ROOT OF TRUST (RoT) APPLICATION FOR INTERNET OF THINGS (IoT) DEVICES

• US 20180088927A1
• Filed: 09/28/2016
• Published: 03/29/2018
• Est. Priority Date: 09/28/2016
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: ZHAO, LI, MISOCZKI, RAFAEL, GHOSH, SANTOSH, SASTRY, MANOJ R.
• Application Number:
  US15/278,658
• Publication Number:
  US 20180088927A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

One embodiment provides an apparatus. The apparatus includes an Internet of Things (IoT) device including a processor, a memory, a flash memory, a network interface and a boot Read Only Memory (ROM). A Root-of-Trust (RoT) application stored in the boot ROM causes the processor run the RoT after initialization of the IoT device. The RoT causes the device to determine a selected image by determining if an update mode is set. The RoT also causes the processor to load the selected image into memory and determine whether a verification of a signature of the selected image is successful. When the verification of the signature is successful then control is transferred to the selected image and when the verification is not successful then a recovery boot is performed

Claims

1. An apparatus comprising:

an Internet of Things (IoT) device including a processor, a memory, a flash memory, a network interface and a boot Read Only Memory (ROM);

a Root-of-Trust (RoT) application stored in the boot ROM wherein the RoT application causes the processor to perform the operations of;

running the RoT from the boot ROM after initialization of the IoT device, the RoT causing the device to perform the operations;

determining a selected image by determining if an update mode is set, wherein when the update mode is set the selected image comprises an update image and wherein when the update mode is not set, the selected image comprises a first image;

loading the selected image into memory;

determining whether a verification of a signature of the selected image is successful using a multi-time hash-based signature process; and

when the verification of the signature of the selected image is successful then transferring control to the selected image and when the verification of the signature of the selected image is not successful then performing a recovery boot.

2. The apparatus of claim 1, wherein the processor running an RoT application comprises the processor running an RoT verification application residing in less than 2 KiloBytes (KB) of memory.

3. The apparatus of claim 1, wherein the processor running an RoT application comprises the processor running an RoT verification application having a latency of about 205 milliseconds.

4. The apparatus of claim 1, wherein the processor using a multi-time hash-based signature process further comprises the processor using a single public key.

5. The apparatus of claim 4, wherein the processor determining whether a verification of a signature of the selected image is successful further comprises the processor using a one-time hash-based signature process.

6. The apparatus of claim 5, wherein the processor using a one-time hash-based signature process comprises the processor using an eXtended Merkle Signature Scheme/Winterniz One Time Signature (XMSS/WOTS+) process.

7. The apparatus of claim 1, wherein when the processor determining verification of the signature of the selected image is successful then transferring control to the image further comprises the processor loading the selected image and verifying at least one subsequent image.

8. The apparatus of claim 1, wherein when the selected image comprises an update image then the processor runs the update image to verify a firmware patch.

9. A method comprising:

running a Root-of-Trust (RoT) from a boot Read Only Memory (ROM) after initialization of an Internet Of Things (IoT) device, the RoT causing the device to perform the operations;

determining a selected image by determining if an update mode is set, wherein when the update mode is set the selected image comprises an update image and wherein when the update mode is not set, the selected image comprises a first image;

loading the selected image into memory;

determining whether a verification of a signature of the selected image is successful using a multi-time hash-based signature process; and

when the verification of the signature of the selected image is successful then transferring control to the selected image and when the verification of the signature of the selected image is not successful then performing a recovery boot.

10. The method of claim 9, wherein the running an RoT application comprises running an RoT verification application residing in less than 2 KiloBytes (KB) of memory.

11. The method of claim 9, wherein the running an RoT application comprises running an RoT verification application having a latency of about 205 milliseconds.

12. The method of claim 9, wherein the using a multi-time hash-based signature process further comprises using a single public key.

13. The method of claim 12, wherein the determining whether a verification of a signature of the selected image is successful further comprises using a one-time hash-based signature process.

14. The method of claim 12, wherein the one-time hash-based signature process comprises an eXtended Merkle Signature Scheme/Winterniz One Time Signature (XMSS/WOTS+) process.

15. The method of claim 9, wherein when the verification of the signature of the selected image is successful then transferring control to the image further comprises loading the selected image and verifying at least one subsequent image.

16. The method of claim 9, wherein when the selected image comprises an update image then running the update image to verify a firmware patch.

17. A computer readable storage device having stored thereon instructions that when executed by one or more processors result in the following operations comprising:

running a Root-of-Trust (RoT) from a boot Read Only Memory (ROM) after initialization of an Internet Of Things (IoT) device, the RoT causing the device to perform the operations;

determining a selected image by determining if an update mode is set, wherein when the update mode is set the selected image comprises an update image and wherein when the update mode is not set, the selected image comprises a first image;

loading the selected image into memory;

determining whether a verification of a signature of the selected image is successful using a multi-time hash-based signature process; and

when the verification of the signature of the selected image is successful then transferring control to the selected image and when the verification of the signature of the selected image is not successful then performing a recovery boot.

18. The device of claim 17, wherein the instructions that when executed by one or more processors further comprises running an RoT verification application residing in less than 2 KiloBytes (KB) of memory.

19. The device of claim 17, wherein the instructions that when executed by one or more processors further comprises running an RoT verification application having a latency of about 205 milliseconds.

20. The device of claim 17, wherein the instructions that when executed by one or more processors using a multi-time hash-based signature process further comprises using a single public key.

21. The device of claim 17, wherein the instructions that when executed by one or more processors determining whether a verification of a signature of the selected image is successful further comprises using a one-time hash-based signature process.

22. The device of claim 21, wherein the instructions that when executed by one or more processors further comprises wherein the one-time hash-based signature process comprises an eXtended Merkle Signature Scheme/Winterniz One Time Signature (XMSS/WOTS+) process.

23. The device of claim 17, wherein the instructions that when executed by one or more processors further comprises wherein when the verification of the signature of the selected image is successful then transferring control to the image then loading the selected image and verifying at least one subsequent image.

24. The device of claim 17, wherein the instructions that when executed by one or more processors further comprises wherein when the selected image comprises an update image then running the update image to verify a firmware patch.