DE102018217431A1 - Secure key exchange on one device, especially an embedded device - Google Patents

Abstract

Method and device for exchanging an update public key on a device, in particular an embedded device, an update signed with a master private key being loaded onto the device for an update of the update public key, the update being a contains new update public key for the device; wherein the integrity of the update is checked by the device by checking the corresponding signature of the update with the master public key present on the device; and the previous update public key of the device is overwritten with the new update public key from the update.

Description

The invention relates to a method and a device for exchanging an update public key on a device, in particular an embedded device.

Embedded devices are highly specialized devices for specific purposes. Usually, embedded devices are embedded in a specific technical context or in a higher-level technical system, e.g. in home entertainment (consumer electronics, e.g. set-top boxes or routers), in medical technology systems, or in aircraft and vehicle technology. But also e.g. ATMs are examples of embedded devices.

The processors for embedded devices often have high real-time requirements, but also requirements such as low energy consumption or low storage capacity.

The software or firmware for embedded devices can also be stored in the main memory (ROM) in a persistent flash memory.

Software or firmware updates for embedded devices are usually carried out via a corresponding Internet download. To ensure the integrity of these updates, they are signed. There is a risk that malicious software or a compromised key can get onto the embedded device through such a download and thus compromise the integrity of the device. Or the private key was compromised and an image with malware that was signed with the compromised key is loaded into the device.

The problem is that when a compromised key is replaced on the embedded device, a compromised key can be transferred again.

It is therefore the object of the present invention to provide a secure method for the replacement of a compromised key of an embedded device.

• Laden eines mit einem Master-Private-Keys (Master/Haupt-Privater-Schlüssel) signierten Updates (z.B. Software-Update) für eine Aktualisierung des Update-Public-Keys auf das Gerät, wobei das Update einen neuen Update-Public-Key für das Gerät enthält;
• Überprüfen der Integrität des Updates durch das Gerät durch Überprüfen der entsprechenden Signatur des Updates mit dem auf dem Gerät vorhandenen Master-Public-Key (Master/Haupt-Öffentlicher-Schlüssel);
• Überschreiben des bisherigen Update-Public-Keys des Gerät mit dem neuen Update-Public-Key aus dem Update. Das Verfahren ermöglicht u.a. ein sicheres Austauschen eine Zertifikates oder Schlüssel (Key) für eine Verschlüsselung bzw. Entschlüsselung bei einem eingebetteten Gerät (z.B. IP-Router) ohne Internetverbindung. Das Verfahren erfolgt mit Vorteil mit geeigneten asymmetrischen Verschlüsselungsverfahren mit privaten (Private Keys) und öffentlichen (Public Keys) Schlüsseln.

The object is achieved by a method for exchanging an update public key (update public key) on a device, in particular an embedded device, the method comprising the following steps:

• Loading an update (e.g. software update) signed with a master private key (master / main private key) for an update of the update public key on the device, the update being a new update public key for the device contains;
• Checking the integrity of the update by the device by checking the corresponding signature of the update with the master public key (master / main public key) present on the device;
• Overwrite the previous update public key of the device with the new update public key from the update. The method enables, among other things, a secure exchange of a certificate or key for encryption or decryption with an embedded device (for example an IP router) without an Internet connection. The method is advantageously carried out using suitable asymmetrical encryption methods with private (private keys) and public (public keys) keys.

A signature (i.e. a digital signature) is created by a sender for a message or an electronic artifact (e.g. a software update) using an asymmetric cryptographic procedure with a private key (secret signature key; private key). A recipient can use the public key (public key or verification key) to check the integrity of the message or artifact (e.g. software update, firmware update). Usually, the private key for a digital signature is not applied directly to the message or the artifact, but to its hash value, which is calculated from the message or the artifact using a hash function (such as SHA-256) becomes.

An update (i.e. software update) can e.g. are firmware, operating system, or application software (applications).

• Laden eines mit einem Update-Private-Keys (Update-Privater-Schlüssel) signiertem Updates für eine Aktualisierung der Firmware auf das Gerät;
• Überprüfen der Integrität des Updates durch das Gerät durch Überprüfen der entsprechenden Signatur des Updates mit dem auf dem Gerät vorhandenen Update-Public-Key (Update-Öffentlicher-Schlüssel), wobei das Gerät mit der im Update enthaltenen Firmware aktualisiert wird, wenn das Update mit dem Update-Private-Key signiert wurde. Weiterhin ermöglicht das Verfahren eine sichere Aktualisierung der Firmware bei einem eingebetteten Gerät ohne Internetverbindung. Firmware-Updates können somit schnell und sicher auf das eingebettete Gerät geladen werden.

A first advantageous embodiment of the invention is that the method further comprises:

• Loading an update signed with an update private key for updating the firmware on the device;
• Checking the integrity of the update by the device by checking the corresponding signature of the update with the update public key present on the device, the device being updated with the firmware contained in the update if the update is carried out with the update private key was signed. The method also enables the firmware to be updated safely an embedded device without an internet connection. Firmware updates can thus be loaded quickly and securely onto the embedded device.

Another advantageous embodiment of the invention is that the memory areas to be updated for the respective update differ in the device depending on the signature. The memory areas can be areas in the main memory (RAM) or areas of a persistent memory (eg flash memory) of the device (eg IP router). For example, areas of a memory that contain the update public key can only be replaced with updates signed with the master private key. Areas of a memory the firmware, boot loader, operating system ( OS ) or applications, can only be replaced with updates-private key signed updates (ie software updates).

A further advantageous embodiment of the invention is that in the device (for example in the embedded device) for bootloader, operating system ( OS ) and applications each have different update public keys. This increases the security of software updates.

A further advantageous embodiment of the invention is that a signed update (software update) includes unique device features, the update being carried out after checking the signature only if the device features present in the update match the device features of the device. The update also advantageously includes device properties (e.g. serial number). These device properties are checked after checking the signature. If the device properties do not match, the update will be rejected and will not be downloaded to the device. This can e.g. Security settings are relaxed to enable troubleshooting. Updates can also be limited to certain devices, as otherwise all devices can be "unsecure" (unsafe or compromised). The update tool (e.g. a diagnostic tool or engineering system) can advantageously detect these unsafe devices. Thus e.g. the activation of a feature is possible through an update for a special device.

A further advantageous embodiment of the invention is that the unique device features contain wildcards (placeholders). This means that devices with a specific characteristic (property) can be activated for a specific update (e.g. all devices that were produced before 1.1.2018). Among other things, this enables a selective deployment (selective delivery) of software updates, e.g. Mitigate manufacturing problems over a period of time.

A further advantageous embodiment of the invention is that the device integrity of the device (e.g. embedded device) is ensured by a trustworthy entity before the update. The integrity of the device (e.g. engineering system, diagnostic tool) that provides the update is also advantageously ensured by a trustworthy entity; this is advantageously done before the update is provided (software updates). A trustworthy entity can e.g. be a corresponding certification server.

• Laden eines mit einem Update-Private-Keys (UPRK) signierten Updates (UP) für eine Aktualisierung der Firmware (FW) auf das Gerät (EG);
• Überprüfen der Integrität des Updates (UP) durch das Gerät (EG) durch Überprüfen der entsprechenden Signatur des Updates (UP) mit dem auf dem Gerät (EG) vorhandenen Update-Public-Key (UPBK), wobei das Gerät (EG) mit der im Update (UP) enthaltenen Firmware (FW) aktualisiert wird, wenn das Update (UP) mit dem Update-Private-Key (UPRK) signiert wurde.

A further advantageous embodiment of the invention resides in a method for carrying out a firmware update, in particular for an embedded device ( EG ), comprising the following steps:

• Load one with an update private key ( UPRK ) signed updates ( UP ) for an update of the firmware ( FW ) on the device ( EG );
• Check the integrity of the update ( UP ) through the device ( EG ) by checking the corresponding signature of the update ( UP ) with the on the device ( EG ) existing update public key ( UPBK ), the device ( EG ) with that in the update ( UP ) included firmware ( FW ) is updated when the update ( UP ) with the update private key ( UPRK ) was signed.

A further advantageous embodiment of the invention resides in a device (e.g. engineering tool, diagnostic tool) that is set up to carry out the inventive method. The device is equipped with appropriate software (in particular for signing, encrypting the updates) and hardware (processor, memory, input / output means, communication means) or can be retrofitted therewith. The device (e.g. engineering tool, diagnostic tool) for signing the updates is preferably in a safe environment at the manufacturer.

The tool (update tool), with which the signed updates are loaded onto a device (e.g. embedded device), contains the signed updates and no private key.

The device for exchanging an update public key on a device, in particular an embedded device, is advantageously set up in such a way that an update signed with a master private key is loaded onto the device for an update of the update public key , the update containing a new update public key for the device; the integrity of the update by the device by checking the corresponding signature of the Updates are checked with the master public key on the device; and the previous update public key of the device is overwritten with the new update public key from the update.

The object is further achieved by a device for exchanging an update public key on a device, in particular an embedded device, the device being set up to update an update signed with a master private key for updating the update public key. Load keys onto the device, the update containing a new update public key for the device; wherein the integrity of the update is checked by the device by checking the corresponding signature of the update with the master public key present on the device; and the previous update public key of the device is overwritten with the new update public key from the update. The device is e.g. an engineering system or a diagnostic tool that is equipped with appropriate software (in particular for signing, encrypting the updates) and hardware (processor, memory, input / output means, communication means). The device (e.g. engineering tool, diagnostic tool) for signing the updates (with the private key) is preferably in a safe environment at the manufacturer. The tool (update tool), with which the signed updates are loaded onto a device (e.g. embedded device), contains the signed updates and no private key.

The task is further solved by a system for the delivery (deployment) of secure updates for updating the firmware on devices, in particular embedded devices,
a device (for example an engineering system or a diagnostic tool) is set up to sign the update with an update private key;
wherein the device is further configured to load the update signed with the update private key onto the device;
the device being set up to check the integrity of the update by checking the corresponding signature of the update with the update public key present on the device, the device being set up to be updated with the firmware contained in the update if the update was signed with the device's update private key. The system enables an efficient delivery (deployment) of secure updates (e.g. software, firmware, operating system, applications), especially for embedded devices. Advantageously, the delivery (deployment) of the updates takes place without an internet connection of the embedded device.

• 1 ein beispielhaftes Szenario zum Austauschen eines Update-Public-Keys auf einem Gerät, insbesondere einem eingebetteten Gerät,
• 2 ein beispielhaftes Szenario zur Aktualisierung der Firmware auf einem Gerät, insbesondere einem eingebetteten Gerät, und
• 3 ein beispielhaftes Flussdiagramm für ein Verfahren zum Austauschen eines Update-Public-Keys auf einem Gerät, insbesondere einem eingebetteten Gerät.

The invention and advantageous embodiments of the present invention are explained using the example of the following figure. It shows:

• 1 an exemplary scenario for exchanging an update public key on a device, in particular an embedded device,
• 2nd an exemplary scenario for updating the firmware on a device, in particular an embedded device, and
• 3rd an exemplary flow chart for a method for exchanging an update public key on a device, in particular an embedded device.

Embedded devices are highly specialized devices for specific purposes. Usually, embedded devices are embedded in a specific technical context or in a higher-level technical system, e.g. in home entertainment (consumer electronics, e.g. set-top boxes or routers), in medical technology systems, or in aircraft and vehicle technology.

The integrity of an update (software update) should be able to be checked by a device (in particular an embedded device) and it should be possible to exchange a detected compromised key. To ensure the integrity of an update, updates are signed using a public-private key cryptology procedure. The certificates for the signature are advantageously issued by a certification authority and signed with a root certificate. If the signature can be traced back to a trusted root certificate installed on the PC (personal computer) during installation, it is assumed that the update is trustworthy and it will be installed.

If a certificate has been compromised, it can be withdrawn by the certification body and this information is distributed over the Internet to users or devices. A PC can then determine that the signature is valid, but that the certificate has been withdrawn and the update can be classified as unsafe.

This method is too complex for a small embedded device (small embedded device) without an Internet connection or is not possible without an Internet connection.

If new software is translated in a development process (software development process) with continuous integration on a build system (tools for software creation, such as editor, configuration management system, compiler, etc.), it is advantageous if the translated updates are signed in the same way so that they are automatically integrated into the Test devices can be loaded. To do this, the private key must be available on the build system. It is difficult to protect the private key in such a way that it cannot be misused. A compromise of the private key is therefore possible.

The present invention enables i.a. Detect updates that have been signed with a compromised private key and prevent such updates from being loaded onto the embedded device.

Example scenario for performing an update (software update) for an embedded device:

1. 1. An update signed by the manufacturer is loaded into the device.
2. 2. The device checks the integrity of the update by checking the signature. A public key is stored in the device for this purpose.
3. 3. If the signature is valid, the update is imported to the device.

If the private key is compromised, the public key in the device must be replaced. For this purpose, a second public key (master public key) has been stored in the manufacture of the device. With an update that has been signed with this master key, you can replace the normal public key in the device.

For this purpose, the update image (memory image or disk image where the update is located) is divided into areas. Each of these areas complies with an UpdateAction. There are various UpdateActions. The UpdateActions differ in the memory area that they can update. These areas are e.g. Parameters, BootLoader, main program, public key, master public key, update module.

Depending on how the update was signed, only certain actions can be carried out. For example, the update module and the public key can only be exchanged for updates that have been signed with the master key.

Example scenario for performing an update with a key update on an embedded device Embedded device:

1. 1. An update for the public key signed by the manufacturer with the master update key is loaded into the device.
2. 2. The device checks the integrity of the update by checking the signature. It determines that the update was signed with the master key.
3. 3. The UpdateActions are executed. A new public key is now available in the device.
4. 4. An update signed by the manufacturer with the new key is loaded into the device.
5. 5. The device checks the integrity of the update using the new public key.
6. 6. If the signature is valid, the UpdateActions are carried out.

UpdateActions are also possible, which check certain device properties during execution and refuse to execute further UpdateActions.

One particular advantage is that if the integrity check is done in the device, it cannot be bypassed using a replay attack.

According to the invention, several public keys (at least two) are stored in the device (embedded device). This enables a secure exchange of a compromised key (key) in the device. It is advantageous to split into several areas in UpdateImage. An update action is assigned to each area. An UpdateAction is assigned to a key and is only executed if the image was also signed with the associated private key. There are advantageously UpdateActions, which check certain device properties when executed in the device and can prevent further execution of the update if the check fails.

1 shows an exemplary scenario for exchanging an update public key UPBK on a device, especially an embedded device EG , one with a master private key MPRK signed update UP for an update of the update public key UPBK on the device EG is loaded, the update UP a new update public key NUPBK for the device EG contains; taking the integrity of the update UP through the device EG by checking the corresponding signature of the update UP with that on the device EG existing master public key MPBK is checked; and where the previous update public key UPBK of the device EG with the new update public key NUPBK from the update UP is overwritten.

This is advantageously done by a device IT loading one with an update private key UPRK signed updates UP for an update of the firmware FW on the device EP. The integrity of the update is advantageously checked UP through the device EG by checking the corresponding signature of the update UP with that on the device EG existing update public key UPBK , the device EG with that in the update UP contained Firmware FW is updated when the update UP with the update private key UPRK the device IT was signed.

The update UP is from the device IT (e.g. engineering system or diagnostic tool) for the device EG provided and on the device EG via a suitable communication link KV1 loaded. With the communication link KV1 it can be a suitable wired (e.g. USB interface) or wireless (e.g. radio, Bluetooth, WLAN) connection.

The device IT (eg engineering system, diagnostic tool) is equipped with appropriate software (especially for signing) and hardware (processor, memory, input / output means, communication means), for example with a processor P2 and storage means SP2 (RAM and flash memory). The device that carries out the update is advantageously handed over to the user. The device advantageously contains the signed update that is to be loaded onto the device (for example an embedded device) and not a private key.

The tool for signing the updates (with the private key) is in a secure environment at the manufacturer.

When updating UP can be software, firmware FW , Operating system or application software that are currently in the device EG existing software, firmware FW , Replace the operating system or applications.

Even the device EG comes with appropriate software (e.g. software for checking the updates UP ) and hardware, e.g. with processor P1 and storage means SP1 (Main memory (RAM) and persistent memory (e.g. flash memory)). Through the update UP can in the device EG current software or firmware FW be replaced in the working memory or in the flash memory.

The device is advantageous IT is set up, one with a master private key MPRK signed update UP for an update of the update public key UPBK on the device EG to load, the update UP a new update public key NUPBK for the device EG contains; taking the integrity of the update UP through the device EG by checking the corresponding signature of the update UP with that on the device EG existing master public key MPBK is checked; and where the previous update public key UPBK of the device EG with the new update public key NUPBK from the update UP is overwritten.

Advantageously differ in the device EG the memory areas to be updated for the respective update UP depending on the signature.

With advantage are in the device EG for bootloader, operating system ( OS ) and applications each have different update public keys UPBK deposited.

A signed update is advantageous UP unique device features, the update UP after checking the signature is only carried out if the in the update UP existing device features with the device features (e.g. serial number) of the device EG to match. The unique device features advantageously contain wildcards.

The update public key is advantageously exchanged UPBK on the device EG (embedded device) through the device IT only if the embedded device EG and the device IT in an exclusive communication connection KV1 (advantageously bidirectionally) are connected to one another. Ie that the embedded device EG and the device IT are isolated from the environment and in particular from the Internet I. For example, through an island connection between device and tool; without internet. This increases security because no attacks (e.g. man-in-the-middle attacks) can occur during an update.

The update public key is advantageously exchanged UPBK on the device EG (embedded device) through the device IT only if the embedded device EG is isolated from other devices and in particular from the Internet I and has been rebooted. This ensures that there is memory in the embedded device EG there is no persistent malware.

Optionally, the device EG eg for communication with a higher-level control unit via a suitable communication connection KV2 (eg WLAN) must be connected to the Internet I.

2nd shows an example scenario for updating the firmware FW on one device EG , especially an embedded device. The representation according to the 2nd shows a system for the delivery (deployment) of secure updates NFW for an update of the firmware FW on devices EG , especially embedded devices. Furthermore, the device IT set up with the update private key UPRK signed update NFW on the device EG to load. The device EG is set up by checking the corresponding signature of the update NFW with that on the device EG existing update public key UPBK the integrity of the update NFW to check, the device EG is set up with that in the update NFW contained new firmware NFW updated will when the update NFW (ie the new firmware for the device) with the update private key UPRK the device IT was signed. contraption IT and device EG are equipped with the appropriate hardware (processors P1 , P2 and memory SP1 , SP2 (RAM and Flash)) and software (e.g. encryption software for asymmetric cryptography)

The update public key is advantageously exchanged UPBK on the device EG (embedded device) through the device IT only if the embedded device EG and the device IT in an exclusive communication connection KV1 (advantageously bidirectionally) are connected to one another.

Ie that the embedded device EG and the device IT are isolated from the environment and in particular from the Internet I. For example, through an island connection between device and tool; without internet. This increases security because no attacks (e.g. man-in-the-middle attacks) can occur during an update.

The update public key is advantageously exchanged UPBK on the device EG (embedded device) through the device IT only if the embedded device EG is isolated from other devices and especially from the Internet I and has been rebooted. This ensures that there is memory in the embedded device EG there is no persistent malware.

• Laden eines mit einem Update-Private-Keys (UPRK) signierten Updates (UP) für eine Aktualisierung der Firmware (FW) auf das Gerät (EG);
• Überprüfen der Integrität des Updates (UP) durch das Gerät (EG) durch Überprüfen der entsprechenden Signatur des Updates (UP) mit dem auf dem Gerät (EG) vorhandenen Update-Public-Key (UPBK), wobei das Gerät (EG) mit der im Update (UP) enthaltenen Firmware (FW) aktualisiert wird, wenn das Update (UP) mit dem Update-Private-Key (UPRK) signiert wurde.

A further advantageous embodiment of the invention resides in a method for carrying out a firmware update, in particular for an embedded device ( EG ), comprising the following steps:

• Load one with an update private key ( UPRK ) signed updates ( UP ) for an update of the firmware ( FW ) on the device ( EG );
• Check the integrity of the update ( UP ) through the device ( EG ) by checking the corresponding signature of the update ( UP ) with the on the device ( EG ) existing update public key ( UPBK ), the device ( EG ) with that in the update ( UP ) included firmware ( FW ) is updated when the update ( UP ) with the update private key ( UPRK ) was signed.

• (VS1) Laden eines mit einem Master-Private-Keys signiertem Updates für eine Aktualisierung des Update-Public-Keys auf das Gerät, wobei das Update einen neuen Update-Public-Key für das Gerät enthält;
• (VS2) Überprüfen der Integrität des Updates durch das Gerät durch Überprüfen der entsprechenden Signatur des Updates mit dem auf dem Gerät vorhandenen Master-Public-Key;
• (VS3) Überschreiben des bisherigen Update-Public-Keys des Gerät mit dem neuen Update-Public-Key aus dem Update.

3rd shows an exemplary flow diagram for a method for exchanging an update public key UPBK on one device EG , especially an embedded device. The process includes the following steps:

• ( VS1 ) Loading an update signed with a master private key for an update of the update public key onto the device, the update containing a new update public key for the device;
• ( VS2 ) Checking the integrity of the update by the device by checking the corresponding signature of the update with the master public key present on the device;
• ( VS3 ) Overwrite the previous update public key of the device with the new update public key from the update.

Process step ( VS1 ) "Loading an update signed with a master private key for an update of the update public key on the device, the update containing a new update public key for the device" is carried out by an appropriately configured device (eg engineering system ) carried out.

• Laden eines mit einem Update-Private-Keys signierten Updates für eine Aktualisierung der Firmware auf das Gerät;
• Überprüfen der Integrität des Updates durch das Gerät durch Überprüfen der entsprechenden Signatur des Updates mit dem auf dem Gerät vorhandenen Update-Public-Key, wobei das Gerät mit der im Update enthaltenen Firmware aktualisiert wird, wenn das Update mit dem Update-Private-Key signiert wurde.

The process optionally includes the following steps:

• Downloading an update signed with an update private key to update the firmware on the device;
• Checking the integrity of the update by the device by checking the corresponding signature of the update with the update public key present on the device, the device being updated with the firmware contained in the update when the update is signed with the update private key has been.

Advantageously differ in the device EG the memory areas to be updated for the respective update UP depending on the signature.

With advantage are in the device EG for bootloader, operating system ( OS ) and applications each have different update public keys UPBK deposited.

A signed update is advantageous UP unique device features, the update UP after checking the signature is only carried out if the in the update UP existing device features with the device features (e.g. serial number) of the device EG to match. The unique device features advantageously contain wildcards.

It is advantageous to download the update UP the device integrity of the device EG ensured by a trustworthy entity, e.g. by a certification server.

A further advantageous embodiment of the invention is that the method is only carried out when the embedded device and the device are connected to one another in an exclusive communication connection (advantageously bidirectionally). This means that the embedded device and the device are isolated from the environment and in particular from the Internet in terms of data technology. For example, through an island connection between the device EG and device; without internet. The exclusive communication connection is advantageously a point-to-point connection, and advantageously a secure point-to-point connection.

The embedded device is advantageous before carrying out the method steps EG isolated from other devices and especially from the Internet and rebooted. This ensures that there is memory in the embedded device EG there is no persistent malware.

The method according to the invention in particular enables a secure firmware update for embedded devices without an Internet connection.

Further aspects of the present invention:

• - Updates are signed with a private key (update private key) and the signature is checked by the end device. A public key (update public key) is available in the end device for this purpose.
• - During development, update files are automatically signed in the build system with the update private key. For this reason, the update private key must be available on the build computers and for testing on all developer computers. So it can potentially be "stolen" relatively easily since many people have access to it.
• - Another public key (master public key) is stored in the end device. Updates that have been signed with a matching private key (master private key) can exchange the update public key.
• - It is easier to "watch" the master private key because the update public key exchange is only carried out manually.
• - Device properties (e.g. serial number) can also be stored in the update. These device properties are checked after checking the signature. If the device properties do not match, the update is rejected. This can e.g. Security settings are relaxed to enable troubleshooting. Here it is important to limit these updates to certain devices, otherwise all devices can become unsecure. The update tool (e.g. engineering system) can advantageously recognize these unsecure (unsafe) devices. Method and device for exchanging an update public key on a device, in particular an embedded device, an update signed with a master private key being loaded onto the device for an update of the update public key, the update being a contains new update public key for the device; wherein the integrity of the update is checked by the device by checking the corresponding signature of the update with the master public key present on the device; and the previous update public key of the device is overwritten with the new update public key from the update.

Reference list

EG

Embedded device

IT

Engineering system

KV1, KV2

Communication link

SP1, SP2

Storage

P1, P2

processor

MPRK

Master private key

MPBK

Master public key

UPBK

Update public key

NUPBK

New update public key

UP

Software update

UPRK

Update private key

FW

Firmware

NFW

New firmware

VS1 - VS3

Procedural step

Claims (11)

Method for exchanging an update public key (UPBK) on a device (EG), in particular an embedded device (EG), the method comprising the following steps: (VS1) Loading an update (UP) signed with a master private key (MPRK) for an update of the update public key (UPBK) on the device (EG), the update (UP) being a new update public -Key (NUPBK) for the device (EG) contains; (VS2) checking the integrity of the update (UP) by the device (EG) by checking the corresponding signature of the update (UP) with the master public key (MPBK) present on the device (EG); (VS3) Overwrite the previous update public key (UPBK) of the device (EG) with the new update public key (NUPBK) from the update (UP). Procedure according to Claim 1 , further comprising the following steps: Loading an update (UP) signed with an update private key (UPRK) for an update of the firmware (FW) on the device (EG); Checking the integrity of the update (UP) by the device (EG) by checking the corresponding signature of the update (UP) with the update public key (UPBK) present on the device (EG), the device (EG) with the firmware (FW) contained in the update (UP) is updated if the update (UP) was signed with the update private key (UPRK). Method according to one of the preceding claims, wherein in the device (EG) the memory areas to be updated for the respective update (UP) differ depending on the signature. Method according to claim according to one of the preceding claims, wherein different update public keys (UPBK) are stored in the device (EG) for bootloader, operating system (OS) and applications. Method according to one of the preceding claims, wherein a signed update (UP) comprises unique device features, the update (UP) being carried out after checking the signature only if the device features present in the update (UP) match the device features of the device (EG) . Procedure according to Claim 5 , where the unique device features contain wildcards. Method according to one of the preceding claims, wherein the device integrity of the device (EG) is ensured by a trustworthy entity before the update (UP). Method for carrying out a firmware update, in particular for an embedded device (EG), comprising the following steps: Loading an update (UP) signed with an update private key (UPRK) for an update of the firmware (FW) on the device (EG); Checking the integrity of the update (UP) by the device (EG) by checking the corresponding signature of the update (UP) with the update public key (UPBK) present on the device (EG), the device (EG) with the firmware (FW) contained in the update (UP) is updated if the update (UP) was signed with the update private key (UPRK). Device which is set up to carry out a method according to the preceding claims. Device (ES) for exchanging an update public key (UPBK) on a device (EG), in particular an embedded device (EG), the device (ES) being set up to receive a master private key (MPRK ) to load signed update (UP) for an update of the update public key (UPBK) on the device (EG), the update (UP) containing a new update public key (NUPBK) for the device (EG) ; wherein the integrity of the update (UP) is checked by the device (EG) by checking the corresponding signature of the update (UP) with the master public key (MPBK) present on the device (EG); and the previous update public key (UPBK) of the device (EG) is overwritten with the new update public key (NUPBK) from the update (UP). System for the delivery of secure updates (UP) for updating the firmware (FW) on devices (EG), in particular embedded devices (EG), wherein a device (ES) is set up to sign the update (UP) with an update private key (UPRK); the device being further configured to load the update (UP) signed with the update private key (UPRK) onto the device (EG); wherein the device (EG) is set up to check the integrity of the update (UP) by checking the corresponding signature of the update (UP) with the update public key (UPBK) present on the device (EG), the Device (EG) is set up so that it is updated with the firmware (FW) contained in the update (UP) if the update (UP) was signed with the update private key (UPRK) of the device (ES).

Images