Secure data downloading, recovery and upgrading

• US 6,341,373 B1
• Filed: 12/01/2000
• Issued: 01/22/2002
• Est. Priority Date: 12/20/1996
• Status: Expired due to Term

• Current Assignee: Comcast Cable Communications Management LLC (Comcast Corporation)
• Original Assignee: Liberate Technologies
• Inventors: Shaw, Robert
• Primary Examiner(s): DAM, TUAN QUANG
• Application Number:
  US09/728,700
• Time in Patent Office: 417 Days
• Field of Search: 717/11, 709/221, 709/222, 709/218, 709/203, 707/10, 707/203, 713/2
• US Class Current: 717/173
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

The invention provides an improved method and system for secure downloading, recovery, and upgrading of data. A client device receives information from a server device using a reliable software modules stored in permanent memory in the client device. The reliable software modules perform software and data integrity tests, and locate and retrieve data for recovery or upgrade of the client device. The client device confirms the trustworthiness of the received information device by comparing digital signatures or digests for the information it receives with known digital certificates in the reliable software module.

Claims

1. A method of updating application code on a client device from a remote server, said method comprising:

performing a boot sequence on said client device, said boot sequence including (a) verifying the validity of application software contained in a writeable memory, (b) automatically retrieving without user intervention from the remote server through a communication channel update data for identifying invalid code segments, (c) automatically retrieving without user intervention from the remote server through said communication channel replacement code for replacement of said invalid code segments, and comparing validity status data within said update data for identifying invalid code segments such that only invalid code segments need be replaced whereby a compression of data transmission is effected.

2. The method of claim 1, wherein said boot sequence further comprises checking for a forced update signal and initiating retrieval of said update data in response to said forced update signal.

3. The method of claim 1, wherein said boot sequence further comprises checking a forced update flag and initiating retrieval of said update data in response to said forced update flag.

4. The method of claim 1, wherein comparing said validity status data within said update data for identifying invalid code segments to be replaced is performed automatically without user intervention.

5. A system for updating application code from a remote server, said system comprising

a client device including a writeable memory;

an interface between said client device and a communication channel to said remote server;

software code stored in said writeable memory to perform a boot sequence on said client device, said boot sequence including (a) determining whether to update a software application stored in said writeable memory, and terminating the boot sequence if no update is necessary, (b) automatically retrieving without user intervention from said remote server over said communication channel update data for identifying invalid code segments, (c) automatically retrieving without user intervention from said remote server over said communication channel replacement code for replacement of said invalid code segments, (d) comparing validity status data within said update data for identifying invalid code segments such that only invalid code segments need be replaced whereby a compression of data transmission is effected, and (e) comparing authentication data within said update data with authentication data stored in said memory for authenticating said update data.

6. The system of claim 5, wherein step (a) further comprises checking for a forced update signal and initiating an update in response to said forced update signal.

7. The system of claim 5, wherein step (a) further comprises checking a forced update flag in said writeable memory and initiating an update in response to said forced update flag.

8. The system of claim 5, wherein said boot sequence further includes:

(f) downloading and authenticating said replacement code from servers specified by location data within said update data upon successful authentication of said update data, and (g) writing said replacement code into said writeable memory.

9. The system of claim 8, wherein step (f) comprises determining from said validity status data in said update data which code segments of said software application require updating and downloading only those software code segments requiring updating.

10. The system of claim 8, wherein said validity status data comprises hash codes corresponding to discrete logical segments of code within said software application.

11. The system of claim 10, wherein said location data comprises internet addresses corresponding to said discrete logical segments of code.

12. The system of claim 8, wherein said replacement code is encrypted and step (f) further comprises decrypting said replacement code.

13. The system of claim 8, wherein said replacement code is compressed and step (f) further comprises decompressing said replacement code.

14. The system of claim 5, wherein said authentication data comprises a digital signature.

15. The system of claim 5, wherein comparing said validity status data within said update data for identifying invalid code segments to be replaced is performed automatically without user intervention.

16. A memory storing information including instructions, the instructions executable by a processor to update application code on a client device from a remote server, the instructions comprising

performing a boot sequence on said client device, said boot sequence including (a) verifying the validity of application software contained in said memory, (b) automatically retrieving without user intervention from the remote server through a communication channel update data for identifying invalid code segments, (c) automatically retrieving without user intervention from the remote server through said communication channel replacement code for replacement of said invalid code segments, and (d) comparing validity status data within said update data for identifying invalid code segments such that only invalid code segments need be replaced whereby a compression of data transmission is effected.

17. The memory of claim 16, wherein step (a) further comprises checking for a forced update signal and initiating retrieval of said update data in response to said forced update signal.

18. The memory of claim 16, wherein step (a) further comprises checking a forced update flag and initiating retrieval of said update data in response to said forced update flag.

19. The memory of claim 16, wherein comparing said validity status within said update data for identifying invalid code segments to be replaced is performed automatically without user intervention.

20. A memory storing information including instructions, the instructions executable by a processor to update application code on a client device from a remote server over a communication channel, the instructions comprising:

performing a boot sequence under control of boot code stored in permanent memory in said client device, said boot sequence including (a) determining whether to update a software application stored in writeable non-volatile memory, and terminating the boot sequence if no update is necessary, (b) automatically retrieving without user intervention from said remote server over said communication channel update data for identifying invalid code segments, (c) automatically retrieving without user intervention from said remote server over said communication channel replacement code for replacement of said invalid code segments, (d) comparing validity status data within said update data for identifying invalid code segments such that only invalid code segments need be replaced whereby a compression of data transmission is effected, and (e) comparing authentication data within said update data with authentication data stored in said permanent memory for authenticating said update data.

21. The memory of claim 20, wherein step (a) further comprises checking for a forced update signal and initiating an update in response to said forced update signal.

22. The memory of claim 20, wherein step (a) further comprises checking a forced update flag in said writeable memory and initiating an update in response to said forced update flag.

23. The memory of claim 20, wherein said boot sequence further includes:

(f) downloading and authenticating said replacement code from servers specified by location data within said update data upon successful authentication of said update data, and (g) writing said replacement code into said writeable memory.

24. The memory of claim 23, wherein step (f) comprises determining from said validity status data in said update data which code segments of said software application require updating and downloading only those software code segments requiring updating.

25. The memory of claim 23, wherein said validity status data comprises hash codes corresponding to discrete logical segments of code within said software application.

26. The memory of claim 25, wherein said location data comprises internet addresses corresponding to said discrete logical units of code.

27. The memory of claim 23, wherein said replacement code is encrypted and step (f) further comprises decrypting said replacement code.

28. The memory of claim 23, wherein said replacement code is compressed and step (f) further comprises decompressing said replacement code.

29. The memory of claim 20, wherein said authentication data comprises a digital signature.

30. The memory of claim 20, wherein comparing, said validity status data within said update data for identifying invalid code segments to be replaced is performed automatically without user intervention.