IoT deployments last for ten years, but that's a long time. Requirements change, vulnerabilities are found, and standards evolve. You'll need a firmware update solution. Talk during The Things Conference 2019.

1. Firmware Updates over the Air
Jan Jongboom, Arm

2. Jan Jongboom
Principal Developer Evangelist
jan.jongboom@arm.com

3. IoT deployments target 10 years lifetime
But 10 years is a really long time!

6. During the lifetime of a device...
Devices get a specific purpose
Requirements change
Standards change
Vulnerabilities are found

9. How to

10. Naive approach
TX RX TX RX TX RX
Firmware fragment
Very inefficient!
Device 1
TX RX TX RX TX RX
Device 2

11. Better approach
RX
Many firmware fragments
Device 1
Device 2
RX
Device N
RX

12. But... how do we do this?
1. Instruct devices to use a new set of keys (same for everyone).
2. Instruct devices to wake up at the same time.
3. Gateway can transmit to all devices with one message.
Problem: low QoS and uni-directional

13. Setting up the device
Device Address: 0xCF32AB09
Multicast Key: 9310E28FA291...

14. Setting up the device
Packet size: 204 bytes
Packet count: 491
Padding: 16 bytes

15. Starting multicast session
Frequency: 869.525 MHz
Data rate: SF9
Time to start: 2019-01-31 14:40:30

16. Dealing with low QoS
CRC hash of firmware
(sent with device's own credentials)
OK!

17. Dealing with low QoS
CRC hash of firmware
(sent with device's own credentials)
OK!
Forward error correction
http://www.inference.phy.cam.ac.uk/mackay/gallager/papers/ldpc.pdf

18. Three new specifications
LoRaWAN Application Layer Clock Synchronization Specification v1.0.0
LoRaWAN Remote Multicast Setup Specification v1.0.0
LoRaWAN Fragmented Data Block Transport Specification v1.0.0

19. In real life

20. Delta updates
Reduce update size by 90%
Good linker can help even more
Choose a memory-efficient patching library
(linear patch format helps)
https://github.com/janjongboom/janpatch
001100
010010
011110
100001
101101
110011
001100
011100
011110
100001
101 11
110011
EQL 8
RPL 110
EQL 16
DEL 1
RPL 1
EQL 7

21. Link layer security is not good enough...
Firmware manifest
Contains firmware hash
Contains manufacturer and device class ID
Signed with private key (held by OEM)

22. Update flow
Device
Network /
App server
Update
Server
OEM
Device
Owner
Private KeyPublic Key
Creates delta
Signs update
Schedules update
Adds error correction
Selects frequency, gateways, data rate
Schedules instructions for device (through NS)
Delivers update
Applies delta update
Verifies update signature
Reboots & flashes

23. Speed
Data rate
Update size
Packet loss
SF9 125 KHz
8 KiB
5%
Frequency 869.525 MHz
Payload per packet 110 bytes
Time per packet 595 ms.
Transmission time 48 seconds
Duty cycle used 48 / 360 sec. = 13.3%
No. of packets 82 (incl. 10% error correction packets)

24. Speed
Data rate
Update size
Packet loss
SF9 125 KHz
8 KiB
5%
Frequency 869.525 MHz
Payload per packet 110 bytes
Time per packet 595 ms.
Transmission time 48 seconds
Duty cycle used 48 / 360 sec. = 13.3%
No. of packets 82 (incl. 10% error correction packets)

25. Getting started

26. Reference implementation
Mbed OS 5.10
Runs on 150 development boards,
but needs storage configuration
Available for:
• L-TEK FF1705
• DISCO-L475VG + radio shield
RAM Usage: 18K
Flash usage: 109K + 32K bootloader
https://github.com/ARMmbed/mbed-os-example-lorawan-fuota

27. Lowering memory requirements
https://github.com/ARMmbed/mbed-os-example-lorawan-atecc608a

30. Google: "firmware updates lorawan"
https://www.youtube.com/watch?v=0NoshDOqmdM

31. Recap
Firmware updates are crucial for any long-term deployment
LoRaWAN can now do it in a standardized way
Do it securely, it's a big attack vector
Get started at https://github.com/ArmMbed/mbed-os-example-lorawan-fuota

32. Slides: hlp://janjongboom.com
Thank you!
Jan Jongboom
Principal Developer Evangelist
jan.jongboom@arm.com