SECURE OVER-THE-AIR UPDATES

• US 20170180391A1
• Filed: 12/22/2015
• Published: 06/22/2017
• Est. Priority Date: 12/22/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hinchliffe, Alexander J., Passera, Pablo R.
• Granted Patent: US 11,831,654 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/10 Integrity

Abstract

In an example, there is disclosed a computing apparatus having: a network interface to communicate with a second device; a contextual data interface to receive and store contextual data; and one or more logic elements comprising a contextual security agent, operable to: receive a contextual data packet via the network interface; compare the contextual data packet to stored contextual data; and act on the comparing. The contextual data packet may optionally be provided out of band, and may be used to authenticate a substantive data packet, such as a patch or update.

Claims

1. A computing apparatus, comprising:

a network interface to communicate with a second device;

a local contextual data cache; and

one or more logic elements comprising a contextual security agent, operable to;

receive a contextual data packet via the network interface;

compare the contextual data packet to contextual data stored in the local contextual data cache; and

act on the comparing.

2. The computing apparatus of claim 1, wherein the computing apparatus comprises a vehicle computer.

3. The computing apparatus of claim 2, wherein the contextual data is selected from the group consisting of fuel level, tire air pressure, number of passengers, emissions, location, speed, inside temperature, outside temperature, weather condition, and a logged user input.

4. The computing apparatus of claim 1, wherein acting on the comparing comprises authenticating the second device at least partly from the contextual data packet.

5. The computing apparatus of claim 1, wherein comparing the contextual data packet comprises decrypting the contextual data packet.

6. The computing apparatus of claim 1, wherein acting on the comparing comprises decrypting a substantive data packet.

7. The computing apparatus of claim 6, wherein decrypting the substantive data packet comprises using all or part of the contextual data packet as a decryption key for the substantive data packet.

8. The computing apparatus of claim 1, wherein the context engine is further operable to perform a trusted execution environment (TEE) attestation.

9. The computing apparatus of claim 1, wherein the context engine is further operable to receive a substantive data packet, and wherein acting on the comparing comprises applying the substantive data packet.

10. The computing apparatus of claim 9, wherein the substantive data packet is a software or firmware update.

11. The computing apparatus of claim 1, wherein the contextual data packet comprises hashed data, and wherein comparing the contextual data packet to stored data comprises hashing at least part of the stored data.

12. The computing apparatus of claim 1, wherein the contextual data packet comprises clear-text data.

13. The computing apparatus of claim 1, wherein receiving the contextual data packet comprises receiving the contextual data packet out of band.

14. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions for providing a contextual security agent operable to:

receive a contextual data packet via a network interface;

compare the contextual data packet to contextual data stored in a local contextual data cache; and

act on the comparing.

15. The one or more tangible, computer-readable storage mediums of claim 14, wherein acting on the comparing comprises authenticating the second device at least partly from the contextual data packet.

16. The one or more tangible, computer-readable storage mediums of claim 14, wherein comparing the contextual data packet comprises decrypting the contextual data packet.

17. The one or more tangible, computer-readable storage mediums of claim 14, wherein acting on the comparing comprises decrypting a substantive data packet.

18. The one or more tangible, computer-readable storage mediums of claim 17, wherein decrypting the substantive data packet comprises using all or part of the contextual data packet as a decryption key for the substantive data packet.

19. The one or more tangible, computer-readable storage mediums of claim 14, wherein the context engine is further operable to perform a trusted execution environment (TEE) attestation.

20. The one or more tangible, computer-readable storage mediums of claim 14, wherein the context engine is further operable to receive a substantive data packet, and wherein acting on the comparing comprises applying the substantive data packet.

21. The one or more tangible, computer-readable storage mediums of claim 14, wherein the contextual data packet comprises hashed data, and wherein comparing the contextual data packet to stored data comprises hashing at least part of the stored data.

22. The one or more tangible, computer-readable storage mediums of claim 14, wherein the contextual data packet comprises clear-text data.

23. The one or more tangible, computer-readable storage mediums of claim 14, wherein receiving the contextual data packet comprises receiving the contextual data packet out of band.

24. A server computing device, comprising:

a network interface;

a contextual data cache interface; and

a server engine operable to;

receive an update request from a client device via the network interface;

receive a contextual datum correlated to the client device via the contextual data cache interface; and

provide a substantive data packet and contextual data packet to the client device via the network interface.

25. The server device of claim 24, wherein the server engine is further operable to hash the contextual datum, and to provide a data index to the client device via the network interface.