Presentation I gave about firmware updates over LPWANs during The Things Conference 2018.

1. Firmware updates over the air
using LoRaWAN
Jan Jongboom
The Things Conference
1 February 2018

2. © 2018 Arm Limited 2 © 2018 Arm Limited

3. © 2018 Arm Limited 3
IoT deployments target 10 years lifetime
But 10 years is a really long time!

4. https://www.buzzfeed.com/norbertobriceno/gimme-a-hell-yeah?utm_term=.xcKNDnloB#.rxa8VOlkm
© 2018 Arm Limited

5. https://boygeniusreport.files.wordpress.com/2016/04/iphone-2g-1st-generation-jobs.jpg?quality=98&strip=all
© 2018 Arm Limited

6. © 2018 Arm Limited 6

7. © 2018 Arm Limited 7
During the lifetime of a device...
Devices get a specific purpose
Requirements change
Standards change
Vulnerabilities are found

8. © 2018 Arm Limited © 2018 Arm Limited
How to

9. © 2018 Arm Limited 9
Naive approach
TX RX TX RX TX RX
Firmware fragment
Very inefficient!
Device 1
TX RX TX RX TX RX
Device 2

10. © 2018 Arm Limited 10
Better approach
RX
Many firmware fragments
Device 1
Device 2
RX
Device N
RX

11. © 2018 Arm Limited 11
But... how do we do this?
1. Instruct devices to use a new set of keys (same for everyone).
2. Instruct devices to wake up at the same time.
3. Gateway can transmit to all devices with one message.
Problem: low QoS and uni-directional

12. © 2018 Arm Limited 12
Setting up the device
Device Address: 0xCF32AB09
Multicast Key: 9310E28FA291...

13. © 2018 Arm Limited 13
Setting up the device
Packet size: 204 bytes
Packet count: 491
Padding: 16 bytes

14. © 2018 Arm Limited 14
Starting multicast session
Frequency: 924.525 MHz
Data rate: 220 bytes / sec
Time to start: 812 sec after UL event 13
ULCounter | RTC
----------------
15 | 781
14 | 704
13 | 623
12 | 491
...

15. © 2018 Arm Limited 15
Dealing with low QoS
CRC hash of firmware
(sent with device's own credentials)
OK!

16. © 2018 Arm Limited 16
Dealing with low QoS
CRC hash of firmware
(sent with device's own credentials)
OK!
Forward error correction
http://www.inference.phy.cam.ac.uk/mackay/gallager/papers/ldpc.pdf

17. © 2018 Arm Limited 17
Speed
220 bytes per second on SF9 125 KHz
30KB Typical patch size
Transmission costs 2m30s (ideally) @ 10mA current
https://www.reddit.com/r/Eyebleach/comments/68r4rt/tortoise_taxi/

18. © 2018 Arm Limited © 2018 Arm Limited
In real life
http://www.totalprosports.com/wp-content/uploads/2013/04/first-pitch-fail-baseball-fail-gifs.gif

19. © 2018 Arm Limited 19
Gateway selection
Plan updates in advance, reserve slot on the
Network Server
Gateway selection strategies, combination possible:
1. Use highest data rate
2. Round-robin between gateways
3. Drive over to site and deploy temporary gateway

20. © 2018 Arm Limited 20
Gateway selection
Use highest data rate
Limits number of devices that gets covered by one gateway
But: higher capacity on gateway
(less channel utilization)
And: highest throughput

21. © 2018 Arm Limited 21
Gateway selection
Round-robin between gateways
Define group of devices that are covered by the same set
of gateways
Downlink scheduling round robin across gateways
May result in higher packet loss on specific gateway-device
links
But: higher capacity per gateway (less channel utilization)

22. © 2018 Arm Limited 22
Gateway selection
Temporary gateway
Dedicated to firmware update
Expensive, but cheaper than replacing the device or
performing a manual per-device update through cable
(if even available)

23. © 2018 Arm Limited 23
Spectrum usage
US: use dedicated band
EU: 869.525 MHz has 10% duty cycle
Duty cycle is measured per hour

24. © 2018 Arm Limited © 2018 Arm Limited
Device
requirements
Picture by Yuri Samoilov https://www.flickr.com/photos/yusamoilov/13334048894

25. © 2018 Arm Limited 25
Link layer security is not enough
Firmware manifest
Contains firmware hash
Contains manufacturer and device class ID
Signed with private key (held by OEM)

26. © 2018 Arm Limited 26
Update flow
Device
Network /
App server
Update
Server
OEM
Device
Owner
Private KeyPublic Key
Signs update
Schedules update
Adds error correction
Selects frequency, gateways, data rate
Schedules instructions for device (through NS)
Calculates hash
Delivers update
Verifies update signature
Applies delta update
Reboots & flashes
Firmware hash

27. © 2018 Arm Limited 27
Components required
Bootloader
Asymmetric crypto
Storage driver
Resilient filesystem
Advanced
LoRaWAN stack
Radio drivers
FlashIAP
Update client

28. © 2018 Arm Limited 27
Components required
Bootloader
Asymmetric crypto
Storage driver
Resilient filesystem
Advanced
LoRaWAN stack
Radio drivers
FlashIAP
Update client

29. © 2018 Arm Limited © 2018 Arm Limited
Mbed OS 5
140 development boards supported
Certified LoRaWAN stack in Mbed OS 5.8
Bootloader, update client and crypto out of the box
Runs on 32K RAM incl. RTOS
Apache 2.0 licensed

30. © 2018 Arm Limited 29
Current state
Multicast and data fragmentation close to
standardization
Reference implementation by Arm + TTN
https://github.com/armmbed/lorawan-fota-demo/
Workshop at 13:30!
© 2018 Arm Limited

31. © 2018 Arm Limited
Google: "firmware updates lorawan"
https://www.youtube.com/watch?v=0NoshDOqmdM

32. © 2018 Arm Limited 31
hnp://janjongboom.com
Thank you!