System and method for the secure unidirectional transfer of software and software updates
View Patent ↗A system is disclosed that provides an authenticated payload, e.g., a software program or update, to a recipient device. A storage device stores a payload. A provider server coupled to the storage device outputs the payload and a manifest table. The manifest table includes information identifying the payload. A manifest engine TX server receives the payload and the manifest table from the provider server, generates information about the received payload, compares the information generated about the payload with the contents of the received manifest table, and, if the information about the received payload matches information for a particular one of the at least one payloads included in the received manifest table, forwards the payload to a one-way data link. The output of the one-way data link is coupled to a manifest engine RX server, which in turn forwards any received payload to a recipient device coupled to an output of the manifest engine RX server.
1. A system for providing an authenticated payload to a recipient device, comprising:
a storage device for storing at least one payload;
a provider server coupled to the storage device and configured to output a particular one of the at least one payloads and a manifest table, the manifest table including information identifying each of the at least one payloads;
a manifest engine TX server coupled to the provider server, the manifest engine TX server configured to receive the particular payload from the provider server, to receive the manifest table from the provider server, to generate information about the received payload, to compare the information generated about the payload with the contents of the received manifest table, and, if the information about the received payload matches information for a particular one of the at least one payloads included in the received manifest table, to forward the payload on an output;
a data link having an input coupled to the output of the manifest engine TX server and an output;
a manifest engine RX server having an input coupled to the output of the data link and an output, and configured to forward any payload received at the input to the output; and
a recipient device coupled to the output of the manifest engine RX server and configured to receive any payload output by the manifest engine RX server.
2. The system of claim 1 , wherein the manifest engine TX server adds a tag to the payload to mark it as authenticated prior to forwarding the payload on the output thereof.
3. The system of claim 1 , wherein the manifest engine RX server adds a tag to the payload to mark it as authenticated prior to forwarding the payload on the output thereof.
4. The system of claim 1 , wherein the data link is a one-way data link in which data may only pass from the input to the output.
5. The system of claim 1 , wherein the provider server has two outputs, a first output for outputting the particular payload and a second output for outputting the manifest table; and wherein the manifest engine TX server has two inputs, a first input coupled to the first output of the provider server to receive the particular payload and a second input coupled to the second output of the provider server to receive the manifest table.
6. The system of claim 1 , wherein the provider server has two outputs, a first output for outputting the particular payload and a second output for outputting the manifest table; and wherein the manifest engine TX server has two inputs, a first input coupled to the first output of the provider server to receive the particular payload and a second input for indirectly receiving the manifest table output by the provider server.
7. The system of claim 1 , wherein the provider server has one output for outputting the particular payload and the manifest table; and wherein the manifest engine TX server has a single input coupled to the first output of the provider server for receiving the particular payload and the manifest table.
8. The system of claim 7 , wherein the provider server is configured to separately tag the particular payload and the manifest table; and wherein the manifest engine TX server is configured to identify the payload and the manifest table based upon such tags.
9. The system of claim 1 , wherein the provider server is coupled to the recipient device via a separate connection and wherein the provider server is configured to output the particular one of the at least one payloads based upon a request for the particular one of the at least one payloads from the recipient device.
10. The system of claim 9 , wherein the separate connection is a network connection.
11. The system of claim 1 , wherein the recipient device has an output for requesting a payload, the request for such payload identifying a particular one of the at least one payloads, the system further comprising:
a second manifest engine TX server having an input coupled to the output of the recipient device and an output, and configured to forward any request received at the input to the output;
a second data link having an input coupled to the output of the second manifest engine TX server and an output; and
a second manifest engine RX server having a first input coupled to the output of the second data link, a second input coupled to the provider server and an output coupled to the provider server;
wherein the provider server is configured to provide a second manifest table including information identifying each of the at least one payloads; and wherein the second manifest engine RX server is configured to receive a request forwarded by the second manifest engine TX server via the second data link and to compare the received request with the information in the second manifest table and, if the particular requested payload is identified in the second manifest table, to forward the received request to the provider server via the output.
12. The system of claim 11 , wherein the request from the recipient device also includes second information demonstrating that the recipient device is authorized to receive the requested payload, wherein the manifest table also includes, for each of the at least one payloads, second information identifying devices authorized to receive the associated payload, and wherein the second manifest engine RX server is also configured to compare the second information in the request with the second information in the manifest table when determining whether to forward the request to the provider server.
13. The system of claim 1 , wherein the recipient device comprises:
a system central processing unit; and
a dedicated storage device for storing authenticated payloads having a write-only input coupled to the output of the manifest engine RX server and a read-only output coupled to the system central processing unit.
14. A system for providing an authenticated payload to a recipient device, comprising:
a storage device for storing at least one payload;
a provider server coupled to the storage device and configured to output a particular one of the at least one payloads and a manifest table, the manifest table including information identifying each of the at least one payloads;
a manifest engine TX server coupled to the provider server, the manifest engine TX server configured to receive the particular payload from the provider server, to receive the manifest table from the provider server, to generate information about the received payload, to compare the information generated about the payload with the contents of the received manifest table, and, if the information about the received payload matches information for a particular one of the at least one payloads included in the received manifest table, to forward the payload on an output;
a data link having an input coupled to the output of the manifest engine TX server and an output;
a manifest engine RX server having an input coupled to the output of the data link and an output, and configured to forward any payload received at the input to the output; and
a recipient device coupled to the output of the manifest engine RX server and configured to receive any payload output by the manifest engine RX server, the provider server also coupled to the recipient device via a separate connection and wherein the provider server is configured to output the particular one of the at least one payloads based upon a request for the particular one of the at least one payloads from the recipient device.
15. The system of claim 14 , wherein the separate connection is a network connection.
16. A system for providing an authenticated payload to a recipient device, comprising:
a storage device for storing at least one payload;
a provider server coupled to the storage device and configured to output a particular one of the at least one payloads and a manifest table, the manifest table including information identifying each of the at least one payloads;
a manifest engine TX server coupled to the provider server, the manifest engine TX server configured to receive the particular payload from the provider server, to receive the manifest table from the provider server, to generate information about the received payload, to compare the information generated about the payload with the contents of the received manifest table, and, if the information about the received payload matches information for a particular one of the at least one payloads included in the received manifest table, to forward the payload on an output;
a data link having an input coupled to the output of the manifest engine TX server and an output;
a manifest engine RX server having an input coupled to the output of the data link and an output, and configured to forward any payload received at the input to the output;
a recipient device coupled to the output of the manifest engine RX server and configured to receive any payload output by the manifest engine RX server, the recipient device also having an output for requesting a payload, the request for such payload identifying a particular one of the at least one payloads;
a second manifest engine TX server having an input coupled to the output of the recipient device and an output, and configured to forward any request received at the input to the output;
a second data link having an input coupled to the output of the second manifest engine TX server and an output; and
a second manifest engine RX server having a first input coupled to the output of the second data link, a second input coupled to the provider server and an output coupled to the provider server;
wherein the provider server is configured to provide a second manifest table including information identifying each of the at least one payloads; and wherein the second manifest engine RX server is configured to receive a request forwarded by the second manifest engine TX server via the second data link, to compare the received request with the information in the second manifest table and, if the particular requested payload is identified in the second manifest table, to forward the received request to the provider server via the output of the second manifest engine RX server.
17. The system of claim 16 , wherein the request from the recipient device also includes second information demonstrating that the recipient device is authorized to receive the requested payload, wherein the manifest table also includes, for each of the at least one payloads, second information identifying devices authorized to receive the associated payload, and wherein the second manifest engine RX server is also configured to compare the second information in the request with the second information in the manifest table when determining whether to forward the request to the provider server.
18. A manifest transfer engine comprising:
a server for sequentially outputting a series of file manifest tables, each file manifest table of the series including file information and being outputted at a predetermined fixed time interval after the output of the immediately preceding file manifest table of the series;
a send side having an input and an output and configured to receive and store each of the series of file manifest tables from the server, the send side further configured to discard each file manifest table of the series of file manifest tables after the expiration of a period of time equal to the predetermined fixed interval so that only a single file manifest table is stored at any point in time, the send side still further configured to receive a file from a user on the input, to compare the received file with the file information in the currently stored file manifest table and, only if there is a match between the file and the file information in the currently stored file manifest table, to transmit the received file on the output;
a one-way data link having an input coupled to the output of the send side and an output and configured to enforce unidirectional data flow from the input to the output; and
a receive side having an input coupled to the output of the one-way data link.
19. A manifest transfer engine comprising:
a server for outputting a file manifest table, the file manifest table including file information and time information;
a send side having an input and an output and configured to receive and store the file manifest table from the server, the send side further configured to discard the file manifest table after a period of time equal to the time information, the send side still further configured to receive a file from a user on the input, to compare the received file with the file information stored in the file manifest table and, only if there is a match between the file and the file manifest table, to transmit the received file on the output;
a one-way data link having an input coupled to the output of the send side and an output and configured to enforce unidirectional data flow from the input to the output; and
a receive side having an input coupled to the output of the one-way data link.