Secure boot and firmware updates (OTA) in IOT Protocols - Step-by-Step Execution

Process Flow - Secure boot and firmware updates (OTA)

Power On Device

↓

Start Secure Boot

↓

Verify Bootloader Signature

Yes↓

Load Firmware

↓

Verify Firmware Signature

Yes↓

Run Firmware

↓

Check for OTA Update

Yes↓

Download Update

↓

Verify Update Signature

Yes↓

Install Update

↓

Reboot Device

↩Back to Start Secure Boot

The device powers on, verifies bootloader and firmware signatures to ensure integrity, runs firmware, checks for OTA updates, verifies and installs updates securely, then reboots to apply changes.

Execution Sample

IOT Protocols

power_on()
if verify_signature(bootloader):
  load_firmware()
  if verify_signature(firmware):
    run_firmware()
    if check_ota_update():
      download_update()
      if verify_signature(update):
        install_update()
        reboot()

This code simulates secure boot by verifying signatures and performs OTA update if available and verified.

Process Table

Step	Action	Condition/Check	Result	Next Step
1	Power on device	N/A	Device powered on	Verify bootloader signature
2	Verify bootloader signature	Is bootloader signature valid?	Yes	Load firmware
3	Load firmware	N/A	Firmware loaded into memory	Verify firmware signature
4	Verify firmware signature	Is firmware signature valid?	Yes	Run firmware
5	Run firmware	N/A	Firmware running	Check for OTA update
6	Check for OTA update	Is OTA update available?	Yes	Download update
7	Download update	N/A	Update downloaded	Verify update signature
8	Verify update signature	Is update signature valid?	Yes	Install update
9	Install update	N/A	Update installed	Reboot device
10	Reboot device	N/A	Device rebooting	Start secure boot again
11	Verify bootloader signature	Is bootloader signature valid?	Yes	Load firmware
12	Verify firmware signature	Is firmware signature valid?	Yes	Run firmware
13	Check for OTA update	Is OTA update available?	No	Continue running firmware
14	Continue running firmware	N/A	Device running updated firmware	End
15	End	N/A	Secure boot and OTA update complete	Stop

💡 No OTA update available after reboot, device runs updated firmware securely.

Status Tracker

Variable	Start	After Step 6	After Step 9	After Step 13	Final
bootloader_signature_valid	Unknown	Yes	Yes	Yes	Yes
firmware_signature_valid	Unknown	Yes	Yes	Yes	Yes
ota_update_available	Unknown	Yes	Yes	No	No
update_signature_valid	Unknown	N/A	Yes	N/A	N/A
firmware_running	No	No	No	Yes	Yes

Key Moments - 3 Insights

Why do we verify the bootloader signature before loading firmware?

Verifying the bootloader signature ensures the device starts from trusted code. As shown in execution_table step 2, if this check fails, the device will not proceed, preventing untrusted code from running.

What happens if the OTA update signature is invalid?

If the update signature is invalid (step 8), the device will reject the update and not install it, protecting from malicious updates. This is critical for security.

Why does the device reboot after installing the update?

Rebooting (step 10) restarts the secure boot process to load the new firmware safely, ensuring the update is applied correctly and verified again before running.

Visual Quiz - 3 Questions

Look at the execution_table at step 6. What is the value of 'ota_update_available'?

A Yes

B No

C Unknown

D Invalid

💡 Hint

Check the 'Condition/Check' column at step 6 and variable_tracker for 'ota_update_available' after step 6.

At which step does the device install the update?

A Step 7

B Step 8

C Step 9

D Step 10

💡 Hint

Look at the 'Action' column in execution_table for the step labeled 'Install update'.

If the firmware signature was invalid at step 4, what would happen next?

A Device would run firmware anyway

B Device would stop booting

C Device would download OTA update

D Device would reboot immediately

💡 Hint

Refer to step 4's 'Condition/Check' and 'Result' columns in execution_table to understand the flow on signature failure.

Concept Snapshot

Secure Boot and OTA Updates:
- Device powers on and verifies bootloader signature.
- Loads and verifies firmware signature before running.
- Checks for OTA updates, downloads and verifies update signature.
- Installs update and reboots to apply securely.
- Ensures only trusted code runs, protecting device integrity.

Full Transcript

When the device powers on, it starts the secure boot process by verifying the bootloader's signature to ensure it is trusted. If valid, it loads the firmware and verifies its signature. Only if the firmware is verified does the device run it. The running firmware checks if an OTA update is available. If yes, it downloads the update and verifies the update's signature. If the update is valid, it installs the update and reboots the device. After reboot, the secure boot process repeats to verify and run the updated firmware. If no OTA update is available, the device continues running the current firmware. This process ensures the device runs only trusted software and safely applies updates.

Practice

1. What is the main purpose of secure boot in IoT devices?

easy

A. To ensure only trusted software runs on the device

B. To speed up the device startup time

C. To allow any software to run without restrictions

D. To backup device data automatically

Solution

1. Step 1: Understand secure boot concept

   Secure boot checks the software's authenticity before running it on the device.

2. Step 2: Identify the main goal

   The goal is to prevent untrusted or malicious software from running.

3. Final Answer:

   To ensure only trusted software runs on the device -> Option A

4. Quick Check:

   Secure boot = trusted software only [OK]

Hint: Secure boot means only trusted software runs [OK]

Common Mistakes:

• Thinking secure boot speeds startup
• Believing secure boot allows any software
• Confusing secure boot with data backup

2. Which of the following is the correct command to verify a firmware update signature using openssl?

easy

A. openssl verify -CAfile ca.pem firmware.sig

B. openssl sign -verify firmware.bin

C. openssl dgst -verify ca.pem -signature firmware.sig firmware.bin

D. openssl check firmware.sig firmware.bin

Solution

1. Step 1: Recall openssl dgst verify syntax

   The correct syntax to verify a signature is: openssl dgst -verify [pubkey/cert] -signature [signature] [file].

2. Step 2: Match the command with syntax

   openssl dgst -verify ca.pem -signature firmware.sig firmware.bin matches this syntax exactly for verifying firmware signature.

3. Final Answer:

   openssl dgst -verify ca.pem -signature firmware.sig firmware.bin -> Option C

4. Quick Check:

   Verify signature = openssl dgst -verify [key] -signature [sig] [file] [OK]

Hint: Verify signature uses 'dgst -verify' and '-signature' flags [OK]

Common Mistakes:

• Using 'openssl sign' instead of 'dgst'
• Missing '-verify' or '-signature' flags
• Using wrong command like 'openssl check'

3. Given this pseudo-code for OTA update verification:

if verify_signature(firmware, signature, public_key):
    install_firmware(firmware)
else:
    reject_update()

What happens if the signature does not match?

medium

A. Update is rejected and not installed

B. Signature is ignored and update proceeds

C. Device reboots automatically

D. Firmware is installed anyway

Solution

1. Step 1: Analyze the conditional logic

   If verify_signature returns false, the else branch runs.

2. Step 2: Understand else branch action

   The else branch calls reject_update(), meaning the update is not installed.

3. Final Answer:

   Update is rejected and not installed -> Option A

4. Quick Check:

   Signature mismatch = reject update [OK]

Hint: If signature fails, update is rejected [OK]

Common Mistakes:

• Assuming firmware installs despite bad signature
• Thinking device reboots automatically
• Ignoring signature verification result

4. You wrote this OTA update script snippet:

if verify_signature(firmware, signature, public_key):
    install_firmware(firmware)
else:
    install_firmware(firmware)

What is the main problem here?

medium

A. Firmware is never installed

B. Signature verification function is missing

C. Public key is not used in verification

D. Firmware is installed even if signature verification fails

Solution

1. Step 1: Review the else branch code

   Both if and else branches call install_firmware(firmware).

2. Step 2: Understand security impact

   This means firmware installs regardless of signature check, breaking security.

3. Final Answer:

   Firmware is installed even if signature verification fails -> Option D

4. Quick Check:

   Else installs firmware = security risk [OK]

Hint: Else should reject update, not install firmware [OK]

Common Mistakes:

• Ignoring else branch code
• Assuming verification function is missing
• Confusing public key usage

5. You want to implement a secure OTA update system that:
- Verifies firmware signature
- Supports rollback if update fails
- Uses secure boot to prevent unauthorized code

Which sequence of steps best achieves this?

hard

A. Enable secure boot -> Install firmware -> Verify signature -> Rollback if failure

B. Enable secure boot -> Verify signature -> Install firmware -> Rollback if failure

C. Verify signature -> Install firmware -> Enable secure boot -> Rollback if failure

D. Install firmware -> Verify signature -> Enable secure boot -> Rollback if failure

Solution

1. Step 1: Enable secure boot first

   Secure boot must be active to prevent unauthorized code from running at startup.

2. Step 2: Verify firmware signature before installing

   Check the update is trusted before installation to avoid bad firmware.

3. Step 3: Install firmware and support rollback

   Install only if verified, and rollback if update fails to keep device safe.

4. Final Answer:

   Enable secure boot -> Verify signature -> Install firmware -> Rollback if failure -> Option B

5. Quick Check:

   Secure boot first, verify, install, rollback [OK]

Hint: Enable secure boot first, then verify before install [OK]

Common Mistakes:

• Installing firmware before verifying signature
• Enabling secure boot after installation
• Skipping rollback support