Reliable and secure firmware update with a dynamic validation for internet of things (IoT) devices
A computing system for a secure and reliable firmware update through a verification process, dynamic validation and continuous monitoring for error or failure and speedy correction of Internet of Things (IoT) device operability. The invention uses a Trusted Execution Environment (TEE) for hardware-based isolation of the firmware update, validation and continuous monitoring services. The isolation is performed by hardware System on a Chip (SoC) Security Extensions such as ARM TrustZone or similar technologies on other hardware platforms. The invention therefore comprises Firmware Update Service (FUS), System Validation Service (SMS) and Continuous Monitoring Service (CMS) running in the TEE with dedicated memory and storage, thus providing a trusted configuration management functionality for the operating system (OS) code and applications on IoT devices. Services running in the TEE use both direct (hardware level) and indirect (software agents inside main execution environment (MEE)) methods of control of the MEE. Embodiments of the invention apply all updates to a staging (new) execution environment (SEE) without changing of the MEE.
1. A system to securely perform a firmware update on a computing system, the system comprising:
a computer system firmware update package comprising a new firmware,
a security extension to isolate a Trusted Execution Environment (TEE);
a firmware update system to run in the TEE;
a Main Execution Environment (MEE) to run an operating system (OS) disposed in the MEE; and
a Stage Execution Environment (SEE),
wherein the firmware update system
performs integrity, authenticity validation and management of the computer system firmware update package,
copies the MEE including the OS into the SEE,
applies the new firmware to the SEE, and
upon successful boot and initialization of the SEE, moves the MEE to a Backup Execution Environment (BEE), and replaces the MEE with the SEE as a new MEE to perform a verifiable update of the firmware, and
the TEE isolates the MEE and the SEE from one another with the security extension.
2. The system as claimed in claim 1 wherein the computing system comprises one or more of an Internet of Things (loT) device, a mobile device, a network device, a workstation or a server.
3. The system as claimed in claim 1 further comprising a separate hardware physically integrated into the computing system, the TEE runs on the separate hardware.
4. The system as claimed in claim 1 wherein the TEE comprises one or more of a Digital Rights Management (DRM) service, a cryptographic service, or a trusted application.
5. The system as claimed in claim 1 wherein the system comprises multiple copies of the TEE created with different firmware versions and configurations.
6. The system as claimed in claim 1 wherein the BEE comprises a plurality of BEEs and the firmware update system switches to a selected one of the plurality of BEEs with optional configuration synchronization.
7. The system as claimed in claim 1 wherein the firmware update system synchronizes the SEE configuration with the MEE.
8. The system as claimed in claim 1 wherein the BEE comprises a plurality of BEEs.
9. The system of claim 1 wherein the firmware update system restores the MEE from the BEE in the event of a problem with the new MEE.
10. The system of claim 1 , further comprising a continuous monitoring system running in the TEE to perform health monitoring of the new MEE.
11. The system of claim 10 , wherein the continuous monitoring system fixes a known problem in the new MEE or initiates a recovery process in the new MEE when a critical problem without a known solution is detected.