SECURE IOT DEVICE UPDATE

• US 20180165088A1
• Filed: 02/27/2017
• Published: 06/14/2018
• Est. Priority Date: 12/14/2016
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Bonar, Adrian, Olinsky, Reuben R., Kim, Sang Eun, Nightingale, Edmund B., de Carvalho, Thales
• Granted Patent: US 10,416,991 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/658 Incremental updates; Differential updates
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

The disclosed technology is generally directed to updating of applications, firmware and/or other software on IoT devices. In one example of the technology, a request that is associated with a requested update is communicated from a normal world of a first application processor to a secure world of the first application processor. The secure world validates the requested update. Instructions associated with the validated update are communicated from the secure world to the normal world. Image requests are sent from the normal world to a cloud service for image binaries associated with the validated update. The secure world receives the requested image binaries from the cloud service. The secure world writes the received image binaries to memory, and validates the written image binaries.

Claims

1. An apparatus for updating, comprising:

an IoT device including a first memory adapted to store run-time data for the device, and at least one processor that is adapted to execute processor-executable code that, in response to execution, enables at least two independent execution environments for the application processor including first independent execution environment and a second execution environment, wherein the first independent execution environment has at least one capability that the second independent execution environment does not have, and further configured in response to execution to enable actions, including;

communicating a request that is associated with a requested update from the second independent execution environment to the first independent execution environment;

validating the requested update;

communicating instructions associated with the validated update from the first independent execution environment to the second independent execution environment;

for image binaries associated with the validated update, sending image requests from the second independent execution environment to a cloud service;

receiving, by the first independent execution environment, the requested image binaries from the cloud service;

using the first independent execution environment to write the received image binaries to a second memory; and

validating the written image binaries.

2. The apparatus of claim 1, wherein the application processor is further configured such that validating the requested update includes:

determining whether the requested update is properly signed; and

comparing image binaries associated with the requested update with image binaries already installed.

3. The apparatus of claim 1, wherein the application processor is further configured such that validating the written image binaries includes comparing signatures associated with the image binaries with corresponding signatures stored in metadata associated with the image binaries.

4. The apparatus of claim 1, wherein the first independent execution environment is a secure world, and wherein the second independent execution environment is a normal world.

5. The apparatus of claim 4, wherein the application processor is further configured such that communicating instructions associated with the validated update from the secure world to the normal world includes communicating, from the secure world to the normal world, an indication as to which image binaries should be installed as part of the validated update.

6. The apparatus of claim 4, wherein the application processor is configured such that the secure world has a trust zone that creates a private independent execution environment that is hardware-protected from the rest of the IoT device.

7. The apparatus of claim 6, wherein the second memory is a flash memory, and wherein the application processor is configured such that the secure world has write access to the flash memory and such that the normal world is prevented from writing to the flash memory.

11. The apparatus of claim 1, wherein the first independent execution environment is a secure world, and wherein the second independent execution environment is a normal world.

12. The method of claim 11, further comprising receiving, by the normal world, information associated with whether a new update is currently available.

13. The method of claim 11, further comprising:

communicating from the secure world to at least one of the normal world or a security complex that the written image binaries have been validated.

14. The method of claim 11, further comprising:

communicating from at least one of a security complex or the normal world to the secure world an indication to switch to the validated update.

15. The method of claim 11, further comprising:

communicating from the secure world to at least one of the normal world or a security complex a location of the validated update.

16. The method of claim 11, wherein communicating instructions associated with the validated update from the secure world to the normal world includes communicating, from the secure world to the normal world, an indication as to which image binaries should be installed as part of the validated update.

17. The method of claim 16, wherein sending image requests from the normal world to the cloud service includes sending, for image binaries that the secure world indicated should be installed as part of the validated updated, image requests associated with the image binaries to the cloud service.

19. The processor-readable storage medium of claim 17, wherein the processor-executable code is further configured such that validating the requested update includes:

determining whether the requested update is properly signed; and

comparing image binaries associated with the requested update with image binaries already installed.

20. The processor-readable storage medium of claim 17, wherein the processor-executable code is further configured such that validating the written image binaries includes comparing signatures associated with the image binaries with corresponding signatures stored in metadata associated with the image binaries.

8. A method for updating, comprising:

communicating, in at least one processor that includes a first independent execution environment and a second independent execution environment, wherein the first independent execution environment has at least one capability that the second independent execution environment does not have, a request that is associated with a requested update from a second independent execution environment of a first application processor to a secure world of the first application processor;

validating the requested update;

communicating instructions associated with the validated update from the secure world to the second independent execution environment;

for image binaries associated with the validated update, sending image requests from the second independent execution environment to a cloud service;

receiving, by the secure world, the requested image binaries from the cloud service;

using the secure world to write the received image binaries to memory; and

validating the written image binaries.

9. The method of claim 8, wherein validating the requested update includes:

determining whether the requested update is properly signed; and

comparing image binaries associated with the requested update with image binaries already installed.

10. The method of claim 8, wherein validating the written image binaries includes comparing signatures associated with the image binaries with corresponding signatures stored in metadata associated with the image binaries.

18. A processor-readable storage medium, having stored thereon processor-executable code that is configured to, upon execution by at least one processor, enable at least two independent execution environments for the processor including a first independent execution environment and a second execution environment, wherein the first independent execution environment has at least one capability that the second independent execution environment does not have, and further configured in response to execution to enable actions, including:

communicating a request that is associated with a requested update from the second independent execution environment to the secure world;

validating the requested update;

communicating instructions associated with the validated update from the secure world to the second independent execution environment;

for image binaries associated with the validated update, sending image requests from the second independent execution environment to a cloud service;

receiving, by the secure world, the requested image binaries from the cloud service;

using the secure world to write the received image binaries to memory; and

validating the written image binaries.