# US 12,118,091 B2 · Methods for securely updating software > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,091 B2 - Document ID: US12118091B2 - Status: Granted - Kind: B2 - Application number: 17/670,122 - Filed: 2022-02-11 - Published: 2023-08-17 - Granted: 2024-10-15 - Earliest claimed: 2022-02-11 - Assignees: Quanta Computer Inc. - Applicants: Quanta Computer Inc. - Inventors: Zhi-Xian Yang; Zhen-An Hung; Chia-Yu Lin; Shin-Hong Chen - Web page: https://patentgrep.com/patent/US12118091B2 ## CPC - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06F 8/65: Updates (security arrangements therefor G06F21/57) - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/14: using a plurality of keys or algorithms - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for updating software comprises transmitting a first version of the software and a first decryption key to a computing system. The method further comprises generating a second version of the software and a second decryption key. The method further comprises encrypting the second version of the software and the second decryption key. The encrypted second version of the software is configured to be decrypted using the first decryption key and not the second decryption key. The method further comprises transmitting the encrypted second version of the software and the encrypted second decryption key to the computing system. ## Claims ### Claim 1 A method of updating software, the method comprising: transmitting a first version of the software and a first decryption key to a computing system; generating a second version of the software and a second decryption key; encrypting the second version of the software and the second decryption key, the encrypted second version of the software being configured to be decrypted using the first decryption key and not the second decryption key; and transmitting the encrypted second version of the software and the encrypted second decryption key to the computing system. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating a third version of the software and a third decryption key; encrypting the third version of the software and the third decryption key, the third version of the software being configured to be decrypted using the second decryption key and not the first decryption key or the third decryption key; and transmitting the encrypted third version of the software and the encrypted third decryption key to the computing system. ### Claim 3 (depends on 2) The method of claim 2, wherein an encrypted version of the first decryption key and the encrypted second decryption key are transmitted to the computing system with the encrypted third version of the software and the encrypted third decryption key. ### Claim 4 (depends on 1) The method of claim 1, wherein the first version of the software is an initial version of the software installed on the computing system. ### Claim 5 (depends on 1) The method of claim 1, wherein the first decryption key is not encrypted when transmitted to the computing system. ### Claim 6 (depends on 1) The method of claim 1, wherein the first version of the software and the first decryption key are encrypted when transmitted to the computing system. ### Claim 7 (depends on 6) The method of claim 6, wherein the encrypted first version of the software is configured to be decrypted using a different decryption key that is prior to and not the first decryption key, the different decryption key being transmitted to the computing system prior to the transmission of the encrypted first version of the software and the encrypted first decryption key. ### Claim 8 (depends on 1) The method of claim 1, wherein generating the second version of the software and the second decryption key includes generating a software package containing the second version of the software and the second decryption key. ### Claim 9 (depends on 8) The method of claim 8, wherein encrypting the second version of the software and the second decryption key includes encrypting the software package, the encrypted software package being configured to be decrypted using the first decryption key and not the second decryption key. ### Claim 10 (depends on 9) The method of claim 9, wherein transmitting the encrypted second version of the software and the encrypted second decryption key to the computing system includes transmitting the encrypted software package. ### Claim 11 (depends on 8) The method of claim 8, wherein generating the software package containing the second version of the software and the second decryption key includes: generating source code for the second version of the software; packaging the second decryption key into the source code for the second version of the software to form modified source code; and compiling the modified source code to form a software package containing the second version of the software and the second decryption key. ### Claim 12 (depends on 1) The method of claim 1, wherein the software is firmware for an electronic device or an electronic system. ### Claim 13 (depends on 12) The method of claim 12, wherein the firmware is a basic input/output system (BIOS) of a computing system or a unified extensible firmware interface (UEFI) of the computing system. ### Claim 14 (depends on 1) The method of claim 1, wherein the second version of the software and the second decryption key are encrypted using a hash table. ### Claim 15 (depends on 1) The method of claim 1, wherein the second version of the software is configured to be installed on the computing system to replace the first version of the software. ### Claim 16 (depends on 1) The method of claim 1, wherein the software is firmware for a computing system, and wherein the second version of the software is configured to be decrypted by and installed on the computing system when the computing system is in a system management mode. ### Claim 17 (depends on 16) The method of claim 16, wherein the second version of the software is configured to trigger a system management interrupt on the computing system when the encrypted second version of the software is transmitted to the computing system. ### Claim 18 (depends on 17) The method of claim 17, wherein the system management interrupt is configured to cause the computing system to enter the system management mode and decrypt the second version of the software using the first decryption key. ### Claim 19 (depends on 1) The method of claim 1, wherein the encrypted second version of the software is hosted at a publicly available network location. ### Claim 20 A method of updating software, the method comprising: initially receiving a first version of the software and a first decryption key; installing the first version of the software on a computing system; subsequently receiving an encrypted software package that includes a second version of the software and a second decryption key; decrypting the encrypted software package with the first decryption key and not the second decryption key; and installing the second version of the software on the computing system to replace the first version of the software.