Guaranteeing Dependency Enforcement in Software Updates

Catuogno, Luigi; Galdi, Clemente; Persiano, Giuseppe

doi:10.1007/978-3-319-26502-5_15

Cited by 2 publications

(1 citation statement)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, these solutions implicitly assumed the capability of detecting a fault in a compartment or the even stronger assumption of a centralized supervision of the update process. However, in the context of IoT/mobile devices, an active adversary might try to break software dependencies by installing inappropriate software [59,62], e.g., trying to break licensing rules or to actively operate to make the system unstable.…”

Section: Challenges and Solutionsmentioning

confidence: 99%

Secure Firmware Update: Challenges and Solutions

Catuogno

Galdi

2023

Cryptography

View full text Add to dashboard Cite

The pervasiveness of IoT and embedded devices allows the deployment of services that were unthinkable only few years ago. Such devices are typically small, run unattended, possibly on batteries and need to have a low cost of production. As all software systems, this type of devices need to be updated for different reasons, e.g., introducing new features, improving/correcting existing functionalities or fixing security flaws. At the same time, because of their low-complexity, standard software distribution platforms and techniques cannot be used to update the software. In this paper we review the current limitations posed to software distribution systems for embedded/IoT devices, consider challenges that the researchers in this area have been identifying and propose the corresponding solutions.

show abstract

Section: Challenges and Solutionsmentioning

confidence: 99%

Secure Firmware Update: Challenges and Solutions

Catuogno

Galdi

2023

Cryptography

View full text Add to dashboard Cite

show abstract

Secure Dependency Enforcement in Package Management Systems

Catuogno

Galdi

Persiano

2020

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Package management systems play an essential role in pursuing systems dependability by ensuring that software is correctly installed and kept up-to-date according to vendor-defined installation policies. Circumventing such policies could make the system unhealthy and insecure and can constitute a serious security threat. In many application scenarios, e.g., distribution of commercial software, the confidentiality of the software must be guaranteed against non-authorized players. In some cases, the installation policy itself is considered a sensitive information, e.g., when it reveals required hardware in military contexts. In this paper we address the problem of strongly enforcing software dependencies in package management systems, to prevent that a malicious user forces the system to install any package despite its requirements are not completely fulfilled. The enforcement is strong in the sense that the encrypted software package cannot be even decrypted if the dependencies are not satisfied. Once a new package is decrypted and installed, our protocol non-interactively updates the key material on the target device. This key update will allow the decryption of further packages that depend on the newly installed one. We further present “policy-hiding” variants of our protocol. Finally we provide an experimental evaluation of the system performance

show abstract

Guaranteeing Dependency Enforcement in Software Updates

Cited by 2 publications

References 9 publications

Secure Firmware Update: Challenges and Solutions

Secure Firmware Update: Challenges and Solutions

Secure Dependency Enforcement in Package Management Systems

Contact Info

Product

Resources

About