# US 12,223,051 B2 · Secure in-service firmware update > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,051 B2 - Document ID: US12223051B2 - Status: Granted - Kind: B2 - Application number: 18/349,147 - Filed: 2023-07-09 - Published: 2023-11-02 - Granted: 2025-02-11 - Earliest claimed: 2021-02-01 - Assignees: Mellanox Technologies, Ltd. - Applicants: Mellanox Technologies, Ltd. - Inventors: Mor Hoyda Sfadia; Yuval Itkin; Ahmad Atamli; Ariel Shahar; Yaniv Strassberg; Itsik Levi - Web page: https://patentgrep.com/patent/US12223051B2 ## CPC - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06F 8/65: Updates (security arrangements therefor G06F21/57) - G06F 9/445: Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57) - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer system includes a volatile memory and at least one processor. The volatile memory includes a protected storage segment (PSS) configured to store firmware-authentication program code for authenticating firmware of the computer system. The at least one processor is configured to receive a trigger to switch to a given version of the firmware, to obtain, in response to the trigger, a privilege to access the PSS, to authenticate the given version of the firmware by executing the firmware-authentication program code from the PSS, to switch to the given version of the firmware upon successfully authenticating the given version, and to take an alternative action upon failing to authenticate the given version. ## Claims ### Claim 1 A computer system, comprising: a volatile memory, comprising a protected storage segment (PSS), the PSS configured to store firmware-authentication program code for authenticating firmware of the computer system; a privilege logic circuit configured to control access rights between elements of the computer system; and at least one processor, configured to: perform system boot; store the firmware-authentication program code in the PSS during the system boot; configure the privilege logic circuit to lock all accesses to the PSS; after completion of the system boot, operate “in service” with post boot privileges; receive a trigger to switch to a given version of the firmware, while operating “in service”; in response to the trigger, obtain a privilege to access the PSS, and authenticate the given version of the firmware by executing the firmware-authentication program code from the PSS; and switch to the given version of the firmware upon successfully authenticating the given version, and take an alternative action upon failing to authenticate the given version. ### Claim 2 (depends on 1) The computer system according to claim 1, further comprising a read-only-memory (ROM), which is configured to store one or both of (i) part of the firmware-authentication program code and (ii) data used by the firmware-authentication program code, wherein, in response to the trigger, the at least one processor is configured to obtain a privilege to access both the PSS and the ROM. ### Claim 3 (depends on 1) The computer system according to claim 1, wherein the at least one processor is configured to obtain the privilege, authenticate the given version and switch to the given version, without a reset. ### Claim 4 (depends on 1) The computer system according to claim 1, wherein, in response to a reset, the at least one processor is configured to boot an initial version of the firmware, to authenticate the initial version of the firmware, and to load the firmware-authentication program code to the PSS. ### Claim 5 (depends on 1) The computer system according to claim 1, further comprising a privilege control circuit that is configured to grant the privilege to access the PSS to the at least one processor, in response to detecting that the at least one processor accesses a defined address. ### Claim 6 (depends on 1) The computer system according to claim 1, further comprising input interfaces, wherein the at least one processor is configured to ignore inputs from the input interfaces while having the privilege to access the PSS. ### Claim 7 (depends on 1) The computer system according to claim 1, wherein the volatile memory and the at least one processor are comprised in a network device. ### Claim 8 (depends on 7) The computer system according to claim 7, wherein the network device comprises one of a network adapter, a network switch, a network router and a network-enabled Graphics Processing Unit (GPU). ### Claim 9 (depends on 1) The computer system according to claim 1, wherein the at least one processor authenticates the given version of the firmware by applying the firmware-authentication program code to the given version of the firmware and to an attestation key. ### Claim 10 (depends on 1) The computer system according to claim 1, wherein the at least one processor receives the trigger to switch to a given version of the firmware and authenticates the given version of the firmware by executing the firmware-authentication program code from the PSS, after the at least one processor moved to a service access privilege configuration in which a privilege logic is set to allow IO and most memory accesses. ### Claim 11 (depends on 1) The computer system according to claim 1, wherein when the at least one processor obtains the privilege to access the PSS, the privilege logic circuit allows access to the PSS only for execution. ### Claim 12 (depends on 1) The computer system according to claim 1, wherein the at least one processor comprises a plurality of processors and wherein when a first one of the processors authenticates the given version of the firmware, the other processors do not stop operation. ### Claim 13 A method, comprising: storing firmware-authentication program code, for authenticating firmware of a computer system, in a protected storage segment (PSS) of a volatile memory, during a system boot; configuring a privilege logic circuit to lock all accesses to the PSS; after completion of the system boot, operating the computer system “in service” with post boot privileges; receiving a trigger to switch to a given version of the firmware, while operating “in service”; in response to the trigger, obtaining a privilege to access the PSS, and authenticating the given version of the firmware by executing the firmware-authentication program code from the PSS; and switching to the given version of the firmware upon successfully authenticating the given version, and taking an alternative action upon failing to authenticate the given version. ### Claim 14 (depends on 13) The method according to claim 13, further comprising storing in a read-only-memory (ROM) one or both of (i) part of the firmware-authentication program code and (ii) data used by the firmware-authentication program code, wherein obtaining the privilege comprises, in response to the trigger, obtaining a privilege to access both the PSS and the ROM. ### Claim 15 (depends on 13) The method according to claim 13, wherein obtaining the privilege, authenticating the given version and switching to the given version are performed without a reset. ### Claim 16 (depends on 13) The method according to claim 13, and comprising, in response to a reset, booting an initial version of the firmware, authenticating the initial version of the firmware, and loading the firmware-authentication program code to the PSS. ### Claim 17 (depends on 13) The method according to claim 13, further comprising granting the privilege to access the PSS to at least one processor of the computer system, in response to detecting that the at least one processor accesses a defined address. ### Claim 18 (depends on 13) The method according to claim 13, further comprising ignoring inputs from input interfaces of the computer system while having the privilege to access the PSS. ### Claim 19 (depends on 13) The method according to claim 13, wherein storing the firmware-authentication program code, receiving the trigger, obtaining the privilege, authenticating the given version and switching to the given version are performed in a network device. ### Claim 20 (depends on 19) The method according to claim 19, wherein the network device comprises one of a network adapter, a network switch, a network router and a network-enabled Graphics Processing Unit (GPU). ### Claim 21 A method for securely switching firmware versions in a computer system, the method comprising: storing, in a protected storage portion of a volatile memory, software program code which authenticates firmware of the computer system, during a system boot; configuring a privilege logic circuit to lock all accesses to the PSS; after completion of the system boot, operating the computer system “in service” with post boot privileges; receiving a trigger to switch to a given version of the firmware, while operating “in service”; and in response to the trigger: (i) obtaining a privilege to access the protected storage portion; (ii) authenticating the given version of the firmware by executing the software program code stored in the protected storage portion; (iii) if the given version is authenticated successfully, switching to the given version of the firmware; and (iv) if the given version is not authenticated successfully, taking an alternative action. ### Claim 22 (depends on 21) The method according to claim 21, wherein the computer system includes, is, or is embedded in, a network device. ### Claim 23 (depends on 22) The method according to claim 22, wherein the network device comprises one of a network adapter, a network switch, a network router and a network-enabled Graphics Processing Unit (GPU). ### Claim 24 (depends on 21) The method according to claim 21, wherein securely switching the firmware versions is performed without a reset.