Firmware updating system and method

A firmware updating system and method are provided. The firmware updating method includes configuring a host to digitally sign a firmware to be updated, and configuring an electronic device to perform an authorization verification on an update tool, and only the update tool that passes the verification has an update permission. The update tool uses an encryption algorithm to encrypt the firmware to be updated that includes a digital signature. After the encryption is completed, the host sends the update tool to the electronic device through the update tool. The electronic device then uses a decryption algorithm to decrypt the received firmware to obtain the firmware to be updated including the digital signature, and write the firmware to be updated into a firmware storage area to be updated. The electronic device then verifies the digital signature in the firmware to be updated.

CROSS-REFERENCE TO RELATED PATENT APPLICATION

This application claims the benefit of priority to China Patent Application No. 202010551629.0, filed on Jun. 17, 2020 in People's Republic of China. The entire content of the above identified application is incorporated herein by reference.

FIELD OF THE DISCLOSURE

The present disclosure relates to a firmware updating system and method, and more particularly to a firmware updating system and method that can safely update a firmware online.

BACKGROUND OF THE DISCLOSURE

A firmware is a “driver” stored in an electronic device, and the electronic device operates by executing the firmware. In order to prolong service life of the electronic device and improve compatibility of the electronic device with different software and hardware environments, manufacturers need to continuously update the firmware. Firmware updating means that the user upgrades the embedded firmware in the electronic device through a specific tool, repairs vulnerabilities of previous versions of the firmware, and improves functions of the electronic device to enhance performance of the electronic device.

In the existing firmware updating manners, protection during the firmware updates is less than secure, and low security causes the firmware to be easily stolen and maliciously modified, which not only harms users, but also hurts profits for firmware manufacturers. Furthermore, since the firmware update is not performed in different storage areas, the firmware currently in use will be overwritten during the firmware update. Moreover, if the firmware update is terminated unexpectedly, the firmware update will fail and the electronic device will not be able to be used normally.

Therefore, improving the firmware updating mechanism to enhance the security of the firmware updating has become one of the important issues in the art.

SUMMARY OF THE DISCLOSURE

In response to the above-referenced technical inadequacies, the present disclosure provides a firmware updating system and method that can safely update a firmware online.

In one aspect, the present disclosure provides a firmware updating method suitable for a firmware updating system including a host and an electronic device, the host is configured to be communicatively connected to the electronic device and store a firmware to be updated, and the firmware updating method includes: configuring the host to execute a firmware generating tool to digitally sign the firmware to be updated, thereby generating the firmware to be updated including a digital signature; configuring the host to execute an update tool to transmit an update command to the electronic device; in response to the electronic device receiving the update command, configuring the electronic device to perform an authorization verification process on the update tool. The authorization verification process includes: configuring the electronic device and the update tool to generate and exchange a plurality of sets of random numbers; configuring the update tool to sign the plurality of sets of random numbers with an asymmetric encryption algorithm to generate a verification signature, and send the verification signature to the electronic device; and configuring the electronic device to verify the verification signature using the asymmetric encryption algorithm, and in response to the electronic device successfully verify the verification signature, configuring the electronic device to send a verification success signal to the update tool, otherwise, send a verification failure signal to the update tool. In response to the update tool receiving the verification success signal, the firmware updating method further includes configuring the update tool to encrypt the firmware to be updated including the digital signature with a symmetric encryption algorithm to generate an encrypted firmware, and send the encrypted firmware to the electronic device; configuring the electronic device to execute an original firmware, and decrypt the encrypted firmware with a decryption algorithm to obtain the firmware to be updated including the digital signature; configuring the electronic device to determine which of a first firmware storage area and a second firmware storage area is a firmware storage area to be updated; configuring the update tool to write the firmware to be updated including the digital signature into the firmware storage area to be updated; in response to a completion of writing the firmware to be updated including the digital signature into the firmware storage area to be updated, configuring the electronic device to execute the original firmware, and verify the digital signature by using a signature verification algorithm. In response to the electronic device successfully verifying the digital signature, an update is completed.

In another aspect, the present disclosure provides a firmware updating system, which includes an electronic device and a host. The electronic device includes a first processing unit and a first memory module. The first memory module includes a firmware execution area, a first firmware storage area, and a second firmware storage area. The firmware execution area stores an original firmware. At least one of the first firmware storage area and the second firmware storage area stores the original firmware. The host is configured to be communicatively connected with the electronic device, and the host includes a second processing unit and a second memory module. The second memory module stores an update tool, a firmware to be updated and a firmware generating tool. The host is configured to execute a firmware generating tool to digitally sign the firmware to be updated, thereby generating the firmware to be updated including a digital signature. The host is configured to execute an update tool to transmit an update command to the electronic device. In response to the electronic device receiving the update command, the electronic device is configured to perform an authorization verification process on the update tool, and the authorization verification process includes: configuring the electronic device and the update tool to generate and exchange a plurality of sets of random numbers; configuring the update tool to sign the plurality of sets of random numbers with an asymmetric encryption algorithm to generate a verification signature, and send the verification signature to the electronic device; and configuring the electronic device to verify the verification signature using the asymmetric encryption algorithm, and in response to the electronic device successfully verify the verification signature, configuring the electronic device to send a verification success signal to the update tool, otherwise, send a verification failure signal to the update tool. In response to the update tool receiving the verification success signal, the update tool is configured to encrypt the firmware to be updated including the digital signature with a symmetric encryption algorithm to generate an encrypted firmware, and send the encrypted firmware to the electronic device. The electronic device is configured to execute an original firmware, and decrypt the encrypted firmware with a decryption algorithm to obtain the firmware to be updated including the digital signature. The electronic device is configured to determine which of a first firmware storage area and a second firmware storage area is a firmware storage area to be updated. The host is configured to execute the update tool to write the firmware to be updated including the digital signature into the firmware storage area to be update. In response to a completion of writing the firmware to be updated including the digital signature into the firmware storage area to be updated, the electronic device is configured to execute the original firmware, and verify the digital signature by using a signature verification algorithm, and in response to the electronic device successfully verifying the digital signature, an update is completed.

Therefore, the firmware updating system and method provided by the present disclosure can prevent malicious firmware from being written into the electronic device by illegal update tools. In addition, when a user uses an authorized tool to update the firmware, since private keys encapsulated in the update tool provided by different electronic device manufacturers are different, the update tool cannot be universal, which further improves security and reliability of the update tool. Furthermore, during the updating process, since the original firmware is signed and verified, it is possible to check whether there is any data added, deleted, or tampered with in the firmware to ensure integrity and correctness of the firmware to be updated.

On the other hand, the firmware updating system and method provided by the present disclosure alternately update the first firmware storage area and the second firmware storage area. When the firmware update process is terminated due to unexpected situations such as power failure, the electronic device can still operate normally. Furthermore, when an update error occurs in one partition in the first firmware storage area and the second firmware storage area, the electronic device can automatically execute the firmware in the other partition to return to the firmware version before the update to ensure the normal operation of the electronic device.

DETAILED DESCRIPTION OF THE EXEMPLARY EMBODIMENTS

Reference is made toFIGS.1and2,FIG.1is a block diagram of a firmware updating system according to an embodiment of the present disclosure, andFIG.2is a schematic configuration diagram of a first memory module according to the embodiment of the present disclosure.

Reference is made toFIG.1andFIG.2, the first embodiment of the present disclosure provides a firmware updating system1, which includes an electronic device10and a host12.

The electronic device10includes a first processing unit100and a first memory module102. The first processing unit100can be, for example, a central processing unit (CPU) or a baseboard management controller (BMC), and the first memory module102can be, for example, an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a flash memory, and the like. The first memory module102is mainly used for storing firmware and includes a firmware execution area Boot, a first firmware storage area mem1, and a second firmware storage area mem2.

The firmware execution area Boot stores an initial program A0, and at least one of the first firmware storage area mem1and the second firmware storage area mem2stores an original firmware A, for example, a first firmware B1or a second firmware C1is the original firmware A. The firmware execution area Boot can execute the initial program A0to load the original firmware A from the first firmware storage area mem1or the second firmware storage area mem2when the electronic device10is turned on.

On the other hand, the host12is configured to be communicatively connected to the electronic device10. The host12includes a second processing unit120and a second memory module122. Similarly, the second processing unit120can be, for example, a central processing unit (CPU) or a baseboard management controller (BMC), and the second memory module122can be, for example, an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a flash memory, and the like. The second memory module122stores an update tool UT, a firmware to be updated UF, and a firmware generating tool FGT.

Reference is further made toFIG.3, which is a flowchart of a firmware updating method according to the embodiment of the present disclosure. As shown inFIG.3, the present disclosure provides a firmware updating method, which is applicable to the above-mentioned firmware updating system1including the host12and the electronic device10. In detail, the firmware updating method of the present disclosure is essentially a safe manner to update the firmware of an electronic device online, and is mainly embodied in a protection mechanism when the original firmware A of the electronic device10is updated, and in a recovery mechanism provided when the firmware update fails. As shown inFIG.3, the firmware updating method includes the following steps:

Step S100: configuring the host12to execute the firmware generating tool FGT to digitally sign the firmware to be updated UF, thereby generating the firmware to be updated UF including the digital signature. For example, the firmware to be updated UF may be a firmware with the latest version obtained from the manufacturer of the electronic device10when the host12executes the update tool UT. In this step, the host12can be configured to execute a digital signature algorithm, for example, an Elliptic Curve Digital Signature Algorithm (ECDSA), and digitally sign the firmware to be updated UF according to a first private key PK1.

In detail, in this embodiment, step S100is digitally signed based on the firmware to be updated UF, the private key for digital signing (that is, the aforementioned first private key PK1) is encapsulated in the firmware generating tool FGT, and the public key used to verify the digital signature is stored in the electronic device10.

Step S101: configuring the host12to execute the update tool UT to transmit an update command S1to the electronic device10.

Step S102: in response to receiving the update command S1, configuring the electronic device10to perform an authorization verification process on the update tool UT. In detail, after the electronic device10receives the update command S1sent by the update tool UT, the electronic device10first confirms an authority of the update tool UT of the user. The present disclosure can provide different update tools for different users, and the present disclosure is not limited thereto.

Reference can be further made toFIG.4, which is a flowchart of an authorization verification process according to the embodiment of the present disclosure. As shown inFIG.4, the authorization verification process includes:

Step S1021: configuring the electronic device10and the update tool UT to generate and exchange a plurality of sets of random numbers.

Step S1022: configuring the update tool UT to sign the plurality of sets of random numbers with an asymmetric encryption algorithm to generate a verification signature S2, and send the verification signature S2to the electronic device.

Reference can be further made toFIG.5, which is a flowchart of an authorization verification process according to a specific embodiment of the present disclosure. In a specific embodiment, step S1021to step S1022further include the following steps:

Step S300: configuring the electronic device10to generate a first set of random numbers to be sent to the host12.

Step S301: in response to receiving the first set of random numbers, configuring the host12to generate a second set of random numbers to be sent to the electronic device10.

Step S302: in response to receiving the second set of random numbers, configuring the electronic device10to generate a third set of random numbers to be sent to the host12.

Step S303: configuring the host12to use the first set of random numbers, the second set of random numbers, and the third set of random numbers as a verification message, and execute the ECDSA to digitally sign the verification message according to a second private key PK2to generate the verification signature S2. In specific embodiments, the firmware manufacturer can provide the user with an update tool UT embedded with a private key (i.e., the second private key PK2).

Step S1023: configuring the electronic device10to verify the verification signature S2with an asymmetric encryption algorithm. In step S1023, the asymmetric encryption algorithm can also be, for example, ECDSA. Therefore, step S1023can further include configuring the electronic device10to execute the ECDSA and verify the verification signature according to a second public key K2. The second public key K2is built in the electronic device10, and the second public key K2has a pairing relationship with the second private key PK2.

If the verification is successful, the authorization verification process proceeds to step S1024: sending a verification success signal S3to the update tool UT, otherwise, the authorization verification process proceeds to step S1025: sending a verification failure signal S4to the update tool UT.

In the above steps, if any step fails, it will return directly and the update tool UT is not allowed to update the firmware.

In response to receiving the verification success signal S3, the firmware updating method further proceeds to step S103: configuring the update tool UT to encrypt the firmware to be updated UF including the digital signature with a symmetric encryption algorithm to generate an encrypted firmware S5, and send the encrypted firmware S5to the electronic device10.

After the update tool UT passes the verification, the update tool UT can further use an embedded key to encrypt the original firmware including the digital signature for users to download and use. Firmware encryption can prevent data from being maliciously tampered with and embezzled to a certain extent during transmission. Therefore, step S103can further include configuring the update tool UT to encrypt the firmware to be updated UF including the digital signature according to the first secret key SK1using a symmetric encryption algorithm.

Then, the firmware updating method proceeds to step S104: configuring the electronic device10to execute the original firmware A, and decrypt the encrypted firmware S5with a decryption algorithm, to obtain the firmware to be updated UF including the digital signature. This step corresponds to step S103. Therefore, step S104can further include configuring the electronic device10to decrypt the encrypted firmware with the decryption algorithm according to the second secret key SK2to obtain the firmware to be updated UT including the digital signature. The update tool UT uses a symmetric encryption algorithm to encrypt the firmware to be updated UF including the digital signature based on the first secret key SK1. The symmetric encryption algorithm has only one non-public key, which is stored in the electronic device10and the update tool UT. In other words, the security of the firmware can be further protected by ensuring the security of the key. In a specific embodiment, the key can be kept by the firmware manufacturer to prevent security breach, but the present disclosure is not limited thereto. Therefore, in this embodiment, the first key SK1is the same as the second key SK2.

Step S105: configuring the electronic device10to determine which of the first firmware storage area mem1and the second firmware storage area mem2is the firmware storage area to be updated. In detail, the non-volatile storage space of the electronic device10can be divided into two partitions, the first firmware storage area mem1and the second firmware storage area mem2, and based on this, the memory partition that needs to be firmware updated is determined. The structure of each memory partition of the electronic device10for storing the firmware is shown inFIG.2. The first firmware storage area mem1can further store a first existence flag B2and a first number of updated times B3, and the second firmware storage area mem2can further store a second existence flag C2and a second number of updated times C3.

Therefore, reference can be made toFIG.6, which is a flowchart of steps for determining a firmware storage area to be updated according to an embodiment of the present disclosure. Step S105can further include the following steps:

Step S400: checking whether the first existence flag B2in the first firmware storage area mem1and the second existence flag C2in the second firmware storage area mem2are marked as having been updated.

In response to the first existence flag B2and the second existence flag C2being not marked as having been updated, the method proceeds to step S401: determining that the first firmware storage area mem1is the firmware storage area to be updated.

In response to one of the first existence flag B2and the second existence flag C2being marked as having been updated, the method proceeds to step S402: determining that the other one being not marked as having been updated is the firmware storage area to be updated.

In response to the first existence flag B2and the second existence flag C2being both marked as having been updated, the method proceeds to step S403: comparing the first number of firmware updated times B3in the first firmware storage area mem1and the second number of firmware updated times C3in the second firmware storage area mem2The method proceeds to step S404: determining one with lesser number of firmware updated times as the firmware storage area to be updated.

For further example, after each firmware update is completed, the existence flag and updated times of the current memory partition are updated. By checking the firmware updated times and the existence flags of the two memory partitions, memory addressing spaces written in the firmware update are determined. When the firmware existence flags of the first firmware storage area mem1and the second firmware storage area mem2are not set (for example, the value is 0), the firmware is updated to the first firmware storage area mem1, when the existence flag of one and only one of the two partitions is not set, the firmware is updated to that partition. When the existence flags of the first firmware storage area mem1and the second firmware storage area mem2are set at the same time (for example, values are both 1), the firmware updated times of the two partitions are compared. If the firmware updated times of the first firmware storage area mem1are greater than that of the second firmware storage area mem2, it means that a current firmware version update time of the first firmware storage area mem1is later than that of the second firmware storage area mem2, and the firmware in the second firmware storage area mem2needs to be updated, otherwise, the firmware of the first firmware storage area mem1is updated.

Therefore, when the update process is unexpectedly terminated or an update error occurs, the electronic device10can automatically execute the firmware in another partition and return to the firmware version before the update, to ensure the normal operation of the electronic device10.

After the firmware storage area to be updated is determined, the method proceeds to step S106: configuring the update tool UT to write the firmware to be updated UF including the digital signature into the firmware storage area to be updated.

Step S107: in response to a completion of writing the firmware to be updated UF including the digital signature into the firmware storage area to be updated, configuring the electronic device10to execute the original firmware A, and verify the digital signature by using a signature verification algorithm. In this case, for example, the signature verification algorithm can also be ECDSA. Therefore, step S107can further include configuring the electronic device10to perform ECDSA and verify the digital signature according to the first public key K1, in which the first public key K1is built in the electronic device10. In a specific embodiment, the public key can be embedded in the electronic device10when the electronic device10is shipped from the factory, and cannot be modified afterward. The first public key K1has a pairing relationship with the first private key PK1.

If the verification is successful, the method proceeds to step S108, since the update is successful, the electronic device10can be configured to return an update success message S6, while setting the existence flag of the updated partition (for example, changing the value thereof from 0 to 1), and the number of updated times is increased by 1. Further, after this firmware update is successful, the firmware to be updated can be written to another partition for alternate update according to information indicated by the existence flag. If the verification fails, the method proceeds to step S109, which represents the update failed.

If the update fails, the method proceeds to step S110: erasing the firmware to be updated UF written in the firmware storage area to be updated, and sending an error message S7to the update tool UT.

In the above embodiments of the present disclosure, all the encryption algorithms, decryption algorithms, and digital signature algorithms involved in the above steps are not limited. The encryption algorithm, decryption algorithm, and digital signature algorithm can be any algorithm that can be implemented in the existing technology. When performing decryption and signature verification on the received encrypted firmware, the decryption algorithm corresponds to the encryption algorithm, and the signature verification algorithm corresponds to the signature algorithm. Similarly, when the authorization verification process is performed on the update tool, the encryption algorithm also corresponds to the decryption algorithm.

In conclusion, the firmware updating system and method provided by the present disclosure can prevent the electronic device from being written into malicious firmware by illegal update tools. In addition, when a user uses an authorized tool to update the firmware, since private keys encapsulated in the update tool provided by different electronic device manufacturers are different, the update tool cannot be universal, which further improves security and reliability of the update tool. Furthermore, during the updating process, since the original firmware is signed and verified, it is possible to check whether there is any data added, deleted, or tampered with in the firmware to ensure integrity and correctness of the firmware to be updated.

On the other hand, the firmware updating system and method provided by the present disclosure alternately update the first firmware storage area and the second firmware storage area. When the firmware update process is terminated due to unexpected situations such as power failure, the electronic device can still operate normally. Furthermore, when an update error occurs in one partition in the first firmware storage area and the second firmware storage area, the electronic device can automatically execute the firmware in the other partition to return to the firmware version before the update to ensure the normal operation of the electronic device.