Method for Software Anti-Rollback Recovery
A temporary anti-rollback table—which is cryptographically signed, unique to a specific device, and includes a version number—is provided to an electronic device requiring a replacement anti-rollback table. The table is verified by the device, and loaded to memory following a reboot. The memory image of the table is used to perform anti-rollback verification of all trusted software components as they are loaded. After booting, the memory image of the table is written in a secure manner to non-volatile memory as a replacement anti-rollback table, and the temporary anti-rollback table is deleted. The minimum required table version number in OTP memory is incremented. The temporary anti-rollback table is created and signed using a private key at authorized service centers; a corresponding public key in the electronic device verifies its authenticity.
1 . A method of recovery by an electronic device having a processor and having non-volatile memory and One Time Programmable (OTP) memory, in which an anti-rollback table is lost or corrupted, comprising:
rebooting the device;
loading into memory, from a predetermined address, by boot code or a first secure software component initially loaded by boot code and executed on the processor, a temporary anti-rollback table having a version number and that has been cryptographically signed, the temporary anti-rollback table including a minimum allowable security revision number for each of a plurality of software components;
verifying the validity of the temporary anti-rollback table;
verifying, using the memory image of the temporary anti-rollback table, a security revision number of each software component subsequently loaded during the boot process; and
after an appropriate memory write driver is loaded, securely saving the memory image of the temporary anti-rollback table as a replacement anti-rollback table in non-volatile storage.
2 . The method of claim 1 , further comprising, prior to loading the temporary anti-rollback table into memory by the first secure software component initially loaded by boot code, verifying that a security revision number of the first secure software component is at least as great as a corresponding security revision number stored in OTP memory.
3 . The method of claim 1 wherein loading the temporary anti-rollback table into memory from a predetermined address comprises reading the table over a USB or UART interface.
4 . The method of claim 1 wherein loading the temporary anti-rollback table into memory from a predetermined address comprises reading the table from non-volatile memory on the device.
5 . The method of claim 4 wherein reading the temporary anti-rollback table from non-volatile memory comprises:
reading the table from public non-volatile memory together with integrity information; and
verifying the integrity of the table using a unique key
6 . The method of claim 4 wherein reading the temporary anti-rollback table from non-volatile memory comprises reading the table from a Replay Protected Memory Block (RPMB).
7 . The method of claim 1 wherein verifying the validity of the temporary anti-rollback table comprises verifying that a device ID used in creating the cryptographic signature matches an ID of the electronic device.
8 . The method of claim 1 wherein verifying the validity of the temporary anti-rollback table comprises utilizing a public key in the boot code or first software component to verify that the cryptographic signature was generated using a corresponding private key.
9 . The method of claim 1 wherein verifying the validity of the temporary anti-rollback table comprises verifying that the temporary anti-rollback table version number is at least as great as a minimum required anti-rollback table version number stored in OTP memory on the electronic device.
10 . The method of claim 1 , further comprising, after loading the temporary anti-rollback table into memory, setting a state bit in memory to trigger a subsequent write of the memory image of the anti-rollback table as a replacement anti-rollback table, when an appropriate memory write driver has been loaded.
11 . The method of claim 10 wherein securely saving the memory image of the temporary anti-rollback table as a replacement anti-rollback table comprises saving the memory image of the temporary anti-rollback table after all software components to be anti-rollback verified have been loaded, and in response to the state bit.
12 . The method of claim 1 , further comprising modifying the memory image of the temporary anti-rollback table in response to the security revision number update of at least one software component.
13 . The method of claim 1 , further comprising, upon loading a software component for which no corresponding entry exists in the memory image of the temporary anti-rollback table, updating the memory image of the temporary anti-rollback table to include the software component and an associated security revision number.
14 . The method of claim 1 wherein securely saving the memory image of the temporary anti-rollback table as a replacement anti-rollback table comprises:
generating integrity data for the memory image of the temporary anti-rollback table; and
writing the memory image of the temporary anti-rollback table to non-secure, non-volatile memory as a replacement anti-rollback table, along with the integrity data.
15 . The method of claim 14 wherein generating integrity data for the memory image of the temporary anti-rollback table comprises generating a Hash-based Message Authentication Code using a unique key available only in a secure operating mode.
16 . The method of claim 1 wherein securely saving the memory image of the temporary anti-rollback table as a replacement anti-rollback table comprises writing the memory image of the temporary anti-rollback table to a Replay Protected Memory Block of non-volatile memory as a replacement anti-rollback table.
17 . The method of claim 9 wherein securely saving the memory image of the temporary anti-rollback table as a replacement anti-rollback table comprises:
incrementing the minimum required anti-rollback table version number; and
storing the updated minimum required anti-rollback table version number in OTP memory.
18 . The method of claim 1 further comprising:
loading a rich operating system (OS) and executing, by the processor, one or more applications under the rich OS; and
operating the processor in a secure mode in isolation from the rich OS and its applications.
19 . The method of claim 18 wherein the processor comprises a first processing unit operative to execute the rich OS and its applications and a second processing unit isolated from the first processing unit, and wherein operating the processor in a secure mode in isolation from the rich OS and its applications comprises executing the secure mode on the second processing unit.
20 . The method of claim 18 wherein the OTP memory is only accessible by the processor in secure mode.
21 . A method of creating a temporary anti-rollback table for an electronic device, comprising:
obtaining from the device a unique device ID and a minimum required version number of an anti-rollback table;
generating a temporary anti-rollback table including an identification of all secure software components to be anti-rollback verified and a security revision number for each such software component;
cryptographically signing the temporary anti-rollback table using a private key, the device ID, and the minimum required table version number; and
providing the temporary anti-rollback table to the device.
22 . The method of claim 21 wherein the security revision number for each software component in the temporary anti-rollback table is zero.
23 . The method of claim 21 wherein the private key corresponds to a public key known to the electronic device.
24 . An electronic device, comprising:
a processor;
non-volatile memory; and
One Time Programmable (OTP) memory;
wherein the processor is operative to
reboot the device;
load into memory, from a predetermined address, by boot code or a first secure software component initially loaded by boot code, a temporary anti-rollback table having a version number and that has been cryptographically signed, the temporary anti-rollback table including a minimum allowable security revision number for each of a plurality of software components;
verify the validity of the temporary anti-rollback table;
verify, using the memory image of the temporary anti-rollback table, a security revision number of each software component subsequently loaded during the boot process; and
after an appropriate memory write driver is loaded, securely save the memory image of the temporary anti-rollback table as a replacement anti-rollback table.