communicate using a second data link that is distinct from the first data link.

19. The computing device of claim 15, wherein the request for the latest version of the software module stored on the server device includes:

(i) the latest version identifier, and

(ii) the unique encryption key.

20. The computing device of claim 15, wherein the latest version identifier and the current version identifier are included in a list that is maintained by the computing device, and the list includes a second current version identifier for the software module installed on a second electronic device that is distinct from the electronic device.