Safe modular upgrades
An Internet of Things (IoT) device is deployed with embedded software that may comprise multiple components. After deployment, updated versions of one or more components of the embedded software may become available. The IoT device maintains a manifest of the installed components. Periodically, the IoT device requests an updated copy of the manifest from an upgrade server. The installed manifest and the updated manifest are compared to determine if updated versions of any components are available. If so, the IoT device requests only the components to be updated. Prior to beginning the copying of the upgraded components, an upgrade flag is set. The IoT device then begins copying the received components into memory, replaces the manifest with the updated manifest, and clears the upgrade flag.
1. A method comprising:
accessing, by one or more processors, a local manifest that identifies a first module, a first local hash of the first module, a second module, a second local hash of the second module, a first memory region for the first module, and a second memory region for the second module;
accessing, by the one or more processors, a remote manifest that identifies the first module, a first remote hash of the first module, the second module, and a second remote hash of the second module;
determining that the first local hash is different from the first remote hash;
determining that the second local hash is equal to the second remote hash; and
receiving, over a network, the first module without receiving the second module.
2. The method of claim 1 , further comprising:
multiplexing, on a single connection, multiple data streams comprising a first data stream for communication by an application and a second data stream for receiving the first module.
3. The method of claim 1 , further comprising:
decrypting the received first module;
generating a hash of the received first module; and
comparing the generated hash to the first remote hash to verify the received first module.
4. The method of claim 1 , further comprising:
transmitting, over the network, the local manifest; and
receiving, over the network, the remote manifest.
5. The method of claim 1 , wherein the first module of the local manifest is an application module.
6. The method of claim 1 , wherein the first module of the local manifest is a kernel module.
7. The method of claim 1 , wherein:
the local manifest further identifies a third module;
the remote manifest further identifies the third module; and
the method further comprises:
receiving, over the network, the third module;
validating the received first module;
validating the received third module; and
installing the received first module and the received third module based on the validating of the received first module and the received third module.
8. A system comprising:
one or more computer processors; and
one or more computer-readable mediums storing instructions that, when executed by the one or more computer processors, cause the system to perform operations comprising:
accessing a local manifest that identifies a first module, a first local hash of the first module, a second module, a second local hash of the second module, a first memory region for the first module, and a second memory region for the second module;
accessing a remote manifest that identifies the first module, a first remote hash of the first module, the second module, and a second remote hash of the second module;
determining that the first local hash is different from the first remote hash;
determining that the second local hash is equal to the second remote hash; and
receiving, over a network, the first module without receiving the second module.
9. The system of claim 8 , wherein the operations further comprise:
multiplexing, on a single connection, multiple data streams comprising a first data stream for communication by an application and a second data stream for receiving the first module.
10. The system of claim 8 , wherein the operations further comprise:
decrypting the received first module;
generating a hash of the received first module; and
comparing the generated hash to the first remote hash to verify the received first module.
11. The system of claim 8 , wherein the operations further comprise:
transmitting, over the network, the local manifest; and
receiving, over the network, the remote manifest.
12. The system of claim 8 , wherein:
the local manifest further identifies a third module;
the remote manifest further identifies the third module; and
the operations further comprise:
receiving, over the network, the third module;
validating the received first module;
validating the received third module; and
installing the received first module and the received third module based on the validating of the received first module and the received third module.
13. A non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors of one or more computing devices, cause the one or more computing devices to perform operations comprising:
accessing a local manifest that identifies a first module, a first local hash of the first module, a second module, a second local hash of the second module, a first memory region for the first module, and a second memory region for the second module;
accessing a remote manifest that identifies the first module, a first remote hash of the first module, the second module, and a second remote hash of the second module;
determining that the first local hash is different from the first remote hash;
determining that the second local hash is equal to the second remote hash; and
receiving, over a network, the first module without receiving the second module.
14. The non-transitory computer-readable medium of claim 13 , wherein the operations further comprise:
multiplexing, on a single connection, multiple data streams comprising a first data stream for communication by an application and a second data stream for receiving the first module.
15. The non-transitory computer-readable medium of claim 13 , wherein the operations further comprise:
decrypting the received first module;
generating a hash of the received first module; and
comparing the generated hash to the first remote hash to verify the received first module.
16. The non-transitory computer-readable medium of claim 13 , wherein the operations further comprise:
transmitting, over the network, the local manifest; and
receiving, over the network, the remote manifest.
17. The non-transitory computer-readable medium of claim 13 , wherein the first module of the local manifest is an application module.
18. The system of claim 8 , wherein the first module of the local manifest is an application module.
19. The non-transitory computer-readable medium of claim 13 , wherein:
the local manifest further identifies a third module;
the remote manifest further identifies the third module; and
the operations further comprise:
receiving, over the network, the third module;
validating the received first module;
validating the received third module; and
installing the received first module and the received third module based on the validating of the received first module and the received third module.
20. The non-transitory computer-readable medium of claim 13 , wherein the first module of the local manifest is a kernel module.