# US 2021/0209231 A1 · Passive monitoring and prevention of unauthorized firmware or software upgrades between computing devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0209231 A1
- Document ID: US20210209231A1
- Status: Published application
- Kind: A1
- Application number: 17/029,175
- Filed: 2020-09-23
- Published: 2021-07-08
- Earliest claimed: 2019-09-25
- Assignees: Shift5, Inc.
- Applicants: Shift5, Inc.
- Inventors: Michael A. Weigand; Joshua A. Lospinoso; James E. Correnti
- Web page: https://patentgrep.com/patent/US20210209231A1

## CPC

- G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]}
- G06F 8/65: Updates (security arrangements therefor G06F21/57)
- G06F 8/654: using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
- G06F 21/554: {involving event detection and direct action}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An apparatus for preventing unauthorized software or firmware upgrades between two or more computing devices connected on a data bus includes a cryptographic engine, memory, and at least one processor coupled with the cryptographic engine and memory. The cryptographic engine stores cryptographic metadata for authorized upgrade images for updating at least one target computing device coupled to the data bus. The cryptographic metadata includes a manifest list of upgrade images. The processor is configured to monitor the data bus for transmissions of striped update hashes from a maintenance device, to receive signed striped hashes corresponding to an upgrade image file transmitted by the maintenance device, to validate the striped update hashes using information in the manifest list, to log that an unauthorized upload has been attempted when at least one of the striped update hashes fails validation, and to perform a mitigation action(s) in response to the attempted unauthorized upload.

## Claims

### Claim 1

A method for preventing unauthorized software or firmware upgrades between two or more computing devices connected on a data bus, the method comprising:
transmitting, by a maintenance device coupled to the data bus, cryptographic metadata for authorized upgrade images to at least one target computing device coupled to the data bus, the cryptographic metadata comprising a manifest list of upgrade images;
monitoring, by a security appliance coupled to the data bus, transmissions from the maintenance device of striped update hashes on the data bus;
providing, to the security appliance, signed striped hashes corresponding to an upgrade image file transmitted by the maintenance device;
validating the striped update hashes using information in the manifest list;
when at least one of the striped update hashes fails validation, logging by the security appliance that an unauthorized upload has been attempted; and
performing at least one mitigation action in response to the attempted unauthorized upload.

### Claim 2 (depends on 1)

The method of claim 1, wherein when at least one of the signed striped hashes fails validation, the method further comprises:
when the security appliance is configured in a passive mode, queuing a fault code for the maintenance device which is indicative of an unauthorized upload; and
when the security appliance is configured in an active mode, intervening on the data bus to prevent further transmission from the maintenance device to the target computing device.

### Claim 3 (depends on 2)

The method of claim 2, wherein intervening on the data bus comprises the security appliance transmitting interfering signals on the data bus, the interfering signals being configured to disrupt transmissions from the maintenance device to the target computing device.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
determining whether there are any further signed striped hashes to process;
when a last signed striped hash has been received, stopping the method; and
when the last signed striped hash has not yet been received, continuing to monitor the data bus for update image transmissions.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
performing a data integrity check as part of a data validation process to confirm that an update image transmission received from the maintenance device has not been corrupted; and
when the data integrity check fails, rejecting, by the target computing device, the update image transmission and stopping the method.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
when at least one of the striped update hashes fails validation, determining whether reprogramming of the target computing device is required;
when it is determined that reprogramming of the target computing device is required, transmitting, by the security appliance, one or more last known valid update images to the target computing device; and
when it is determined that reprogramming of the target computing device is not required, stopping the method.

### Claim 7 (depends on 1)

The method of claim 1, wherein validating the signed striped hashes comprises comparing the striped update hashes transmitted by the maintenance device with signed striped hashes provided to the security appliance and, when the striped update hashes match the signed striped hashes, the security appliance indicating that the striped update hashes are valid.

### Claim 8 (depends on 1)

The method of claim 1, wherein the manifest list comprises at least one of image version number, target computing device information, image size, image cryptographic chunk size, cryptographic support information, a list of chunked hashes and/or signature of chunked hashes, type of hash function used to generate the striped update hashes, public key, Certificate Authority (CA), intermediate CA key chains and sets, file certificate and hash, and metadata.

### Claim 9 (depends on 1)

The method of claim 1, further comprising the security appliance, operating in a passive mode, receiving and recording the cryptographic metadata and image files into memory.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
the security appliance checking the cryptographic metadata with known keys to verify signatures in the metadata; and
the security appliance recording verified and unverified image data in memory, wherein valid signatures are added to a trusted update list and invalid signatures are logged as a security fault.

### Claim 11

An apparatus for preventing unauthorized software or firmware upgrades between two or more computing devices connected on a data bus, the apparatus comprising:
at least one processor;
memory coupled with the at least one processor; and
a cryptographic engine coupled with the at least one processor, the cryptographic engine storing cryptographic metadata for authorized upgrade images for updating at least one target computing device coupled to the data bus, the cryptographic metadata comprising a manifest list of upgrade images;
wherein the at least one processor is configured:
to monitor the data bus for transmissions of striped update hashes from a maintenance device coupled to the data bus;
to obtain signed striped hashes corresponding to an upgrade image file transmitted by the maintenance device;
to validate the striped update hashes using information in the manifest list;
to log that an unauthorized upload has been attempted when at least one of the striped update hashes fails validation; and
to perform at least one mitigation action in response to the attempted unauthorized upload.

### Claim 12 (depends on 11)

The apparatus of claim 11, wherein when at least one of the signed striped hashes fails validation and the apparatus is configured in a passive mode, the at least one processor is further configured to queue a fault code for the maintenance device which is indicative of an unauthorized upload, and when at least one of the signed striped hashes fails validation and the apparatus is configured in an active mode, the at least one processor is further configured to intervene on the data bus to prevent further transmission from the maintenance device to the at least one target computing device.

### Claim 13 (depends on 12)

The apparatus of claim 12, wherein in intervening on the data bus, the at least one processor is configured to cause the apparatus to transmit interfering signals on the data bus, the interfering signals being configured to disrupt transmissions from the maintenance device to the target computing device.

### Claim 14 (depends on 11)

The apparatus of claim 11, wherein the at least one processor is further configured:
to determine whether there are any further signed striped hashes to process;
to stop monitoring the data bus when a last signed striped hash has been received; and
to continue monitoring the data bus when the last signed striped hash has not been received.

### Claim 15 (depends on 11)

The apparatus of claim 11, wherein the at least one processor is further configured:
to perform a data integrity check as part of a data validation process for confirming that an update image transmission received from the maintenance device has not been corrupted; and
when the data integrity check fails, thereby causing the target computing device to reject the update image transmission, to stop monitoring the data bus.

### Claim 16 (depends on 11)

The apparatus of claim 11, wherein the at least one processor is further configured:
to determine whether reprogramming of the target computing device is required when at least one of the striped update hashes fails validation;
to cause the apparatus to transmit one or more last known valid update images to the target computing device when it is determined that reprogramming of the target computing device is required; and
to stop monitoring the data bus when it is determined that reprogramming of the target computing device is not required.

### Claim 17 (depends on 11)

The apparatus of claim 11, wherein in validating the signed striped hashes, the at least one processor is configured to compare the striped update hashes transmitted by the maintenance device with signed striped hashes provided to the apparatus and, when the striped update hashes match the signed striped hashes, to indicate that the striped update hashes are valid.

### Claim 18 (depends on 11)

The apparatus of claim 11, wherein the manifest list comprises at least one of image version number, target computing device information, image size, image cryptographic chunk size, cryptographic support information, a list of chunked hashes and/or signature of chunked hashes, type of hash function used to generate the striped update hashes, public key, Certificate Authority (CA), intermediate CA key chains and sets, file certificate and hash, and metadata.

### Claim 19 (depends on 11)

The apparatus of claim 11, wherein when the apparatus is operating in a passive mode, the at least one processor is configured to receive and record the cryptographic metadata and image files into the memory.

### Claim 20 (depends on 19)

The apparatus of claim 19, wherein the at least one processor is further configured:
to check the cryptographic metadata with known keys to verify signatures in the metadata; and
to record verified and unverified image data in the memory, wherein valid signatures are added to a trusted update list and invalid signatures are logged as a security fault.

### Claim 21

A computer program product for preventing unauthorized software or firmware upgrades between two or more computing devices connected on a data bus, the computer program product comprising a non-transient computer readable storage medium having computer readable program code embodied thereon, the computer readable program code, when executed on at least one processor of a security appliance coupled to the data bus, causing the security appliance:
to store cryptographic metadata for authorized upgrade images for updating at least one target computing device coupled to the data bus, the cryptographic metadata comprising a manifest list of upgrade images;
to monitor the data bus for transmissions of striped update hashes from the maintenance device;
to obtain signed striped hashes corresponding to an upgrade image file transmitted by the maintenance device;
to validate the striped update hashes using information in the manifest list;
to log that an unauthorized upload has been attempted when at least one of the striped update hashes fails validation; and
to perform at least one mitigation action in response to the attempted unauthorized upload.