Secure Persistent Software Updates

• US 20190018964A1
• Filed: 07/14/2017
• Published: 01/17/2019
• Est. Priority Date: 07/14/2017
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Basehore, Derek, Sanders, Nick
• Granted Patent: US 10,445,503 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

Techniques and devices for secure persistent software updates are described. Through use of these techniques and devices, events that can prevent a software update from occurring can be detected and operations that enable the software update to occur can be performed. The techniques are capable of ensuring a computing device is using a latest software and that persistent software updates continue, despite any efforts to compromise the computing device.

Claims

1. A device comprising:

a network interface configured to receive a message from an update server over a network;

a processor configured to;

operate the device according to a normal mode that enables the device to receive the message from the update server; and

a secure watchdog configured to;

set a time frame for receiving the message from the update server; and

responsive to not receiving the message before the expiration of the time frame, cause the processor to switch from operating the device according to the normal mode to operating the device according to a recovery mode, the recovery mode;

having a reduced set of functions compared to the normal mode; and

enabling a software update to occur on the device.

2. The device of claim 1, wherein responsive to receiving the message before an expiration of the time frame, the secure watchdog is further configured to set a new time frame for receiving another message from the update server over the network.

3. The device of claim 2, wherein the secure watchdog is further configured to determine the new time frame based on a schedule of the update server.

4. The device of claim 2, wherein receiving the message further includes authenticating the message as having been sent from the update server based on a digital signature of the message.

5. The device of claim 1, wherein the secure watchdog is a microcontroller embedded in the device.

6. The device of claim 1, wherein causing the processor to switch to the recovery mode is based on a hardware-generated signal sent from the secure watchdog to the processor.

7. The device of claim 6, wherein:

the secure watchdog includes a watchdog timer configured to send the hardware-generated signal based on the expiration of the time frame; and

the secure watchdog is further configured to reset the watchdog timer when the message is received.

8. The device of claim 1, wherein the secure watchdog is further configured to send, via the network interface, a request to the update server that causes the update server to send the message.

9. The device of claim 1, wherein the secure watchdog is further configured to:

receive a termination message; and

cease causing the processor to switch to the recovery mode.

10. The device of claim 9, wherein the termination message is received from the update server.

11. The device of claim 9, wherein the termination message includes an input from a user that verifies presence of the user.

12. A method comprising:

receiving a message from an update server, the message including information associated with a latest software that is available for a computing device via the update server;

determining, based on the received message, whether a current software that the computing device is configured to execute corresponds with the latest software;

responsive to the current software not corresponding with the latest software, setting a time frame for enabling a software update to occur on the computing device;

responsive to the time frame expiring, determining whether the latest software is stored on the computing device; and

responsive to the latest software being stored, causing the computing device to reboot, the reboot enabling the computing device to load the latest software;

or

responsive to the latest software not being stored, causing the computing device to switch from operating according to a normal mode to operating according to a recovery mode that enables the software update to occur on the computing device, the recovery mode having a reduced set of functions compared to the normal mode.

13. The method of claim 12, wherein the determining whether the current software corresponds with the latest software is based on a comparison of a version number associated with the current software with a version number associated with the latest software.

14. The method of claim 12, wherein determining whether the latest software is stored on the device is based on information associated with a previous software update.

15. The method of claim 12, further comprising causing the computing device to perform the software update while the computing device is in the recovery mode.

16. A method comprising:

storing information associated with a latest software that is available via an update server, the information received via a message from the update server;

accessing, during a boot-up process of a computing device, the information associated with the latest software;

determining, before a software is loaded during the boot-up process, whether the software corresponds with the latest software based on the information associated with the latest software; and

responsive to the software not corresponding to the latest software, causing the computing device to operate in a recovery mode, the recovery mode;

enabling the computing device to not load the software; and

enabling a software update to occur on the computing device.

17. The method of claim 16, wherein causing the computing device to operate in the recovery mode includes causing the boot-up process to load recovery software configured for the recovery mode.

18. The method of claim 17, wherein the recovery software is a read-only software stored on the computing device.

19. The method of claim 16, further comprising causing the computing device to perform the software update after causing the computing device to operate in the recovery mode.

20. The method of claim 16, wherein the information associated with the latest software is stored in a secure memory separate from the software.