System and method for securely upgrading firmware

• US 20030191955A1
• Filed: 10/25/2001
• Published: 10/09/2003
• Est. Priority Date: 05/10/2001
• Status: Active Grant

• Current Assignee: Randco Incorporated of Delaward
• Original Assignee: Ranco Incorporated of Delaware (Schneider Electric SE)
• Inventors: Chapman, John Gilman Jr., Wagner, Phillip Ryan
• Granted Patent: US 7,095,858 B2
• Time in Patent Office: Days
• US Class Current: 713/191
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068

Abstract

Upgraded firmware for a microcontroller is created and encrypted to construct a file (116) that can be distributed and installed by technicians in the field. The encryption includes character encryption (210) of the data as well as a second level of block encryption (216). Within the encrypted file (116), information about the firmware and the target microcontroller (104) is included. The distributed firmware file (116) is stored on a portable device, such as a PDA, that can communicate with the target microcontroller (104) to effect a firmware transfer from the PDA (112) to the microcontroller (104). The microcontroller (104) includes a programming routine that receives the encrypted data stream from the PDA and decrypts the data before storing the new firmware image. The programming routine also identifies when updating the firmware has left the firmware in an unusable condition and prevents operation of the microcontroller until the firmware is restored. Accordingly, the security of the firmware is maintained throughout the distribution and upgrade process and the integrity of the upgrade process is maintained as well.

Claims

1. A method for constructing an encrypted file comprising the steps of:

obtaining a first key and a second key having a same size;

obtaining a third key that is constructed by rearranging and combining the first and second keys, wherein the third key is larger in size than the first and second keys;

obtaining a fourth key that is constructed by selecting a subset of the third key, wherein the fourth key is smaller in size than the first, second and third keys;

encrypting (210) a source file (256) by encrypting a plurality of segments of the source file (256) using the fourth key to generate a first encrypted file (260), the size of each segment being equal in size to the fourth key; and

encrypting (216) the first encrypted file (260) by encrypting a plurality of blocks of the first encrypted file (260) using the third key to generate a second encrypted file (268), the size of each block being equal in size to the third key.

2. The method according to claim 1, further including the step of:

appending (212) the first key to the first encrypted file (260) before generating the second encrypted file (268).

3. The method according to claim 1, further including the steps of:

calculating (208) a checksum of the source file; and

appending the checksum (258) to the first encrypted file (260) before generating the second encrypted file (268).

4. The method according to claim 1, further including the steps of:

calculating (214) a cyclic redundancy check (266) for the first encrypted file (260); and

appending the cyclic redundancy check (266) to the first encrypted file (260) before generating the second encrypted file (268).

5. The method according to claim 1, further including the steps of:

calculating a cyclic redundancy check (270) of the second encryption file (278); and

appending the cyclic redundancy check (270) to the second encryption file (278).

6. A method for constructing a firmware file for a target microcontroller, comprising the steps of:

obtaining a firmware image file (256) for the target microcontroller (104);

encrypting (210) each byte of the firmware image file (256) using a first key to generate a first encrypted file (260), wherein the value of the first key depends on a device (102) using the target microcontroller (104); and

encrypting (216) each block of the first encrypted file (260) using a second key to generate a second encrypted file (268), wherein the first key is a subset of the second key.

7. The method according to claim 6, further comprising the steps of:

obtaining a private key that is based on the target microcontroller (104);

obtaining a public key that is associated with the firmware image file (256);

obtaining the second key that is constructed by rearranging and combining the private and public keys, wherein the second key is larger in size than the public and private keys; and

obtaining the first key that is constructed by selecting a subset of the second key, wherein the first key is smaller in size than the second, public and private keys.

8. The method according to claim 6, further comprising the step of:

appending (212) the public key to the first encrypted file (260) before generating the second encrypted file (268).

9. The method according to claim 6, further including the steps of:

calculating a checksum (258) of the firmware image file (256) and appending the checksum (258) to the first encrypted file (260) before generating the second encrypted file (268);

calculating a first cyclic redundancy check (266) on the first encrypted file (260) and appending the first cyclic redundancy check (266) to the first encrypted file (260) before generating the second encrypted file (268); and

calculating a second cyclic redundancy check (270) on the second encrypted file (268) and appending the second cyclic redundancy (270) check to the second encrypted file (268).

10. The method according to claim 6, further comprising the step of:

appending to the first encrypted file (260) information (240) about at least one of a software version of the firmware image file (256), compatible hardware for the firmware image file (256), and an expiration period of the firmware image file (256).

11. A method for updating firmware in a microcontroller, the method comprising the steps of:

receiving a request (414) to update a current firmware;

in response to the request, initiating (304) a boot-up sequence of instructions;

determining (306) the current firmware'"'"'s integrity;

if the integrity is verified, then waiting (308) a predetermined period of time for an initiation signal to begin a firmware upgrade process and executing (314) the current firmware if the initiation signal is not received during the predetermined period of time;

if the integrity is not verified, then waiting (310) for the initiation signal; and

in response to the initiation signal, executing (312) a firmware programming routine that receives new firmware and overwrites the current firmware with the new firmware.

12. The method according to claim 11, further comprising the steps of:

setting an flag (528) to indicate that the firmware may be in a corrupted state when the firmware programming routine is executed; and

clearing the flag (540) if the firmware programming routine indicates that overwriting the current firmware is successful.

13. The method according to claim 11, further comprising the steps of:

receiving an indication (316) of how successful the firmware programming routine is at overwriting the current firmware;

executing the new firmware (322), if the indication is one of success; and

initiating (318) the boot-up sequence of instructions, if the indication is not one of success.

14. A method for upgrading firmware in a microcontroller-controlled device, the method comprising the steps of:

receiving (506) an encrypted first portion of a new firmware;

verifying (510) that the new firmware is appropriate for a microcontroller, based on the first portion;

receiving the new firmware (516) in encrypted form and a previously calculated first integrity indicator for the new firmware;

generating (518) a decrypted data stream by decrypting the received new firmware based on a first decryption algorithm;

calculating (518) a second integrity indicator of the decrypted data stream and discarding the decrypted data stream;

validating (522) the new firmware'"'"'s integrity based on the first and second integrity indicators;

if the new firmware'"'"'s integrity is successfully validated, receiving (530) the new firmware in encrypted form;

decrypting (532) the received new firmware based on the first decryption algorithm to generate a plurality of bytes;

decrypting (532) each of the plurality of bytes based on a second decryption algorithm to generate a firmware image file; and

overwriting (534) a current firmware with the generated firmware image file.

15. The method according to claim 14, further comprising the steps of:

retrieving (604) from a local memory store a first decryption key whose value depends on the device;

using the first decryption key to extract (608) a second decryption key from the encrypted first portion;

constructing (610) a third encryption key by combining and rearranging the first and second encryption keys; and

wherein the first encryption algorithm relies on the third decryption key and the second encryption algorithm relies on a subset of the third encryption key.

16. A computer readable media bearing instructions for constructing an encrypted file, said instructions being arranged to cause one or more processors upon execution thereof to perform the steps of:

obtaining a first key and a second key having a same size;

obtaining a third key that is constructed by rearranging and combining the first and second keys, wherein the third key is larger in size than the first and second keys;

obtaining a fourth key that is constructed by selecting a subset of the third key, wherein the fourth key is smaller in size than the first, second and third keys;

encrypting the source file by encrypting a plurality of segments of a source file using the fourth key to generate a first encrypted file, the size of each segment being equal in size to the fourth key; and

encrypting the first encrypted file by encrypting a plurality of blocks of the first encrypted file using the third key to generate a second encrypted file, the size of each block being equal in size to the third key.

17. A computer readable media bearing instructions for updating firmware in a microcontroller, said instructions being arranged to cause one or more processors upon execution thereof to perform the steps of:

receiving a request to update a current firmware;

in response to the request, initiating a boot-up sequence of instructions;

determining the current firmware'"'"'s integrity;

if the integrity is verified, then waiting a predetermined period of time for an initiation signal to begin a firmware upgrade process and executing the current firmware if the initiation signal is not received during the predetermined period of time;

if the integrity is not verified, then waiting for the initiation signal; and

in response to the initiation signal, executing a firmware programming routine that receives new firmware and overwrites the current firmware with the new firmware.

18. A computer readable media bearing instructions for upgrading firmware in a microcontroller-controlled device, said instructions being arranged to cause one or more processors upon execution thereof to perform the steps of:

receiving an encrypted first portion of a new firmware;

verifying that the new firmware is appropriate for a microcontroller, based on the first portion;

receiving the new firmware in encrypted form and a previously calculated first integrity indicator for the new firmware;

generating a decrypted data stream by decrypting the received new firmware based on a first decryption algorithm;

calculating a second integrity indicator of the decrypted data stream and discarding the decrypted data stream;

validating the new firmware'"'"'s integrity based on the first and second integrity indicators;

if the new firmware'"'"'s integrity is successfully validated, receiving the new firmware in encrypted form;

decrypting the received new firmware based on the first decryption algorithm to generate a plurality of bytes;

decrypting each of the plurality of bytes based on a second decryption algorithm to generate a firmware image file; and

overwriting a current firmware with the generated firmware image file.

19. A computer readable encrypted firmware distribution file (116) embodied in a carrier wave, comprising:

a first file (260) encrypted according to a first algorithm, said first file comprising a firmware image (256) for a target microcontroller (104);

a header (262) comprising information about one or both of the target microcontroller (104) and the firmware image (256);

a second file (268) encrypted according to a second algorithm;

said second file (268) comprising the first file (260), the header (262) and a first integrity indicator (266) calculated from the first file (260) and the header (262); and

a second integrity indicator (270) calculated from the second file (268).

20. The carrier wave according to claim 19, wherein the header further comprises an encryption key used in the first and second algorithms.

21. A method for securely updating microcontroller firmware, the method comprising the steps of:

receiving (308) a request from a remote device (112) to upgrade firmware of a microcontroller (104);

receiving (530) an encrypted file from the remote device (112), the encrypted file comprising an executable application for operating an appliance (102) controlled by the microcontroller (104);

decrypting (532) the received file to construct an unencrypted firmware image based on the executable application; and

storing (534) the unencrypted firmware image in a programmable memory (120) accessible by the microcontroller (104).

22. The method according to claim 21, further comprising the step of:

retrieving (604) a first decryption key from a protected memory location accessible by the microcontroller (104), wherein the protected memory location is located local to the microcontroller (104).

23. The method according to claim 22, further comprising the step of:

retrieving (504) a second decryption key from a portion of the encrypted file.

24. The method according to claim 23, further comprising the step of:

performing (534) the decrypting step using the first and second decryption keys.

25. The method according to claim 21, further comprising the step of:

verifying (510) the encrypted file is appropriate for the microcontroller after receiving the encrypted file but before constructing the unencrypted firmware image.

26. The method according to claim 21, further comprising the step of:

verifying (522) the integrity of the encrypted file before constructing the unencrypted firmware image.

27. The method according to claim 21, wherein the remote device (112) is a handheld device locally connected to the microcontroller (104) via one of a wire link and a wireless link.