Passive monitoring and prevention of unauthorized firmware or software upgrades between computing devices

An apparatus for preventing unauthorized software or firmware upgrades between two or more computing devices connected on a data bus, the apparatus comprising:

• at least one processor;
• memory coupled with the at least one processor;
• and
• a cryptographic engine coupled with the at least one processor, the cryptographic engine storing cryptographic metadata for authorized upgrade images for updating at least one target computing device coupled to the data bus, the cryptographic metadata comprising a manifest list of upgrade images;
• wherein the at least one processor is configured:
• to monitor the data bus for transmissions of striped update hashes from a maintenance device coupled to the data bus;
• to obtain signed striped hashes corresponding to an upgrade image file transmitted by the maintenance device;
• to validate the striped update hashes using information in the manifest list;
• to log that an unauthorized upload has been attempted when at least one of the striped update hashes fails validation before the unauthorized upload completes;
• and
• to perform at least one mitigation action, before the unauthorized upload completes, in response to the attempted unauthorized upload,
• wherein the upgrade image file comprises at least first and second subsets of signed striped hashes, the first subset of signed striped hashes being different in size relative to the second subset of signed striped hashes.

A computer program product for preventing unauthorized software or firmware upgrades between two or more computing devices connected on a data bus, the computer program product comprising a non-transient computer readable storage medium having computer readable program code embodied thereon, the computer readable program code, when executed on at least one processor of a security appliance coupled to the data bus, causing the security appliance:

• to store cryptographic metadata for authorized upgrade images for updating at least one target computing device coupled to the data bus, the cryptographic metadata comprising a manifest list of upgrade images;
• to monitor the data bus for transmissions of striped update hashes from the maintenance device;
• to obtain signed striped hashes corresponding to an upgrade image file transmitted by the maintenance device;
• to validate the striped update hashes using information in the manifest list;
• to log that an unauthorized upload has been attempted when at least one of the striped update hashes fails validation before the unauthorized upload completes;
• and
• to perform at least one mitigation action, before the unauthorized upload completes, in response to the attempted unauthorized upload,
• wherein a final subset of the signed striped hashes corresponding to the upgrade image file is different in size relative to other signed striped hashes to facilitate malicious code detection.