Secure in-band upgrade using key revocation lists and certificate-less asymmetric tertiary key pairs

A system for securely booting a device comprising:

• at least one memory configured to store a bootloader and one or more kernel or user applications, the bootloader digitally signed using a first cryptographic key associated with the bootloader, the one or more kernel or user applications digitally signed using one or more second cryptographic keys associated with the one or more kernel or user applications;
• and at least one processor configured to:
• securely boot the system using the bootloader;
• execute the one or more kernel or user applications;
• and use an in-band channel to update or replace the first cryptographic key via a key revocation list and certificate-less asymmetric tertiary key pairs;
• wherein:
• the bootloader comprises a first-stage bootloader and a second-stage bootloader;
• and to securely boot the device, the at least one processor is further configured to execute bootROM code to verify the first-stage bootloader and execute the first-stage bootloader to verify the second-stage bootloader;
• wherein:
• the first cryptographic key used to digitally sign the bootloader is a secondary secret key;
• authentication certificates for the first-stage and second-stage bootloaders comprise a secondary public key associated with the secondary secret key;
• the one or more second cryptographic keys used to digitally sign the one or more kernel or user applications are one or more tertiary secret keys stored on a Hardware Security Module (HSM);
• and one or more authentication certificates for the one or more kernel or user applications comprise one or more tertiary public keys associated with the one or more tertiary secret keys, wherein at least one signature is placed within the one or more authentication certificates of an image header and the partition and wherein the certificate-less asymmetric tertiary key pairs comprise the one or more tertiary secret keys and the one or more tertiary public keys;
• wherein, to securely boot the device, the at least one processor is further configured to:
• verify a primary public key in the authentication certificate for the first-stage bootloader using the primary public key or a hash of the primary public key stored in the device;
• verify a signature of the secondary public key in the authentication certificate for the first-stage bootloader using the primary public key;
• and verify a signature of the first-stage bootloader in the authentication certificate for the first-stage bootloader using the secondary public key.

A non-transitory computer readable medium for securely booting a device containing instructions that when executed cause at least one processor to:

• securely boot a device using a bootloader, the bootloader being digitally signed using a first cryptographic key associated with the bootloader;
• execute one or more kernel or user applications using the device, the one or more kernel or user applications being digitally signed using one or more second cryptographic keys associated with the one or more kernel or user applications;
• and use an in-band channel to update or replace the first cryptographic key via a key revocation list and certificate-less asymmetric tertiary key pairs;
• Wherein:
• the bootloader comprises a first-stage bootloader and a second-stage bootloader;
• and to securely boot the device, the at least one processor is further configured to execute bootROM code to verify the first-stage bootloader and execute the first-stage bootloader to verify the second-stage bootloader;
• wherein:
• the first cryptographic key used to digitally sign the bootloader is a secondary secret key;
• authentication certificates for the first-stage and second-stage bootloaders comprise a secondary public key associated with the secondary secret key;
• the one or more second cryptographic keys used to digitally sign the one or more kernel or user applications are one or more tertiary secret keys stored on a Hardware Security Module (HSM);
• and one or more authentication certificates for the one or more kernel or user applications comprise one or more tertiary public keys associated with the one or more tertiary secret keys, wherein at least one signature is placed within the one or more authentication certificates of an image header and the partition and wherein the certificate-less asymmetric tertiary key pairs comprise the one or more tertiary secret keys and the one or more tertiary public keys;
• wherein, to securely boot the device, the at least one processor is further configured to:
• verify a primary public key in the authentication certificate for the first-stage bootloader using the primary public key or a hash of the primary public key stored in the device;
• verify a signature of the secondary public key in the authentication certificate for the first-stage bootloader using the primary public key;
• and verify a signature of the first-stage bootloader in the authentication certificate for the first-stage bootloader using the secondary public key.