UL 5500-2018 UL Standard for Safety Remote Software Updates (First Edition).pdf

1、UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL UL 5500 Remote Software Updates STANDARD FOR SAFETYUL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM ULUL COPYRIGHTED MATERIAL NOT AUTHORIZ

2、ED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL UL Standard for Safety for Remote Software Updates, UL 5500 First Edition, Dated September 6, 2018 Summary of Topics This First Edition of the Standard for Safety for Remote Software Updates, ANSI/UL 5500, covers the remote updat

3、ing of software via the manufacturers recommended process. It is limited to software elements having an inuence on safety and on compliance with the particular end product safety standard. The new requirements are substantially in accordance with Proposal(s) on this subject dated November 10, 2017,

4、May 25, 2018, and July 27, 2018. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form by any means, electronic, mechanical photocopying, recording, or otherwise without prior permission of UL. UL provides this Standard as is wit

5、hout warranty of any kind, either expressed or implied, including but not limited to, the implied warranties of merchantability or tness for any purpose. In no event will UL be liable for any special, incidental, consequential, indirect or similar damages, including loss of prots, lost savings, loss

6、 of data, or any other damages arising out of the use of or the inability to use this Standard, even if UL or an authorized UL representative has been advised of the possibility of such damage. In no event shall ULs liability for any damage ever exceed the price paid for this Standard, regardless of

7、 the form of the claim. Users of the electronic versions of ULs Standards for Safety agree to defend, indemnify, and hold UL harmless from and against any loss, expense, liability, damage, claim, or judgment (including reasonable attorneys fees) resulting from any error or deviation introduced while

8、 purchaser is storing an electronic Standard on the purchasers computer system. SEPTEMBER 6, 2018 UL 5500 tr1UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL SEPTEMBER 6, 2018 UL 5500 tr2 No Text on This PageUL COPYRIGHTED MATERIAL NOT AUTHOR

9、IZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL SEPTEMBER 6, 2018 1 UL 5500 Standard for Safety for Remote Software Updates First Edition September 6, 2018 This ANSI/UL Standard for Safety consists of the First Edition. The most recent designation of ANSI/UL 5500 as an Ameri

10、can National Standard (ANSI) occurred on September 6, 2018. ANSI approval for a standard does not include the Cover Page, Transmittal Pages, and Title Page. Comments or proposals for revisions on any part of the Standard may be submitted to UL at any time. Proposals should be submitted via a Proposa

11、l Request in ULs On-Line Collaborative Standards Development System (CSDS) at https:/. ULs Standards for Safety are copyrighted by UL. Neither a printed nor electronic copy of a Standard should be altered in any way. All of ULs Standards and all copyrights, ownerships, and rights regarding those Sta

12、ndards shall remain the sole and exclusive property of UL. COPYRIGHT 2018 UNDERWRITERS LABORATORIES INC. ANSI/UL 5500-2018UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL SEPTEMBER 6, 2018 REMOTE SOFTWARE UPDATES - UL 5500 2 No Text on This P

13、ageUL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL CONTENTS 1 Scope .4 2 Normative references4 3 Terms and denitions5 4 Remote Software Update Process 6 4.1 General .6 4.2 Establish remote connection .8 4.3 Authentication 8 4.4 Authorization

14、 .9 4.5 Hardware / Architecture / Software Download Package Compatibility Check .9 4.6 Download/Transmission .9 4.7 Verication of Received Software Download Package10 4.8 Application of Received Software Download Package10 4.9 Conclusion of Remote Software Update Process 11 5 Remote Software Update

15、Validation11 5.1 General .11 5.2 Failure/Status Identication Detection 12 5.3 Response to Error Detection .12 5.4 Software Download Package Version 13 6 Documentation Safety related availability or connectivity of REMOTE communications; Field updates done with physical access by qualied personnel; S

16、oftware development lifecycle and maturity; Cryptographic techniques for the purposes of user data condentiality and consumer privacy; Insider threat (corporate espionage); and REMOTE control operation of the product. NOTE 2 This standard is intended to be used in conjunction with the appropriate en

17、d product safety standard. 2 Normative references For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies: FIPS 140-2, (Annexes A, B and C) Security Requirements for Cryptographic Modules IEEE 802.

18、3, Standard for Ethernet IEEE 802.11, Information Technology Telecommunications and Information Exchange Between Systems Local and Metropolitan Area Networks Specic Requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specications IEEE 802.15.4, Standard for Low-Ra

19、te Wireless Networks ISO/IEC 9796, Information Technology Security Technologies Digital Signature Scheme Giving Message Recovery ISO/IEC 9797-1, Information Technology Security Technologies Message Authentication Codes (MACs) ISO/IEC 9798 (all parts), Information Technology Security Technologies Ent

20、ity Authentication ISO/IEC 10118-1, Information Technology Security Technologies Hash-Functions Part 1: General SEPTEMBER 6, 2018 REMOTE SOFTWARE UPDATES - UL 5500 4UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL ISO/IEC 14888-1, Information

21、 Technology Security Technologies Digital Signatures with Appendix Part 1: General ISO/IEC 15946-1, Information Technology Security Technologies Cryptographic Techniques Based on Elliptic Curves Part 1: General ISO/IEC 18033-1, Information Technology Security Technologies Encryption Algorithms Part

22、1: General ISO/IEC 29192-1, Information Technology Security Techniques Lightweight Cryptography Part 1: General ISO/IEC 19772, Information Technology Security Techniques Authenticated Encryption NIST SP 800-56A, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptogr

23、aphy NIST SP 800-57, Recommendation for Key Management, Part 1: General 3 Terms and denitions For the purposes of this standard, the following denitions apply. 3.1 AUTHENTICATION the process of verifying the identity of an ENTITY. 3.2 AUTHORIZATION the process of permitting an authenticated ENTITY t

24、o access or manipulate the product or the product property to the extent the ENTITY has such permission. Note to entry: In this context, manipulation means the downloading, installation and verication of software. 3.3 ENTITY a person, device, product or service which interacts with another via a net

25、work. 3.4 INCIDENT an occurrence that actually or potentially results in adverse safety consequences in the end device application. Note to entry: INCIDENT is modied from: https:/niccs.us-cert.gov/glossary#I 3.5 REMOTE a term dened by the end product standard. Note to entry: In the end product appli

26、cation, the term potentially addresses, but is not limited to the following conditions: supervision; SEPTEMBER 6, 2018 REMOTE SOFTWARE UPDATES - UL 5500 5UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL intervention; whether the presence of t

27、he hazard is detectable; distance from the device; and physical access to the device or devices. 3.6 SECURITY the state of having acceptable risk, as determined by the end product standard, that particular SECURITY threats do not exploit a particular SECURITY vulnerability leading to safety hazard(s

28、). Note to entry: This term is also known as cybersecurity. 3.7 SOFTWARE DOWNLOAD PACKAGE element that could include software, rmware or safety parametric data. 4 Remote Software Update Process 4.1 General 4.1.1 The REMOTE software update process shall not result in a risk of re, electrical shock, i

29、njury to persons, loss of one or more safety functions, or other hazard as specied in the relevant end product standard. The remote software update process, including any AUTHENTICATION and encryption processes, shall include means to prioritize hardware and software interrupts of the operational rm

30、ware. Compliance is checked by applying the requirements of 4.1.2 and 4.2 to 4.9 SEPTEMBER 6, 2018 REMOTE SOFTWARE UPDATES - UL 5500 6UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL 4.1.2 The software update process shall implement a suitabl

31、e means for connection between a host and one or more target end devices for the SOFTWARE DOWNLOAD PACKAGE. Validation of the REMOTE software update process in accordance with the requirements of this standard and the relevant end product standard shall include the following process steps. The steps

32、 may be discrete or combined and may be reordered by the end product requirements: Establish REMOTE Connection (see 4.2) AUTHENTICATION (see 4.3) AUTHORIZATION (see 4.4) Hardware/Architecture/SOFTWARE DOWNLOAD PACKAGE Compatibility Check (see 4.5) Download/(Re-)Transmission (see 4.6) Verication of R

33、eceived SOFTWARE DOWNLOAD PACKAGE (see 4.7) Application of Received SOFTWARE DOWNLOAD PACKAGE (see 4.8) Software Update Process Concluded (see 4.9) Compliance is checked by inspection. This is generated text for gtxt. Figure 4.1 Example of REMOTE Communication Path for Software Update Process SEPTEM

34、BER 6, 2018 REMOTE SOFTWARE UPDATES - UL 5500 7UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL 4.2 Establish remote connection 4.2.1 The manufacturer shall identify a communication protocol for establishing a REMOTE connection between the ho

35、st and end device. Compliance is checked by inspection. Suitable technologies that may be used include, but are not limited to: IEEE 802.3; IEEE 802.11; IEEE 802.15.4; Other open source and proprietary methodologies. NOTE: Link and transport layer cryptographic techniques for these protocols may be

36、used to fulll the requirement of 4.6. 4.2.2 The REMOTE software download process shall include means to identify the host and end device entities. Unless otherwise specied in the end product standard or by regulation, the manufacturer shall specify the means for unique identication of the end produc

37、t. Compliance is checked by inspection. 4.3 Authentication The AUTHENTICATION process shall Establish the respective identities of the host and end device(s); and Include suitable means for verifying the host and end device entities are, by design, those intended to be engaged in REMOTE software upd

38、ate. AUTHENTICATION attributes shall be encrypted. NOTE: Suitable means may include digital certicates, device IDs, serial numbers, white listing and known-answer tests. Compliance is checked by inspection. SEPTEMBER 6, 2018 REMOTE SOFTWARE UPDATES - UL 5500 8UL COPYRIGHTED MATERIAL NOT AUTHORIZED F

39、OR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL 4.4 Authorization The AUTHORIZATION process shall: Include suitable means for verifying that the host ENTITY has the manufacturer specied REMOTE software update rights; or Include suitable means for verifying that the end device may

40、engage the host ENTITY in the receipt and installation of a REMOTE SOFTWARE DOWNLOAD PACKAGE. Compliance is checked by inspection. 4.5 Hardware / Architecture / Software Download Package Compatibility Check Means for a hardware / architecture / SOFTWARE DOWNLOAD PACKAGE compatibility check shall be

41、provided. Such means shall be one of the following: An end device means that demonstrates its hardware and software architecture is compatible with the SOFTWARE DOWNLOAD PACKAGE; The SOFTWARE DOWNLOAD PACKAGE is on a pre-selection list of manufacturer-specied SOFTWARE DOWNLOAD PACKAGES previously fo

42、und compatible. NOTE: Software previously found to meet the necessary criteria is also known as a “whitelisted application.” Compliance is checked by inspection. 4.6 Download/Transmission Data transmission shall be encrypted. Suitable means for encryption shall be industry standard cryptographic tec

43、hniques as described in one or more of the following: ISO/IEC 9796; ISO/IEC 9797-1; ISO/IEC 9798-1; ISO/IEC 10118-1; ISO/IEC 14888-1; ISO/IEC 15946-1; ISO/IEC 18033-1; ISO/IEC 29192-1; ISO/IEC 19772; NIST SP 800-56A; NIST SP 800-57; or SEPTEMBER 6, 2018 REMOTE SOFTWARE UPDATES - UL 5500 9UL COPYRIGH

44、TED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL FIPS 140-2, (Annexes A, B and C) Other suitable cryptographic techniques shown to be equivalent to the industry standard cryptographic techniques fulll these requirements. Compliance is checked by inspect

45、ion. 4.7 Verication of Received Software Download Package The detailed requirements for verication of the received SOFTWARE DOWNLOAD PACKAGE to end devices are device-specic and are as described in the end product standard. Verication of the received SOFTWARE DOWNLOAD PACKAGE process shall include a

46、 check for authenticity of the SOFTWARE DOWNLOAD PACKAGE with respect to the version management process (Clause 6), SOFTWARE DOWNLOAD PACKAGE data integrity and hardware / architecture / SOFTWARE DOWNLOAD PACKAGE compatibility. However, a check for compatibility is not required where incompatibility

47、 affecting safety is precluded by the end product design. Compliance is checked by inspection. 4.8 Application of Received Software Download Package The detailed requirements for the application to end devices of the received SOFTWARE DOWNLOAD PACKAGE are device-specic and are as described in the en

48、d product standard. Application of the received SOFTWARE DOWNLOAD PACKAGE process shall: Include a means to verify suitable conditions are present to apply the received SOFTWARE DOWNLOAD PACKAGE to the end device; or If the end device is operable during application of the received SOFTWARE DOWNLOAD PACKAGE, the device shall continue to comply with the requirements of the end product standard during this application. Compliance is checked by inspection. SEPTEMBER 6, 2018 REMOTE SOFTWARE UPDATES - UL 5500 10