Security hardening for a Wi-Fi router

• US 9,998,285 B2
• Filed: 12/22/2015
• Issued: 06/12/2018
• Est. Priority Date: 12/22/2015
• Status: Active Grant

• Current Assignee: T-Mobile USA, Inc. (Deutsche Telekom AG)
• Original Assignee: T-Mobile USA, Inc. (Deutsche Telekom AG)
• Inventors: Hodroj, Samir
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US14/979,336
• Publication Number:
  US 20170180135A1
• Time in Patent Office: 903 Days
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 8/654 using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method and system of securing the firmware of a router. Upon determining that a received digital message does not have integrity or the digital signature of the received digital message is not correct, the digital message is ignored or discarded. Otherwise the digital message is decrypted and a new firmware extracted therefrom. The existing firmware is then flashed with the new extracted firmware.

Claims

1. A router comprising:

a processor;

at least one network interface coupled to the processor configured to enable communications via one or more communication networks;

a memory for content and programming;

a program stored in the memory, wherein execution of the program by the processor configures the router to perform acts comprising, during a provisioning stage;

receiving a provisioning digital message from a firmware server, the provisioning digital message comprising a digital certificate and an initial encrypted firmware that, when unencrypted and installed on the router, prevents unauthorized access to an existing firmware of the router;

the program being further executed by the processor to configure the router to perform acts comprising, during a maintenance stage;

receiving a digital message;

determining whether the digital message has integrity;

determining whether a digital signature of the digital message is correct;

upon determining that at least one of;

(i) the digital message does not have integrity, or (ii) the digital signature of the digital message is not correct, ignoring or discarding the digital message; and

upon determining that (i) the digital message does have integrity, and (ii) the digital signature of the digital message is correct;

decrypting the digital message;

extracting a new firmware from the digital message; and

flashing the existing firmware of the router in the memory with the new firmware.

2. The router of claim 1, wherein only firmware that prevents access via at least one of Telnet and SSH is used to flash the existing firmware in the memory with the new firmware.

3. The router of claim 1, wherein the initial encrypted firmware has a symmetric key encryption.

4. The router of claim 1, wherein execution of the program further configures the router to perform acts comprising, during a provisioning stage:

receiving a decryption key operative to decrypt the provisioning digital message received from the firmware server.

5. The router of claim 4, wherein upon determining that (i) the digital message does have integrity, and (ii) the digital signature of the digital message is correct, the decryption key is used to decrypt the digital message.

6. The router of claim 1, wherein a new digital message is received by the router from the firmware server at predetermined intervals.

7. The router of claim 1, further comprising a cellular broadband driver, and wherein a new digital message is received by the router from the firmware server via a cellular network.

8. The router of claim 1, further comprising a security application stored in the memory, wherein the security application performs an act of at least one of (i) determining that the digital message has integrity, or (ii) determining that the digital signature of the digital message is correct.

9. The router of claim 1, wherein execution of the program further configures the router to perform acts comprising:

determining that the digital message is in a format of a firmware update, and

wherein determining that the digital message has integrity, is based on the digital message being in the format of the firmware update.

10. The router of claim 1, wherein determining whether the digital message has integrity comprises performing at least one of:

(i) a cyclic redundancy check (CRC) or (ii) a message digest check.

11. The router of claim 1, further comprising:

sending the digital message to a remote authentication server; and

receiving a confirmation from the remote authentication server that at least one of (i) the digital message does have integrity, or (ii) that the digital signature of the digital message is correct,

wherein, determining that at least one of (i) the digital message does have integrity, or (ii) that the digital signature of the digital message is correct, is based at least in part on receipt of the confirmation.

12. A non-transitory computer-readable medium having stored thereon a plurality of sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform a method of securing a firmware of a router, the method comprising:

receiving a digital message;

sending the digital message to a remote authentication server;

in response to receiving, from the remote authentication server, a first confirmation that at least one of;

(i) the digital message does not have integrity, or (ii) a digital signature of the digital message is not correct, ignoring or discarding the digital message;

in response to receiving, from the remote authentication server, a second confirmation that (i) the digital message does have integrity, and (ii) the digital signature of the digital message is correct;

decrypting the digital message;

extracting a new firmware from the digital message; and

flashing an existing firmware with the new firmware.

13. The method of claim 12, further comprising:

receiving a provisioning digital message from a firmware server, the provisioning digital message including a digital certificate and an initial encrypted firmware that, when unencrypted and installed on the router, is operative to prevent unauthorized access to the firmware of the router.

14. The method of claim 13, further comprising, in a provisioning stage receiving a decryption key operative to decrypt the provisioning digital message received from the firmware server.

15. The method of claim 14, wherein upon receiving, from the remote authentication server, the second confirmation that (i) the digital message does have integrity, and (ii) the digital signature of the digital message is correct, decrypting the digital message with the decryption key.

16. The method of claim 13, wherein a new digital message is received by the router from the firmware server via a cellular network.

17. The method of claim 12, wherein, receiving the second confirmation that the digital message does have integrity, is based at least in part on the digital message being in a format of a firmware update.

18. The method of claim 12, wherein, receiving the second confirmation that the digital message does have integrity is based at least in part on one of a (i) a cyclic redundancy check or a message digest check.

19. The method of claim 12, wherein only firmware that prevents access via at least one of Telnet and SSH is used to flash the existing firmware with the new firmware.

20. The method of claim 13, wherein the initial encrypted firmware has a symmetric key encryption.