GB2425193A

GB2425193A - Method for updating the software in a processor unit

Info

Publication number: GB2425193A
Application number: GB0507562A
Authority: GB
Inventors: Richard Ormson
Original assignee: NEC Technologies UK Ltd
Current assignee: NEC Technologies UK Ltd
Priority date: 2005-04-14
Filing date: 2005-04-14
Publication date: 2006-10-18
Anticipated expiration: 2025-04-14
Also published as: GB0507562D0; GB2425193B

Abstract

A method for updating the software in a processor unit comprises loading the software update to a non-volatile processor memory, verifying the source of the update, comparing the version number of the update with the version number of the current software stored in a one time write memory element (e.g. a PROM) and running the downloaded software, replacing the current software version number in the one time write memory element, dependent on the result of the comparison. The one time write memory element could be used on a bit by bit basis, with a different bit being set depending on the version number of the software being used. This method could be used to update the software in a mobile communications device and to prevent software rollback thus preventing the ability to copy an older version of the software on to the mobile communications device.

Description

METHOD OF SOFT WAKL

UPDATING AND RELATED DEVICE

The present invention relates to a method of updating software within a processor unit and to a device including such a processor unit.

There is increasing interest in the improvement of security mechanisms associated with electronic devices and in particular mobile radio communication devices such as cellular phone handsets. The improvement of such security measures is considered to offer the advantage of reducing criminal activity in general and also a reduction in lost-revenue that can arise, for example, through the theft of subsidized cellular phone handsets.

The improvement in security mechanisms has lead to a variety of principles being agreed by operator associations such as the GSMA and manufacturer associations such as EJCTA, and in accordance with such principles, the international mobile equipment identifier (IMEI), and also the data paths that cany that number to the handset air-interface, are required to be protected against unauthorised alterations.

One such known principle relates to the prevention of so-called softwareversion rollback. This principle has been developed to take account of the potential situation in which an earlier version of handset software, and having a known security fault, is accidentally or otherwise loaded onto a handset in order to replace a later version of the software which did not exhibit such a security weakness.

Software version rollback prevention therefore seeks to prevent the overwriting of a later version of software with an earlier version and so as to prevent the security of the handset becoming compromised through the reintroduction of an earlier software version having a known security fault.

Standard mechanisms for preventing software rollback are currently known and which involve incorporation of a security manager function into the software itself. This security manager function is arranged to examine any new software that is download to the handset to replace currently running software. In particular, the security manager function is arranged to initiate and control a comparison between the version number of the software newly downloaded, and that currently running in the handset.

If the newly downloaded software has a version number higher than that of the currently running software, the new software is fully downloaded. If not, the new software is rejected and no overwriting of the software currently running in the handset takes place. It is found that such a security mechanism is usually run in parallel with a software verification process which, for example, can employ a Public Key Infrastructure (PKI) mechanism, to ensure that the newly received software originates from a trusted sauce.

However, a number of disadvantages and limitations have been identified in such known mechanisms.

In particular, with regard to software-rollback prevention within cellular phone handsets, the software to be protected is that found within the Communications Central Processor Unit (CCPU) while the security management module would be located within the Application CPU of the handset. However, the Application CPU comprises an inherently insecure location since user-applications are downloaded to this area and so, when located here, the security module itself will be vulnerable to attack by the download of malicious application software. Should the security of this module be compromised, there would then be no restriction nor limitation as to the software that could be loaded onto the handset. Also, this standard form of the known security mechanisms is one that is found to be incompatible with over-the-air update systems such as the delta update system in which complete replacement of currently running software is not necessary.

Also, this known mechanism provides a hacker with immediate feedback as to whether the current software has been successfully overwritten and, in general, this security mechanism is not well suited to a system with limited memory space since it requires two copies of the software to be held in the active RAM at any one time.

The present invention seeks to provide for a method of software updating, and also a related device, having advantages over known such methods and devices.

In particular, the present invention seeks to provide for a security mechanism that can overcome the above-mentioned specific disadvantages while maintaining a high degree of protection against unwanted software version rollback.

According to one aspect of the present invention, there is provided a method of software updating in a processor unit and comprising the steps of: loading the software update having a version number to processor nonvolatile memory; verifying the source of the software update; responsive to the aforesaid verification step commencing running of the software; as an initial step in the running of the software comparing the said software update version number with a current software version number stored in one time write memory means associated with the processing unit; and running the downloaded software in place of the current software and replacing the current software version number in the one time write memory element dependent upon the result of the said comparison.

The invention advantageously provides for a simplified method of achieving a software version update in a manner having advantages over known such methods.

Preferably, the method includes the step of downloading software version updates to a non-volatile memory associated with a communications separate processor unit of a mobile radio communications device.

The downloading of the software update to the processor unit is advantageously completed without any prior step of version-checking.

In particular, the said initial step of the running of the software advantageously comprises the first action taken by the software as it is run.

Yet further, the step of comparing the version number of the software update with the software version number stored in the one time write memory means comprises comparing the software update version number with the version stored in a one time write memory element on the communication central processor unit.

As an alternative, the step of comparing the version number of the software update with the software version number stored in the one time write memory element comprises comparing the software update version number with the version stored in a one time write memory means attached to the communication central processor unit.

Preferably, the comparison between the version number of the software update and the version number stored in a one time write memory element is conducted on a per-bit basis.

If the version number of the downloaded software update is higher than the current version number found in a one time write memory means, the downloaded software continues to run in place of the then previous version of the software and the one time write memory means is updated by replacement of the current version number with the version number of the downloaded software update.

If, however, the two version numbers compared are the same, then no action need be taken in relation to the overwriting of the current software nor the updating of the one time write memory means.

If, however, the version number of the downloaded software update is less than the version number stored in the one time write memory element, the downloaded software update is rejected and cannot then serve to overwrite the current version of the software.

According to another aspect of the present invention there is provided a mobile radio communications device having a processor unit and associated non- volatile memory, means for verifying the authenticity of software updates delivered thereto, a one time write memory means arranged for the storage of a software version number therein, means for comparing the version number of a software update delivered to the processor unit with that stored in the one time write memory means, wherein the software update is run, and the software version number stored in the one time write memory means is updated, dependent upon the result of the aforesaid comparison between the version numbers.

Preferably, the processor unit is that within a mobile radio communications device and so can comprises a communications central processor unit. Further, the one time write memory means can be provided on the communications central processor unit or is arranged to be attached thereto.

In particular, the means for comparison of the software version number can be arranged to lead to the updating of the one time write memory means on a per bit basis.

As above, if the means for comparing the software version numbers identifies that the downloaded software update version number is higher than that currently stored in the one time write element, the processor is arranged to continue to run the downloaded software and also to update the one time write memory element with the new software version number. The "current" software is then effectively overwritten.

If, however, the version numbers are determined as being the same by the aforesaid means for comparison, no action need be taken. If the version number of the software update is found to be smaller than the version number currently stored in the one time write element, then the software update is not run, and neither is the one time write element updated.

The invention also provides for a computer program comprising computer program code means adopted to perform all the steps of the method defined above when said program is run.

Further, the invention provides for a computer program as defined above and as embodied on a computer readable medium.

As will be appreciated, the present invention is particularly advantageous since it removes the requirement to simultaneously hold two copies of the software in active memory.

Further, the software is only permitted to start to run if it is verified as originating from a trusted source and this can advantageously serve to ensure that the version number is included within the update and so is available for use within the method of the present invention.

A particularly important aspect of the present invention is the use of the one- time-write memory means allowing only for changes in state from 0 to 1 but not back again.

The invention is described further hereinafter, by way of example only, with reference to the accompanying drawings in which: Fig. 1 is a flow diagram illustrating operation of a method according to an embodiment of the present invention; Fig. 2 is a table illustrating entries within an example of a one time write memory means according to an embodiment of the present invention; and Fig. 3 is a schematic block diagram of a mobile radio communications device in the form of a cellular phone handset and arranged to operate in accordance with an embodiment of the present invention.

As mentioned above a particularly important aspect of the present invention is the operation of a one time write memory means employing a memory device whose state can be changed from a 0 to a 1 but not back again.

Turning to the operational diagram of Fig. I, there is illustrated a one time write memory element 10 comprising memory devices offering the storage of eight bits so that a system employing the memory element 10 can accommodate eight software versions per byte. Within the illustrated example, the memory element 10 currently has software version number 2 stored therein as indicated by the two highlighted bits within the device.

Three possible scenarios are identified by reference to three separate software versions 12, 14 and 16 that are delivered to the device arranged to operate in accordance with the present invention.

The software 12 comprises an example of version 1 software, the software 14 comprises an example of version 2 software, i.e. the version corresponding to that currently identified within the one time write element, and the software 16 comprises an example of version 3 software.

Thus, with version 2 identified in the one time write element 10 an aftempt to overwrite the software with version 1 software 12 as indicated at step 18 will fail since through the comparison of software version numbers, the software version number is identified as being less than the number stored in the memory element 10 and so the software version 1 does not continue to run as indicated at step 20 and no overwriting of current version 2 software takes place.

If however, the software 14 which comprises an example of software version 2 is delivered to an handset, it is identified, again through comparison of its version number with the version number stored in one time write memory element 10, that it corresponds to the version currently running on the handset and so the current version continues to run normally and no updating of the one time write memory element is required.

It should be appreciated that since, in accordance with the invention, it has already been verified that the software has originated from a trusted source, it can be readily determined that the software attempting to be downloaded will include an appropriate version number for use in the comparison step of the invention.

If, however, it is the software 16 that is introduced to the handset for overwriting the current version of the software, it will be appreciated that such overwriting will be permitted. As noted, software 16 comprises an example of version 3 software and so comparison with the version number within the one time write memory element 10 determines that the version number of software 16 is greater than the currently stored version number.

Thus, at step 24 from the result of such comparison, the software update can continue to run at step 26 in place of the previous version 2 software and that, importantly, the one time write memory element 10 is updated as illustrated at 28 by the addition of one bit so as to confirm that the version of the now current software is version 3.

Thus, as will be appreciated from this illustrated embodiment, any further attempted software updates such as introduction of the software updates 10, 14 and 16, and others will proceed on the basis of a comparison of the version number with the stored version 3 number, as represented by the three highlighted bits in the one time write memory element illustrated at 28.

As mentioned, an important aspect of this procedure is the operation of the one time write memory means and which is formed from memory devices exhibiting states that can be changed once, for example from 0 to 1, but not then changed back again. Ideally this is arranged to operate on a per bit basis to allow a large number of software versions to be accommodated. In the illustrated example of the invention, through the use of one bit for each new software version eight versions can be represented per byte of one time write memory. Also, since the number of commercial software builds for a cellular phone handset rarely exceeds twenty, it is considered that three bytes of such memory is likely to prove sufficient to cover all versions of the software that are to arise during the lifetime of the handset.

In order to best employ the version monitoring offered by the invention, it is proposed that all engineering/development versions of the software are given version number 0 as far as the version checking procedure is concerned. This then will leave the maximum range of version numbers available for commercial use. Commercial software versions that are produced post development should start at version 1, and all handsets that are made available for retail should be supplied pre-loaded with the most recent version of commercial software. This advantageously allows handsets to be loaded with as many different engineering software builds as are required during development but of course since version 0 software will not run on any handset that has had a commercial version of the software with a version member of 1 or higher loaded therein, no security risks arise in pursuing this provision.

As a further enhancement, the bits of the most significant end of the one time write memory may be used to further restrict, in a selective manner, the version number of software that can be loaded onto a particular handset. Such a feature can prove useful for operators that have their own software builds, or if particular software builds are likely to exhibit a lesser set of supported features than others.

Such an arrangement will require a slightly more sophisticated version numbering system than the simple bit counting suggested above and an example of such an arrangement is illustrated in the table represented by Fig. 2.

In the table the "X" entries are available for software version numbering, while the initial two bits indicate the handset capability. Since, as noted above, memory transition is only possible in one direction from 0 to 1, it is apparent that a low-end capability handset can never be reprogrammed to mid-range or high-end capability. Nor can a mid-range handset become one with high end capability. This allows the same platform to be used for multiple handsets without the risk that purchasers, for example, the end user or the handset manufacturers who purchase the platform, will be able to access features that they are not entitled to.

Turning now to Fig. 3, there is provided for the purpose of clarity a schematic representation of a mobile radio communications device 30 in the form of a cellular phone handset 32 and which is arranged for operation in accordance with the present invention.

The handset 32 comprises standard features such as antenna 34, receptionltransmission circuitry 36 and memory arrangement 40 associated with the CPU 38.

Yet further, and in accordance with an aspect of the present invention, the handset 32 also includes a one time write element 42 which serves to provide for the functionality illustrated with reference to the one time write memory elements 10, 28 illustrated in Fig. 1.

Thus, from the above it can be appreciated that the present invention provides for an advantageous method of software version update, a related device employing such method for the update of software within a process thereof and also a related computer program product providing for such functionality having advantages over known security mechanisms seeking to prevent software rollback.

The invention can achieve its advantages in a relatively, simple manner, since any new software is downloaded directly to CCPU non-volatile memory without any attempt at version checking. This removes the requirement to simultaneously hold two copies of software in active memory.

The software is first verified as being from the correct source then it is permitted to run and any appropriate verification procedure can be employed such as by way of a secure boot mechanism or otherwise As noted, an important initial action in running the verified software is to compare its version number with that stored in a one time write area of memory on, or attached to, the CCPU. As the software has been verified as being from the correct source, for example, the device manufacturer, it can be determined that any software versions that start to run on the handset will include a version number for use in such comparison.

Thus, the comparison of version numbers and other steps related to the version checking and overwriting processing need only be initiated in instances where such version checking is likely to prove possible.

Claims

Claims 1. A method of software updating in a processor unit and comprising

the steps of: loading the software update having a version number to processor non-volatile memory; verifying the source of the software update; responsive to the aforesaid verification step commencing running of the software; as an initial step in the running of the software comparing the software update version number with a current software version number stored in one time write memory means associated with the processing unit; and running the downloaded software in place of the current software and replacing the current software version number in the one time write memory element dependent upon the result of the said comparison.
2. A method as claimed in Claim 1 or 2, and including a step of downloading the software update to a non-volatile memory associated with a communications central processor unit of a mobile radio communications device.
3. A method as claimed in Claim 1 or 2, wherein the downloading of the software update to the processor unit is conducted without any prior step of version checking.
4. A method as claimed in Claim 1, 2 or 3, wherein the one time write memory means is provided as part of the processor unit.
5. A method as claimed in Claim 1, 2 or 3, wherein the one time write memory means is arranged to connect to the processor unit.
6. A method as claimed in Claim 1, 2, 3, 4 or 5, wherein the comparison between the version number of the software update and the version number stored in the one time write memory means proceeds on a per-bit basis 7 A method as claimed in any one or more of the preceding claims wherein, during the comparison, if the version number of the update is higher than the current version number found in a one time write memory means, the downloaded software continues to run in place of the current version of the software and the one time write memory means is updated to replace the current version number with the version number of the downloaded software update.

8 A method as claimed in any one or more of Claims 1 to 6, wherein during the comparison, if the two version numbers compared are the same, then no action is taken in relation to overwriting of the previous software nor updating of the one time write memory means.

9 A method as claimed in any one or more of Claims I to 6, wherein during the comparison, if the version number of the downloaded software update is less than the version number stored in the one time write memory means the downloaded software update is rejected and is not employed to overwrite the current software version and the one time write memory means is not updated 10. A mobile radio communications device having a processor unit and an associated non-volatile memory, means for verifying the authenticity of software updates delivered thereto, a one time write memory means arranged for the storage of a software version number therein, means for comparing the version number of a software update delivered to the processor unit with that stored in the one time write memory means, wherein the software update is run, and the software version number stored in the one time write memory means is updated, dependent upon the result of the aforesaid comparison between the version numbers.

11 A device as claimed in Claim 10, wherein the processor unit comprises a communications central processor unit 12. A device as claimed in Claim 10 or 11, wherein the one time write memory means is provided as part of the processor unit. is

6. A method as claimed in Claim 1, 2, 3, 4 or 5, wherein the comparison between the version number of the software update and the version number stored in the one time write memory means proceeds on a per-bit basis.

7. A method as claimed in any one or more of the preceding claims wherein, during the comparison, if the version number of the update is higher than the current version number found in a one time write memory means, the downloaded software continues to run in place of the current version of the software and the one time write memory means is updated to replace the current version number with the version number of the downloaded software update.

8. A method as claimed in any one or more of Claims I to 6, wherein during the comparison if the two version numbers compared are the same, then no action is taken in relation to the overwriting of the previous software nor the updating of the one time write memory means.

9. A method as claimed in any one or more of Claims 1 to 6, wherein during the comparison, if the version number of the downloaded software update is less than the version number stored in the one time write memory means the downloaded software update is rejected and is not employed to overwrite the current software version and the one time write memory means is not updated.

10. A mobile radio communications device having a processor unit and an associated non-volatile memory, means for verifring the authenticity of software updates delivered thereto, a one time write memory means arranged for the storage of a software version number therein, means for comparing the version number of a software update delivered to the processor unit with that stored in the one time write memory means, wherein the software update is run, and the software version number stored in the one time write memory means is updated, dependent upon the result of the aforesaid comparison between the version numbers.

11. A device as clainied in Claim 10, wherein the processor unit comprises a communications central processor unit.

12. A device as claimed in Claim 10 or 11, wherein the one time write memory means is provided as part of the processor unit.

13. A device as claimed in Claim 10, 11 or 12, wherein the one time write memory means is arranged to connect to the processor unit.

14. A device as claimed in Claim 10, 11, 12 or 13, wherein the means for comparison of the software version numbers can be arranged to lead to the updating of the one time write means on a per bit basis.

15. A computer program comprising computer program code means adapted to perform all the steps of the method defined in any one or more of Claims 1 to9whenrun.

16. A computer program as defined in Claim 15 and as embodied on a computer readable medium.

17. A method of software updating in a processor unit substantially as hereinbefore described with reference to and as illustrated in Fig. 1 of the accompanying drawings.

18. A mobile radio communications device having a processor unit substantially as hereinbefore described and with reference to Fig. 1, Fig. 2 and Fig. 3 of the accompanying drawings.

Amendments to the claims have been filed as follows Claims I A method of updating current software in a processor unit and comprising the steps of loading a software update having a version number to processor nonvolatile memory, verifying the source of the software update; responsive to the aforesaid verification step commencing running of the software update, as an initial step in the running of the software update comparing the software update version number with a current software version number stored in one time write memory means associated with the processing unit; and running the software update in place of the current software and updating the current software version number in the one time write memory element dependent upon the result of the said comparison 2 A method as claimed in Claim I or 2, and including a step of downloading the software update to a non-volatile memory associated with a communications central processor unit of a mobile radio communications device.

3 A method as claimed in Claim I or 2, wherein the downloading of the software update to the processor unit is conducted without any prior step of version checking.

4. A method as claimed in Claim 1, 2 or 3, wherein the one time write memory means is provided as part of the processor unit 5. A method as claimed in Claim 1, 2 or 3, wherein the one time write memory means is arranged to connect to the processor unit.