초록 ▼

An apparatus, system and method for secure code-downloading and information exchange, in the full generality of complex code dependencies while considering the implications of mutual distrust and hot-swapping. Included are secure techniques wherein an authority signs code from another party upon whi

An apparatus, system and method for secure code-downloading and information exchange, in the full generality of complex code dependencies while considering the implications of mutual distrust and hot-swapping. Included are secure techniques wherein an authority signs code from another party upon which that authority depends in order to establish that a trusted execution environment, is being preserved. Trusted code is employed to ensure that proprietary data is destroyed, disabled, and/or made unreadable, when a change causes the trusted execution environment to cease holding to a certain security level. A carefully constructed key structure is employed to ensure that communications allegedly from particular code in a particular environment can be authenticated as such. Authenticity of code that decides the authenticity of public-key signatures, and/or the authenticity of other code is cared for. In particular, the loading code that performs these tasks may itself be reloadable. Authenticity is maintained in physically secure coprocessors with multiple levels of dependent software that is independently downloadable by mutually suspicious authorities, and in physically secure coprocessors whose software has sufficient richness and complexity so as to be certainly permeable. Recoverability is provided for physically secure coprocessors from code of arbitrary evil running at arbitrary privilege.

대표청구항 ▼

[ What is claimed is:] [1.] A method for a node's authority to download new code into an existing node within a device, said method comprising:said authority preparing a command message including the new code, load predicates and trust parameters, where the load predicates specify whether a current

[ What is claimed is:] [1.] A method for a node's authority to download new code into an existing node within a device, said method comprising:said authority preparing a command message including the new code, load predicates and trust parameters, where the load predicates specify whether a current environment in said device is a secure environment for said code;said authority communicating said command message to the device;said device receiving said message;said device verifying that said message originated from said authority, and verifying that the current environment is valid for said load predicates; anddownloading said code if said message is verified to have originated from said authority, and said current execution environment is valid for said load predicates.