Method and apparatus for multi-block updates with secure flash memory

• US 20070143530A1
• Filed: 12/15/2005
• Published: 06/21/2007
• Est. Priority Date: 12/15/2005
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Rudelic, John, Camber, August, Srinivasan, Sujaya
• Application Number:
  US11/303,162
• Publication Number:
  US 20070143530A1
• Time in Patent Office: Days
• US Class Current: 711/103
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

Method and apparatus for multi-block update using secure flash memory. An update package is received at a device containing update code to update existing code for the device stored in non-volatile memory. The received update code is stored in a first portion of the non-volatile memory, while pointers identifying storage locations of respective sets of the update code are written to a second portion of the non-volatile memory device. An update process is then performed with the update code by using the pointers to locate the respective sets and assembling the update code. Updated firmware and software images are then written to the non-volatile memory device to complete the update.

Claims

1. A method comprising:

receiving an update package at a mobile device containing update code to update existing code for the mobile device stored in a flash memory device;

storing the update code in a first portion of the flash memory device;

writing pointers identifying storage locations of respective sets of the update code in a second portion of the flash memory device; and

performing an update process to update an existing code portion stored in the flash memory device with the update code by using the pointers to locate the respective sets and assemble the update code.

2. The method of claim 1, further comprising performing an authentication process on the update package to verify an originator of the update package.

3. The method of claim 2, wherein the authentication process comprises:

employing a public key stored on the mobile device to authenticate the update package by verifying the update package was signed by an originator using a private key corresponding to the public key.

4. The method of claim 1, wherein the flash memory device includes a built-in processor element to perform the update process.

5. The method of claim 1, further comprising performing the update process in a manner that is fully recoverable from any state.

6. The method of claim 1, wherein a portion of the flash memory device is used to track the locations and lengths of an update code portion.

7. The method of claim 2, wherein the update package is authenticated using a random number and public key prior to storage in the mobile device.

8. The method of claim 1, wherein the flash memory device includes a plurality of storage blocks, and the update code is stored in at least two storage blocks.

9. The method of claim 6, wherein the pointers are stored in a patch block of the flash memory device.

10. The method of claim 1, wherein the respective sets of the update code comprise differential entry sets, each differential entry set specifying a difference between a set of existing code and a set of update code used to update the existing code.

11. The method of claim 1, wherein the non-volatile memory comprises a flash memory device including multiple storage blocks, and wherein the flash update is stored in at least one storage block in a discontiguous manner.

12. The method of claim 1, wherein the mobile device comprises a wireless mobile communication device, and the update package is received by the wireless mobile communication device via a wireless transmission.

13. A mobile communications device comprising;

a flash memory client comprising;

data blocks and code blocks;

a modification block;

a patch block; and

an interface for file system management;

a buffer memory; and

a transmission path coupling the flash memory client to the buffer memory.

14. The apparatus of claim 13, wherein the mobile communications device comprises a microcontroller.

15. An apparatus comprising:

a processor;

a plurality of flash memory blocks coupled to the processor and logically partitioned into code blocks, data blocks, and a patch block; and

instructions stored in at least one code block to execute on the processor to perform operations comprising,

storing update code received at the apparatus in at least one data block;

writing pointers identifying storage locations of respective sets of the update code in the patch block; and

performing an update process to update an existing code portion in at least one code block with the update code by using the pointers to locate the respective sets of update code and assemble the update code.

16. The apparatus of claim 15, wherein the memory blocks further include a modification block, and wherein the update process includes assembling update code in the modification block and writing a copy of the modification block to a code block to update the code in the code block.

17. The apparatus of claim 15, further comprising:

an encryption unit coupled to the processor; and

a hash unit coupled to the processor,

wherein a secure flash memory device performs an authentication process on the update code using the encryption unit and the hash unit.

18. The apparatus of claim 15, further comprising a random number generator.

19. The apparatus of claim 15, further comprising random access memory (RAM) coupled to the processor to store a buffer in which portions of the update code are assembled.

20. The apparatus of claim 15, further comprising:

a public key; and

a private key stored in the flash memory.

21. A mobile device, comprising:

a first processor;

a radio frequency (RF) interface including an antenna, coupled to the first processor;

a first memory, coupled to the first processor; and

a secure flash memory, coupled to the first processor and including

a second processor;

a plurality of flash memory blocks coupled to the second processor and logically partitioned into code blocks, data blocks, and a patch block;

a second memory, coupled to the second processor; and

a first set of instructions stored in at least one code block to execute on the second processor to perform operations comprising,

storing update code received at the mobile device in at least one data block;

writing pointers identifying storage locations of respective sets of the update code in the patch block; and

performing an update process to update an existing code portion in at least one code block with the update code by using the pointers to locate the respective sets of update code and assemble the update code.

22. The mobile device of claim 21, wherein the secure flash memory further includes:

an encryption unit coupled to the second processor; and

a hash unit coupled to the second processor,

wherein execution of the first set of instructions performs an authentication process on the update code using the encryption unit and the hash unit.

23. The mobile device of claim 21, further comprising a second set of instructions stored in at least one code block, to be executed on the first processor to perform operations comprising:

receiving an RF transmission containing an update package;

extracting a differential file from the update package; and

forwarding differential file entries in the differential file to the secure flash memory.

24. A machine-readable medium to provide instructions to be executed on a processor of an apparatus including a plurality of flash memory blocks coupled to the processor and logically partitioned into code blocks, data blocks, and a patch block, execution of the instructions to perform operations comprising:

storing update code received at the apparatus in at least one data block;

writing pointers identifying storage locations of respective sets of the update code in the patch block; and

performing an update process to update an existing code portion in at least one code block with the update code by using the pointers to locate the respective sets of update code and assemble the update code.

25. The machine-readable medium of claim 24, wherein the memory blocks further include a modification block, and wherein the update process includes assembling update code in the modification block and writing a copy of the modification block to a code block to update the code in the code block.

26. The machine-readable medium of claim 24, wherein the apparatus further includes an encryption unit and a hash unit coupled to the processor, and wherein execution of the instructions performs an authentication process on the update code using the encryption unit and the hash unit.