Method for downloading at least one software component onto a computing device, and associated computer program product, computing device and computer system

• US 9,633,207 B2
• Filed: 04/22/2015
• Issued: 04/25/2017
• Est. Priority Date: 10/23/2012
• Status: Active Grant

• Current Assignee: Thales SA
• Original Assignee: Thales SA
• Inventors: Derouet, Ludovic, Ech-Chergui, Ben Youcef
• Primary Examiner(s): Hoffman, Brandon
• Application Number:
  US14/693,780
• Publication Number:
  US 20150332051A1
• Time in Patent Office: 734 Days
• Field of Search: None
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method for downloading at least one software component onto a computing device, and associated computer program product, computing device and computer system are disclosed. In one aspect, the method is implemented by the computer device including an information processing unit having a memory. The downloading method includes downloading to the memory of a first application from a first distribution capability and connection to a second distribution capability via the first application. The connection to the second distribution capability is performed in a secure manner using an authentication code. The downloading method further includes downloading to the memory of a second application from the second distribution capability, secure connection to a third distribution capability via the second application, and downloading to the memory of each software component from the third distribution capability.

Claims

1. A method for downloading at least one software component to a computing device, the method being implemented by the computing device comprising an information processing unit having a memory, the method comprising:

downloading into the memory a first application from a first distribution capability; and

connecting via the first application to a second distribution capability,

wherein the connection to the second distribution capability is performed securely using an authentication code, and wherein the method further comprises;

downloading into the memory a second application from the second distribution capability, wherein the second application is encapsulated in a package protected by a cryptographic protection code, and, during downloading of the second application, the protected package is sent from the second distribution capability to the computer device;

securely connecting, via the second application to a third distribution capability; and

downloading into the memory the software component from the third distribution capability,

wherein, during the connection to the third distribution capability and/or the downloading of each software component, the data exchanged between the third distribution capability and the computing device are protected by cryptographic protection, and

wherein security elements associated with the cryptographic protection of the data exchanged between the third distribution capability and the computing device are stored in a security container, the security container being cryptographically protected by an unlock code and the container is encapsulated in the protected package received from the second distribution capability.

2. The method of claim 1, wherein after downloading of the package comprising the second application, the first application performs a cryptographic operation using the cryptographic protection code to extract the second application from the package.

3. The method of claim 1, wherein the authentication code, the cryptographic protection code and the unlock code are stored in the memory of the computing device prior to the downloading of the first application.

4. The method of claim 3, wherein the authentication code, the cryptographic protection code and the unlock code are different from each other.

5. The method of claim 1, wherein the downloading of the second application is carried out directly by the first application.

6. The method of claim 1, wherein the connecting step to the third distribution capability includes authentication of the computing device at the third distribution capability and authentication of the third distribution capability at the computing device in order to perform reciprocal authentication of the computing device and the third distribution capability.

7. The method of claim 1, wherein the secure connection to the third distribution capability is established via the use of a code that is different from the authentication code used for the secure connection to the second distribution capability.

8. The method of claim 7, wherein the secure connection to the second distribution capability has a different security level than that of the secure connection to the third distribution capability.

9. A non-transitory computer-readable medium including a computer program comprising software instructions that, when implemented by an information processing unit integrated with a computing device, implements the downloading method according to claim 1.

10. A computing device, comprising an information processing unit having a memory, the memory having a downloading application configured to download at least one software component, the downloading application comprising:

a first capability configured to download a first application into the memory from a first distribution capability, the first application being configured to connect to a second distribution capability,

wherein the first application is configured to connect to the second distribution capability in a secure manner using an authentication code, and

wherein the memory is configured to store;

a second capability configured to download a second application into the memory from the second distribution capability, the second application being configured to connect securely to a third distribution capability, the second application being further configured to be encapsulated in a package protected by a cryptographic protection code, and, during downloading of the second application, the protected package is configured to be sent from the second distribution capability to the computer device; and

a third capability configured to download each software component from the third distribution capability into the memory,

wherein, during a connection to the third distribution capability and/or the downloading of each software component, the data exchanged between the third distribution capability and the computing device are configured to be protected by cryptographic protection, and

wherein security elements associated with the cryptographic protection of the data exchanged between the third distribution capability and the computing device are configured to be stored in a security container, the security container being configured to be cryptographically protected by an unlock code and the container is encapsulated in the protected package received from the second distribution capability.

11. A computer system comprising at least one computing device according to claim 10, a first distribution capability, a second distribution capability, and a third distribution capability, each distribution capability being connected to each computing device by a data link.

12. The computer system of claim 11, wherein the system further comprises a deployment capability, the deployment capability being configured to request from the second distribution capability the creation of a first repository, and to send to the second distribution capability the second application for insertion into the first repository, the deployment capability being configured to request from the third distribution capability, the creation of a second repository and to send to the third distribution capability each software component for inclusion in the second repository.

13. The computing device of claim 10, wherein the secure connection to the third distribution capability is established via the use of a code that is different from the authentication code used for the secure connection to the second distribution capability.

14. The computing device of claim 13, wherein the secure connection to the second distribution capability has a different security level than that of the secure connection to the third distribution capability.