A Hardware-based Framework for Secure Firmware Updates on Embedded Systems

Abstract

Firmware refers to device read-only resident code which includes microcode and macro-instruction-level routines. For Internet-of-Things (IoT) devices without an operating system, firmware includes all the necessary instructions on how such embedded systems operate and communicate. Thus, firmware updates are an essential part of device functionality. They provide the ability to patch vulnerabilities, address operational issues, and improve device reliability and performance during the lifetime of the system. This process, however, is often exploited by attackers in order to inject malicious firmware code into the embedded device. In this paper, we present a framework for secure firmware updates on embedded systems. The approach is based on hardware primitives and cryptographic modules, and it can be deployed in environments where communication channels might be insecure. The implementation of the framework is flexible as it can be adapted in regards to the IoT device's available hardware resources and constraints. Our security analysis shows that our framework is resilient to a variety of attack vectors. The experimental setup demonstrates the feasibility of the approach. By implementing a variety of test cases on FPGA, we demonstrate the adaptability and performance of the framework. Experiments indicate that the update procedure for a 1183kB firmware image could be achieved, in a secure manner, under 1.73 seconds.

A Modular End-to-End Framework for Secure Firmware Updates on Embedded Systems

“…Our flexible framework demonstrates the ability to be reconfigured in terms of hardware components while also giving the ability to EDs to be deployed in-field without any secure enrollment phase or hardcoded secrets within the ED's non-volatile memory. Recent work has shown that PPUFs alongside other security primitives implemented on hardware could be utilized for secure firmware delivery to in-field devices [16]. However, the approach is not end-to-end secure as it lacks the communication handshake required for two-way authentication in a truly public-key -based fashion.…”

“…Also, the updating procedure must be initiated from the firmware vendor's side which is not considered good practice in OTA updates [2,27]. The work in [17] improves the firmware updating procedure proposed in [16] by introducing digital signatures, which allow the device to better authenticate the manufacturer. However, it still suffers from the aforementioned drawbacks.…”

Hardware-Enabled Secure Firmware Updates in Embedded Systems

“…Firmware updates are transmitted from the manufacturer to the embedded device through an insecure channel. The proposed approach relies on hardware as a root-of-trust to attain high security levels and is motivated towards low-end embedded devices [19]. The framework is designed in a way that user intervention and device downtime are minimized.…”

A Modular End-to-End Framework for Secure Firmware Updates on Embedded Systems

“…can utilize for remote firmware updates. We enhance our preliminary work on leveraging hardware primitives to deliver firmware updates [9], in order to provide an end-to-end secure and modular framework, incorporating two-way authentication handshakes, strong confidentiality guarantees, and protection mechanisms against a variety of possible attacks. Our proposed methodology provides significant advantages over existing PUF-based techniques used primarily for authentication purposes:…”