More information at https://www.mbed.com/fota-lora Presentation from Embedded World 2018 about firmware updates over LPWANs such as LoRa / LoRaWAN, Sigfox, NB-IoT or LTE-M1. From multicast to delta updates to bootloaders.

1. Firmware updates over
Low-Power Wide Area Networks
Jan Jongboom
Embedded World
February 2018

2. © 2018 Arm Limited 2 © 2018 Arm Limited

3. © 2018 Arm Limited 3
The case for LPWANs
Powerconsumption/Bandwidth
Range
IoT sweet spot

4. © 2018 Arm Limited 4
Pick two
High bandwidth Low power
Long range

5. © 2018 Arm Limited 5
LPWAN deployments target 10 years lifetime
But 10 years is a really long time!

6. https://boygeniusreport.files.wordpress.com/2016/04/iphone-2g-1st-generation-jobs.jpg?quality=98&strip=all
© 2018 Arm Limited

7. © 2018 Arm Limited 7

8. During the lifetime of a device...
Devices get a specific purpose
Requirements change
Standards change
Vulnerabilities are found
© 2018 Arm Limited

9. © 2018 Arm Limited © 2018 Arm Limited

10. © 2018 Arm Limited 10
Relaying data back to device
TX RX TX RX TX RX
LoRaWAN Class A, LTE-M Power Save Mode, Sigfox
RX TXRX
LoRaWAN Class B, LTE-M EdRX
RX RX

11. © 2018 Arm Limited 11
Naive approach
TX RX TX RX TX RX
Firmware fragment
Very inefficient!
Device 1
TX RX TX RX TX RX
Device 2

12. © 2018 Arm Limited 12
Better approach
RX
Many firmware fragments
Device 1
Device 2
RX
Device N
RX

13. © 2018 Arm Limited 13
But... how do we do this?
1. Instruct devices to use a new set of keys (same for everyone).
2. Instruct devices to wake up at the same time.
3. Gateway can transmit to all devices with one message.
Problem: low QoS and uni-directional

14. © 2018 Arm Limited 14
Setting up the device
Device Address: 0xCF32AB09
Multicast Key: 9310E28FA291...
Packet size: 204 bytes
Packet count: 491
Padding: 16 bytes

15. © 2018 Arm Limited 15
Starting multicast session
Frequency: 924.525 MHz
Data rate: 220 bytes / sec
Time to start: 812 sec after UL event 13
ULCounter | RTC
----------------
15 | 781
14 | 704
13 | 623
12 | 491
...

16. © 2018 Arm Limited 16
Dealing with low QoS
CRC hash of firmware
(sent with device's own credentials)
OK!

17. © 2018 Arm Limited 17
Dealing with low QoS
CRC hash of firmware
(sent with device's own credentials)
OK!
Forward error correction
http://www.inference.phy.cam.ac.uk/mackay/gallager/papers/ldpc.pdf

18. © 2018 Arm Limited 18
Speed
220 bytes per second on LoRaWAN SF9 125 KHz
30KB Typical patch size
Transmission costs 2m30s (ideally) @ 10mA current
https://www.reddit.com/r/Eyebleach/comments/68r4rt/tortoise_taxi/

19. © 2018 Arm Limited © 2018 Arm Limited
In real life
http://www.totalprosports.com/wp-content/uploads/2013/04/first-pitch-fail-baseball-fail-gifs.gif

20. © 2018 Arm Limited 20
Gateway selection
Use highest data rate
Limits number of devices that gets covered by one
gateway
But: higher capacity on gateway
(less channel utilization)
And: highest throughput

21. © 2018 Arm Limited 21
Gateway selection
Round-robin between gateways
Define group of devices that are covered by the same set
of gateways
Downlink scheduling round robin across gateways
May result in higher packet loss on specific gateway-device
links
But: higher capacity per gateway (less channel utilization)

22. © 2018 Arm Limited 22
Gateway selection
Temporary gateway
Dedicated to firmware update
Expensive, but cheaper than replacing the device or
performing a manual per-device update through cable
(if even available)

23. © 2018 Arm Limited 23
Spectrum usage
US: use dedicated band
EU: 869.525 MHz has 10% duty cycle
Duty cycle is measured per hour
Channel hopping?

24. © 2018 Arm Limited 24
Update flow
Device Network
Update
Server
OEM
Device
Owner
Private KeyPublic Key
Signs update
Schedules update
Adds error correction
Selects frequency, gateways, data rate
Schedules instructions for device (through NS)
Calculates hash
Delivers update
Verifies update signature
Applies delta update
Reboots & flashes
Firmware hash

25. © 2018 Arm Limited © 2018 Arm Limited
Device
requirements
Picture by Yuri Samoilov https://www.flickr.com/photos/yusamoilov/13334048894

26. © 2018 Arm Limited 26
Link layer security is not enough
Firmware manifest
Contains firmware hash
Contains manufacturer and device class ID
Signed with private key (held by OEM)

27. © 2018 Arm Limited 27
Delta updates
001100
010010
011110
100001
101101
110011
001100
011100
011110
100001
101 11
110011
EQL 8
RPL 110
EQL 16
DEL 1
RPL 1
EQL 7
Update goes from 200K to 30K
Good linker can help even more
Choose a memory-efficient patching library
(linear patch format helps)
https://github.com/janjongboom/janpatch

28. © 2018 Arm Limited 28
Device security
MCU
Firmware update service
Application
Arm TrustZone
Memory space
Secure Element

29. © 2018 Arm Limited 29
Components required
Bootloader
Asymmetric crypto
Storage driver
Resilient filesystem
Advanced
LoRaWAN stack
Radio drivers
FlashIAP
Update client

30. © 2018 Arm Limited 29
Components required
Bootloader
Asymmetric crypto
Storage driver
Resilient filesystem
Advanced
LoRaWAN stack
Radio drivers
FlashIAP
Update client

31. © 2018 Arm Limited © 2018 Arm Limited
Mbed OS 5
140 development boards supported
Certified LoRaWAN stack in Mbed OS 5.8
Bootloader, update client and crypto out of the box
Runs on 32K RAM incl. RTOS
Apache 2.0 licensed

32. © 2018 Arm Limited 31
Current state
Reference implementation on top of LoRaWAN
Standardization work in progress
https://github.com/armmbed/lorawan-fota-demo/
© 2018 Arm Limited

33. © 2018 Arm Limited
https://mbed.com/fota-lora

34. © 2018 Arm Limited
Recap
1. LPWANs are awesome!
2. Secure firmware updates are necessity
3. Firmware updates over LPWAN deemed
impossible... But they are not!

35. Thank You!
Danke!
Merci!
!
!
Gracias!
Kiitos!
감사합니다
धन्यवाद
© 2018 Arm Limited 34
https://mbed.com/fota-lora