Loading [MathJax]/extensions/MathZoom.js
Secure Firmware Updates for Constrained IoT Devices Using Open Standards: A Reality Check | IEEE Journals & Magazine | IEEE Xplore

Secure Firmware Updates for Constrained IoT Devices Using Open Standards: A Reality Check


Secure IoT firmware update over the network, shown in progress on a prototype based on a microcontroller with 32kB of RAM running RIOT, and complying with the SUIT specif...

Abstract:

While the IoT deployments multiply in a wide variety of verticals, the most IoT devices lack a built-in secure firmware update mechanism. Without such a mechanism, howeve...Show More

Abstract:

While the IoT deployments multiply in a wide variety of verticals, the most IoT devices lack a built-in secure firmware update mechanism. Without such a mechanism, however, critical security vulnerabilities cannot be fixed, and the IoT devices can become a permanent liability, as demonstrated by recent large-scale attacks. In this paper, we survey open standards and open source libraries that provide useful building blocks for secure firmware updates for the constrained IoT devices–by which we mean low-power, microcontroller-based devices such as networked sensors/actuators with a small amount of memory, among other constraints. We design and implement a prototype that leverages these building blocks and assess the security properties of this prototype. We present experimental results including first experiments with SUIT, a new IETF standard for secure IoT firmware updates. We evaluate the performance of our implementation on a variety of commercial off-the-shelf constrained IoT devices. We conclude that it is possible to create a secure, standards-compliant firmware update solution that uses the state-of-the-art security for the IoT devices with less than 32 kB of RAM and 128 kB of flash memory.
Secure IoT firmware update over the network, shown in progress on a prototype based on a microcontroller with 32kB of RAM running RIOT, and complying with the SUIT specif...
Published in: IEEE Access ( Volume: 7)
Page(s): 71907 - 71920
Date of Publication: 29 May 2019
Electronic ISSN: 2169-3536

Funding Agency:


References

References is not available for this document.