Secure firmware interface
A mailbox mechanism is used for communication of secure messages from a server to the firmware of a device. Mailbox content provided by the server is authenticated in a driver execution environment of the device, using reboots across the communication sessions, and then stored in secure storage. The communication sessions include first receiving a signed server key, and then receiving a message from the server that is based on a hash of a nonce generated by the device.
1. A method for securely sending a command to a device comprising the steps of:
a server sending a signed server key to the device while the device is booted;
the server instructing the device to reboot a first time, while the device is booted;
the server receiving, from the device after the device has rebooted, a nonce encrypted using the signed server key;
the server sending a message to the device that includes a first portion with a secure command and a second portion that is based on a hash of the nonce, while the device is booted;
the server instructing the device to reboot a second time, while the device is still booted from the reboot.
2. The method according to claim 1 , wherein the second portion is the hash of the nonce.
3. The method according to claim 1 , wherein the second portion is a signature that is calculated as if the hash of the nonce were in the message.
4. The method of claim 1 , wherein the message includes a key revocation list.
5. The method of claim 1 , wherein the signed server key is signed by a further, signing server.
6. The method of claim 1 , wherein the message includes a command to:
activate a component of firmware in the device;
deactive a component of firmware in the device;
launch an application in the device;
save data in the device;
delete data in the device;
collect data; or
send data to the server.
7. The method of claim 1 , wherein a public key corresponding to the signed server key is stored in firmware in the device.
8. The method of claim 1 , further comprising the server decrypting the nonce.
9. The method of claim 1 , wherein all the sending, receiving and instructing steps are carried out via an agent present in an operating system of the device.
10. The method of claim 9 further comprising, prior to the server sending the signed server key to the device:
the server receiving a call initiated by the agent;
the server receiving an ID of the device during the call; and
the server selecting the signed server key from multiple different signed server keys, based on the ID.
11. The method of claim 1 , further comprising:
the server receiving a further message, from the device, wherein the further message is encrypted with a session key derived from selected bits of the nonce.
12. The method of claim 11 , further comprising:
the server deriving the session key from the selected bits of the nonce; and
decrypting the further message.