Presentation from Arm Tech Symposia 2017 in Taipei and Hsinchu about firmware updates over low powered wide area networks (LPWAN) like LoRa, Sigfox and NB-IoT

1. Enabling firmware
updates over LPWAN
Jan Jongboom | Developer Evangelist | Arm
Tech Symposia 2017

2. © 2017 Arm Limited 2

3. © 2017 Arm Limited 3
Wait, what... LPWAN?
Powerconsumption/Bandwidth
Range
IoT sweet spot

4. © 2017 Arm Limited 4
Pick two
High bandwidth Low power
Long range

5. © 2017 Arm Limited 5
Many choices...
10 years battery life, 10 km range

6. © 2017 Arm Limited
LPWAN
Physics crash-course
© 2017 Arm Limited

7. © 2017 Arm Limited 7
High link budget
TX
P (dBm)
RX
Derived from work by Thomas Telkamp
TX Power
Connector loss
Antenna gain
Connector loss
Antenna gain
RX Power
Path loss and fading
14
0
-100
Receiver sensitivity

8. © 2017 Arm Limited 7
High link budget
RX
Derived from work by Thomas Telkamp
TX Power
Connector loss
Antenna gain
Connector loss
Antenna gain
RX Power
Path loss and fading
Receiver sensitivity
-137 dBm
14 dBm151 dBm link budget

9. © 2017 Arm Limited 8
Link budget
Wi-Fi
Unlicensed LPWAN
Licensed LPWAN
TX Power RX Sensitivity Link budget
20.5 dBm -75 dBm 95.5 dBm
14 dBm -137 dBm 151 dBm
23 dBm -129 dBm 152 dBm

10. © 2017 Arm Limited 9
Theoretical maximum in free space
2.4 GHz, with 95.5 dBm link budget:
550 meters
915 MHz, with 151 dBm link budget:
850,000 meters

11. © 2017 Arm Limited 10

12. © 2017 Arm Limited 11
Unfortunately... we don't live in free space
Attenuation Reflection and diffraction Fresnel zone

13. © 2017 Arm Limited
Based on Tokyo - model for calculating realistic path loss
Picture by Moyan Brenn: https://commons.wikimedia.org/wiki/File:Tokyo_(16043023330).jpg© 2017 Arm Limited
Hata model
Large city (250 bps)
Large city (1,760 bps)
Suburb (250 bps)
TX height RX height Range
0.1 m 40 m 4 km
0.1 m 40 m 2.5 km
0.1 m 40 m 9 km
Suburb (250 bps) 1 m 100 m 13 km

14. © 2017 Arm Limited © 2017 Arm Limited https://www.flickr.com/photos/aaronjacobs/64368770
Aggressive
sleeping

15. © 2017 Arm Limited 14
Transmit as little as possible
No gateway pinning
No keep-alive
NB-IoT: 200 mW
Sigfox: 25 mW
https://www.flickr.com/photos/pheezy/5875298232

16. © 2017 Arm Limited 15
Listen as little as possible
RX consumption: 9 mA
500 mAh / 9 mA / 24h = 2.31 days
2.31 days !== 10 years

17. © 2017 Arm Limited 16
Relaying data back to device
TX RX TX RX TX RX
LoRaWAN Class A, LTE-M Power Save Mode, Sigfox
RX TXRX
LoRaWAN Class B, LTE-M EdRX
RX RX

18. © 2017 Arm Limited 17
Tiny packets
No IP routing in packets
Security in message, not in transport layer
No TLS handshakes (6 messages, 6.5K data)
Small 13-14 byte header
Every byte counts!

19. © 2017 Arm Limited 18
IoT deployments target 10 years lifetime
But 10 years is a really long time!

20. © 2017 Arm Limited 19 © 2017 Arm Limited

21. © 2017 Arm Limited © 2017 Arm Limited
How to

22. © 2017 Arm Limited 21
Naive approach
TX RX TX RX TX RX
Firmware fragment
Very inefficient!
Device 1
TX RX TX RX TX RX
Device 2

23. © 2017 Arm Limited 22
Better approach
RX
Many firmware fragments
Device 1
Device 2
RX
Device N
RX

24. © 2017 Arm Limited 23
But... how do we do this?
1. Instruct devices to use a new set of keys (same for everyone).
2. Instruct devices to wake up at the same time.
3. Gateway can transmit to all devices with one message.
Problem: low QoS and uni-directional

25. © 2017 Arm Limited 24
Setting up the device
Device Address: 0xCF32AB09
Multicast Key: 9310E28FA291...

26. © 2017 Arm Limited 25
Setting up the device
Packet size: 204 bytes
Packet count: 491
Padding: 16 bytes

27. © 2017 Arm Limited 26
Starting multicast session
Frequency: 924.525 MHz
Data rate: 220 bytes / sec
Time to start: 812 sec after UL event 13
ULCounter | RTC
----------------
15 | 781
14 | 704
13 | 623
12 | 491
...

28. © 2017 Arm Limited 27
Dealing with low QoS
CRC hash of firmware
(sent with device's own credentials)
OK!

29. © 2017 Arm Limited 28
Dealing with low QoS
CRC hash of firmware
(sent with device's own credentials)
OK!
Forward error correction
http://www.inference.phy.cam.ac.uk/mackay/gallager/papers/ldpc.pdf

30. © 2017 Arm Limited 29
Speed
220 bytes per second in real world scenario
(2.5KM range in cities)
180KB Firmware size, 30KB with Delta updates
Transmission costs 3m30s @ 15mA current
https://www.reddit.com/r/Eyebleach/comments/68r4rt/tortoise_taxi/

31. © 2017 Arm Limited © 2017 Arm Limited
Security
Picture by Yuri Samoilov https://www.flickr.com/photos/yusamoilov/13334048894

32. © 2017 Arm Limited 31
Link layer security is not enough
Firmware manifest
Contains firmware hash
Contains manufacturer and device class ID
Signed with private key

33. © 2017 Arm Limited 32
Separate trusted and non-trusted code
(Not yet implemented)

34. © 2017 Arm Limited 33
Bootloader support
New in Mbed OS 5.5
Bootloader verifies integrity,
preferably in non-writable flash
Tamper-proof secure element to
protect keys
https://os.mbed.com/blog/entry/firmware-updates-mbed-5-flashiap/

35. © 2017 Arm Limited © 2017 Arm Limited
Caveats
http://www.totalprosports.com/wp-content/uploads/2013/04/first-pitch-fail-baseball-fail-gifs.gif

36. © 2017 Arm Limited © 2017 Arm Limited
Network congestion
Sending a lot of data has negative effect on network
Higher data rate is better
RX sensitivity is useless when someone screams next to you
Spread spectrum helps against narrowband interference

37. © 2017 Arm Limited 36
Spectrum regulations in EU
Unlicensed does not mean unregulated
1% duty cycle in 868 MHz band, except at 869.525 MHz
Downside: it's the RX2 channel
Round-robin between gateways
Drive over to site and deploy temporary gateway

38. © 2017 Arm Limited 37
US is both better and worse
Better
Worse
No duty cycle
Wider channels (500 KHz vs. 125 KHz)
Faster
400 ms. dwell time
915 MHz band is used for a lot of other stuff, lower QoS

39. © 2017 Arm Limited
Current state

40. © 2017 Arm Limited 39
Reference implementation
Multi-Tech xDot (Cortex-M3, 32K RAM)
LoRaWAN 1.02
mbed OS 5.5
Network server by The Things Network

41. © 2017 Arm Limited 40
Client + bootloader
Open source
Apache 2.0
Available on GitHub
Very little security!
Secure bootloader and cryptographically secure update service available as licensable IP
from Arm.

42. © 2017 Arm Limited © 2017 Arm Limited
Reference implementation:
https://github.com/ArmMbed/fota-lora-radio
Demo: http://bit.ly/lora-update-demo

43. © 2017 Arm Limited
Recap
1. LPWANs are awesome!
2. Secure firmware updates are necessity
3. Firmware updates over LPWAN deemed
impossible... But they are not!

44. Thank You!
Danke!
Merci!
!
!
Gracias!
Kiitos!
감사합니다
धन्यवाद
© 2017 Arm Limited
http://bit.ly/lora-update-demo
jan.jongboom@arm.com

45. © 2017 Arm Limited
The Arm trademarks featured in this presentation are registered trademarks or
trademarks of Arm Limited (or its subsidiaries) in the US and/or elsewhere. All rights
reserved. All other marks featured may be trademarks of their respective owners.
www.arm.com/company/policies/trademarks