Method And System For Secure Download Of Firmware

• US 20100008510A1
• Filed: 07/10/2008
• Published: 01/14/2010
• Est. Priority Date: 07/10/2008
• Status: Abandoned Application

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Zayas, Fernando A.
• Application Number:
  US12/171,279
• Publication Number:
  US 20100008510A1
• Time in Patent Office: Days
• US Class Current: 380/283
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

Firmware is securely downloaded from a host to an information storage device using an encryption key generated by the information storage device. The encryption key is generated in response to a firmware download request by the host. The host encrypts the firmware image with the encryption key and downloads the encrypted firmware image to the information storage device. The information storage device receives the encrypted firmware image, decrypts the firmware image, and updates its firmware with this firmware image.

Claims

1. A method for updating firmware for an information storage device, comprising:

receiving a request to update firmware from a host;

generating an encryption key;

transmitting the encryption key to the host; and

receiving a new firmware from the host, the new firmware being encrypted with the encryption key.

2. The method according to claim 1, wherein the encryption key is transmitted to the host in an encrypted form, and a key that is used to encrypt the encryption key is different from the encryption key that is transmitted to the host.

3. The method according to claim 1, further comprising:

receiving user credentials from the host; and

transmitting the encryption key to the host if the user credentials are authenticated.

4. The method according to claim 3, further comprising:

establishing a unique session key; and

encrypting the encryption key using the unique session key.

5. The method according to claim 3, further comprising logging the request and data on the authenticated user in an audit log.

6. The method according to claim 1, wherein the encryption key is generated as a random number.

7. The method according to claim 1, further comprising:

decrypting the new firmware received from the host using the encryption key; and

reprogramming the information storage device using the new firmware.

8. A method for updating firmware for an information storage device, comprising:

transmitting a request to update firmware to the information storage device;

receiving an encryption key from the information storage device;

encrypting a new firmware using the encryption key; and

transmitting the encrypted new firmware to the information storage device.

9. The method according to claim 8, wherein the request and the encrypted new firmware are transmitted to the information storage device over a network.

10. The method according to claim 8, wherein the encryption key is received from the information storage device in encrypted form, and a key that is used to encrypt the encryption key is different from the encryption key that is received from the information storage device.

11. The method according to claim 9, further comprising:

transmitting user credentials to the information storage device; and

establishing a unique session key,

wherein the encryption key is encrypted using the unique session key.

12. The method according to claim 8, wherein a standard download microcode command is used to transmit the new firmware to the information storage device.

13. The method according to claim 8, further comprising:

transmitting another request to update firmware to the information storage device; and

receiving another encryption key from the information storage device, said another encryption key being different from said encryption key.

14. A hard disk drive comprising:

a microcontroller; and

a memory unit storing firmware for the microcontroller,

wherein the firmware includes instructions for causing the microcontroller to generate an encryption key in response to a request for downloading a new firmware into the microcontroller.

15. The hard disk drive of claim 14, wherein a new encryption key is generated each time a request for downloading a new firmware into the microcontroller is received by the microcontroller.

16. The hard disk drive of claim 14, wherein the encryption key is generated as a random number.

17. The hard disk drive of claim 14, wherein the firmware further includes instructions for causing the microcontroller to encrypt the encryption key and transmit the encrypted encryption key to its host.

18. The hard disk drive of claim 14, wherein the encryption key is encrypted using a session key that has been established with the host.

19. The hard disk drive of claim 14, wherein the firmware further includes instructions for causing the microcontroller to decrypt an encrypted new firmware received from the host and load the new firmware in the memory unit.

20. The hard disk drive of claim 14, wherein the firmware further includes instructions for causing the microcontroller to validate the user prior to transmitting the encryption key to the host.