Abstract: An electronic device includes a boot memory, a hardware memory programmed with a signing key, and a processor configured to implement a fixed trusted module and a dynamic trusted image module. The fixed trusted module contains a digital certificate, which includes a platform key used to verify a first boot module, and a package verification key used to validate authenticity of an image update file. The dynamic trusted image module contains a platform certificate signed by the signing key. The platform certificate includes a platform verification key used to validate at least one of (i) a second boot module, (ii) an operating system loader, (iii) an operating system, or (iv) a file system. The platform certificate also includes image information associated with one or more images stored in the platform certificate, key information associated with one or more public keys, and electronic device-specific data.

Abstract: An over-the-air firmware update is accomplished in a secure manner using a two-step process. The first step uses an initial boot using a fixed boot program and an authenticated and verified secondary environment to complete starting of only authenticated code. After verifying a pending update, the second step is started with the electronic device being booted into an update mode with an update loader that has exclusive access to a signing key. A dummy update image is loaded into a temporary memory location and a hash is taken. A digital certificate is created corresponding to the update image and signed using the signing key. The update and digital certificate are atomically installed and the signing key is deactivated. Upon reboot, the new image is used for operation and is verified by the hash data and public key in the digital certificate.