Secure Firmware Updates on Embedded Systems
About
With the advancement of Internet-of-Things (IoT) technology, embedded devices have increasingly permeated our daily lives. Such devices allow physical objects to become integrable with information. As a result, embedded devices are increasingly interdependent and, in many cases, important to our safety. For example, critical domains such as Industrial Control Systems (ICS) are being integrated into Industrial IoT (IIoT) embedded systems in order to augment traditional control systems with wireless sensing services and provide better automation through multiple sensors and measurement points. This massive deployment of embedded systems in mission-critical environments introduces security challenges. Such devices are highly constrained in terms of performance and resources; hence, it is often infeasible to employ traditional security techniques as those used in general-purpose computing systems. The number of incidents causing software failures, data breaches, and often physical damage is increasing. For instance, malicious adversaries can compromise high-wattage IoT devices to disrupt the power grid’s normal operation by manipulating
the total load demand.
SENTRY Lab @KAUST PI Prof. Konstantinou in collaboration with KIOS Research and Innovation Centre of Excellence @University of Cyprus developed a secure protocol that integrators (e.g., system designers, IoT infrastructure owners, etc.) can utilize for remote firmware updates. The end-to-end secure and modular framework incorporates two-way authentication handshakes, strong confidentiality guarantees, and protection mechanisms against a variety of possible attacks. The proposed methodology leverages hardware primitives to deliver firmware updates and provides significant advantages over existing PUF-based techniques used primarily for authentication purposes. The security analysis shows that the framework is resilient to a variety of attack vectors. The experimental setup demonstrates the feasibility of the approach. By implementing a variety of test cases on FPGA, the work demonstrates the adaptability and performance of the framework. Experiments indicate that the update procedure for a 1183-kB firmware image could be achieved, in a secure manner, under 1.73 seconds.
Read the full article in ACM Journal on Emerging Technologies in Computing Systems (JETC).
