Lightweight, cryptographically based system for secure firmware updates for Internet of Things devices

Abstract

A secure firmware update system for Internet of Things (IoT) devices using simple cryptographic mechanisms. The system includes: a communication interface configured to receive firmware update data packets from an update server over a wired or wireless network; a secure update processing unit that is operationally coupled with the communication interface, wherein the secure update processing unit comprises the following: a cryptographic verification processing unit configured to authenticate firmware update data packets using a simple digital signature scheme selected from hash-based signatures, restricted-environment optimized elliptic curve signatures, or message authentication codes (MACs) generated by block ciphers with reduced rounds; a decryption module configured to decrypt encrypted firmware payloads using light symmetric encryption techniques stored in secure non-volatile memory, with the decryption keys provided in a tamper-proof form; an integrity check control unit configured to perform rolling hash-based validation of decrypted firmware segments to ensure end-to-end update integrity while minimizing RAM usage; and a memory management unit configured to store the validated firmware payload in a secondary memory partition separate from a primary execution partition, thereby enabling atomic firmware switching and rollback protection.

Description

AREA OF INVENTION

[0001] The present invention relates generally to the security of the Internet of Things (IoT) and in particular to a secure IoT firmware management system in IoT devices using lightweight cryptographic mechanisms that are computationally efficient and suitable for restricted environments. BACKGROUND OF THE INVENTION

[0002] IoT devices such as smart sensors, wearables, industrial controllers, and home automation devices typically operate in resource-constrained environments where power, computing power, and storage availability are limited. Secure firmware updates are critical for such devices to ensure the integrity, authenticity, and confidentiality of the software components that govern device behavior. Existing cryptographic mechanisms, including conventional asymmetric techniques like RSA and elliptic curve cryptography, are often computationally intensive and power-hungry, making them unsuitable for low-power IoT nodes. Furthermore, traditional update frameworks rely on a centralized infrastructure that may not scale to billions of distributed nodes.Therefore, there is a need for a secure, lean and scalable mechanism to deliver firmware updates for IoT devices without compromising resource efficiency or security guarantees.

[0003] The rise of the Internet of Things (IoT) has fundamentally transformed the digital and physical landscape by integrating intelligence into everyday objects, machines, and infrastructure. From smart horns and connected medical devices to industrial controls and sensors for critical infrastructure, the number of IoT devices worldwide now numbers in the tens of billions. Given this massive proliferation, keeping such devices up-to-date and secure has become one of the key technical and operational challenges. Firmware updates form the backbone of IoT device maintenance, providing not only new features but also critical patches to address vulnerabilities and bugs.Unlike applications, which can often be updated independently of the user, firmware resides at the lowest level of device operation and controls essential hardware-software interactions. Consequently, any disruption in the delivery of firmware updates can render the device unstable, vulnerable to attacks, or even permanently inoperable. Existing solutions for secure firmware updates are traditionally based on computing paradigms in desktops, servers, and mobile systems. However, the unique limitations of IoT hardware render these solutions inadequate or impractical for large-scale deployment.

[0004] One of the most widespread approaches in conventional computer systems is the use of a public key infrastructure (PKI) to authenticate firmware updates. In this model, update packages are digitally signed using asymmetric encryption methods such as RSA or elliptic curve cryptography (ECC). The device verifies the signature using a pre-shared trusted public key before accepting and applying the update. This method ensures the authenticity and integrity of the firmware and has proven effective for general-purpose computers and mobile devices with sufficient processing power, memory resources, and battery capacity. However, when applied to IoT devices such as smart sensors, environmental monitors, or industrial controllers, this approach reveals significant shortcomings. The use of RSA or even ECC results in computational overhead that can exceed the limited processing power of IoT microcontrollers.This leads to longer update times, increased energy consumption, and in some cases, thermal stress. Many IoT nodes operate on coin cell batteries or energy harvesting subsystems, and the repeated execution of computationally intensive cryptographic operations can drastically shorten device lifespans. Furthermore, maintaining and deploying PKI infrastructure across billions of devices introduces scalability and management challenges, including the risk of certificate revocation and key compromise.

[0005] Another solution studied across the industry relies on secure boot mechanisms combined with trusted execution environments (TEEs). With this approach, IoT devices verify firmware integrity at startup using hardware-embedded trust mechanisms. Secure Elements or TPM-like chips are embedded in the device to store cryptographic keys and validate the authenticity of firmware images during the boot process. While this method effectively prevents the execution of unauthorized firmware, it does not automatically guarantee the secure delivery of the update. The device can still download corrupted or malicious firmware, and the rejection process during boot can render the device unusable until valid firmware is restored.Furthermore, adding TEEs or secure elements increases device costs and complexity, which is not always acceptable for extremely low-cost IoT nodes deployed in large quantities, such as smart meters or disposable medical sensors. The additional space requirements, manufacturing costs, and integration challenges make such approaches impractical in many scenarios where cost and size constraints are paramount.

[0006] Cloud-based firmware deployment frameworks have also been investigated as a solution, where centralized servers distribute updates over secure channels such as TLS. In these models, the authenticity of the updates is protected by end-to-end encryption, and devices maintain secure sessions with update servers to receive firmware binaries. This approach leverages existing web security infrastructure and benefits from mature cryptographic standards. However, IoT networks often suffer from intermittent connectivity, limited bandwidth, and high latency, especially in rural or industrial deployments using LPWAN technologies such as LoRaWAN, Sigfox, or NB-IoT. The overhead of establishing and maintaining TLS sessions can exceed the capacity of such networks. Furthermore, centralized architectures create bottlenecks and single points of failure.A compromise of update server or cloud credentials could allow attackers to simultaneously distribute malicious firmware to millions of devices, with devastating consequences. Distributed denial-of-service (DDoS) attacks on update servers expose further vulnerabilities, rendering such solutions insufficiently resilient for mission-critical IoT deployments.

[0007] Some approaches propose using blockchain-based distributed ledgers for the secure distribution of firmware updates. In these systems, firmware updates are immutably recorded on a blockchain, and devices verify the update metadata against the ledger before applying the new firmware. This ensures transparency, tamper resistance, and decentralized trust. However, blockchain solutions are inherently resource-intensive, requiring significant storage and computing power. Lightweight IoT devices cannot store large ledgers or perform repeated cryptographic validations using blockchain consensus protocols. Furthermore, blockchain transactions are subject to latency and require reliable connectivity, which conflicts with the intermittent and low-power nature of IoT networks.While blockchain-based update systems offer effective decentralized security, they are not practical for most limited devices due to resource mismatches.

[0008] Other existing solutions include delta firmware updates, which transfer only the differences between old and new firmware to reduce bandwidth and power costs. While this optimization reduces communication overhead, it complicates the verification process. Delta updates must be applied correctly to the existing firmware, and any bit-level corruption or manipulation during transmission can compromise the integrity of the resulting firmware image. Reconstructing the full firmware from deltas can also be computationally and memory-intensive, posing challenges for microcontrollers with limited flash and RAM. Without a robust, lightweight cryptographic integrity mechanism, delta update systems can unintentionally increase the attack surface by introducing vulnerabilities during reconstruction.

[0009] Solutions for secure firmware updates in IoT devices have significant drawbacks in restricted environments. PKI-based systems are computationally and energy-intensive; secure boot mechanisms protect against unauthorized execution but do not guarantee secure deployment; cloud-based update frameworks present scalability and centralization risks; blockchain-based approaches require resources far exceeding the capacity of typical IoT hardware; delta updates complicate integrity checks; proprietary ecosystems create challenges regarding interoperability and trust; and many existing systems lack resilience to replay, downgrade, or failed update scenarios.These limitations underscore the urgent need for a secure firmware update system specifically tailored to the unique requirements of IoT devices, utilizing lightweight cryptographic mechanisms that balance strong security guarantees with energy efficiency, scalability, and operational resilience. Summary of the invention

[0010] The present invention provides a system and device architecture for secure firmware updates in IoT devices. This architecture utilizes lightweight cryptographic mechanisms, including hash-based signatures, reduced-round block ciphers, and ellipse curve variants optimized for restricted environments. The system ensures the integrity, authenticity, and up-to-dateness of the firmware while minimizing computational overhead. In one embodiment, the IoT device includes a secure update processing unit integrated into the hardware-software architecture, enabling the authentication, decryption, and application of firmware updates received via wired or wireless communication links. The update unit uses pre-approved lightweight cryptographic keys, rolling hash-based integrity checks, and nonce-based replay protection to ensure that only authorized updates are applied.

[0011] The device architecture consists of a machine-integrated module with a cryptographic coprocessor, non-volatile security memory, and an update application controller configured as part of the microcontroller subsystem. The cryptographic coprocessor executes simple cryptographic primitives, offloading the main processor to conserve power. A dual-partitioned memory structure stores the current firmware and incoming update images in isolated areas, enabling atomic switching and rollback protection in case of incomplete or malicious updates.

[0012] The present invention aims to overcome the limitations and disadvantages of existing secure firmware update mechanisms for IoT (Internet of Things) devices, while providing a technically efficient, scalable, and robust solution. A key objective of the invention is to provide a system and device architecture that enables the secure deployment and installation of firmware updates in resource-constrained IoT environments without incurring the high computational and energy costs of conventional cryptographic frameworks. A further objective is the use of lean cryptographic mechanisms specifically tailored to the limited computational, memory, and energy budgets of IoT devices. This ensures that security does not compromise the lifespan or real-time performance of the devices.The invention also aims to establish a mechanism that guarantees the authenticity, integrity, and timeliness of firmware updates and ensures that only authorized and up-to-date firmware is accepted by the device. At the same time, it prevents replay or downgrade attacks that could create new vulnerabilities.

[0013] A further objective of the invention is to create a dual-partitioned memory structure within the device, enabling the secure deployment of incoming firmware alongside existing operating firmware. This allows for atomic switching to the new image and provides rollback protection in the event of incomplete, corrupted, or malicious updates. Another objective of the invention is to provide an embedded cryptographic coprocessor or an equivalent hardware-software module that offloads simple cryptographic operations from the main processor, thereby improving update speed, minimizing latency, and saving energy during security-critical operations.The invention aims at scalability by developing update mechanisms that function reliably on billions of devices in heterogeneous networks and at different geographical locations, while ensuring seamless key management, secure deployment and lifetime maintenance without the bottlenecks of centralized infrastructures.

[0014] A further objective of the invention is to improve the resilience and operational continuity of IoT devices through watchdog monitoring, tamper-proof storage, and error correction procedures. These ensure that updates can be performed securely even in environments with interrupted connectivity, limited bandwidth, or restricted power resources. The aim is also to provide a customizable framework that can be implemented in a wide variety of IoT applications—from industrial automation and critical infrastructure to medical devices and consumer electronics—while simultaneously ensuring interoperability and vendor independence.The invention is intended to ensure that firmware updates remain efficient, reliable and transparent to end users, thereby reducing the risk of device failures and providing robust protection against unauthorized modifications, the injection of malicious code or denial-of-service attacks through manipulated update processes. BRIEF DESCRIPTION OF THE FIGURE

[0015] These and other features, aspects, and advantages of the present invention will be better understood if the following detailed description is read with reference to the accompanying drawing, in which the same symbols consistently represent the same parts. The following applies: Fig. Figure 1 shows a block diagram of a secure firmware update system in IoT devices using simple cryptographic mechanisms.

[0016] Experts will also recognize that the elements in the drawing are shown for the sake of simplicity and are not necessarily to scale. For example, the flowcharts illustrate the process by highlighting the main steps to enhance understanding of the aspects of this disclosure. Furthermore, with regard to the design of the device, one or more components of the device may be represented in the drawing by conventional symbols, and the drawing may show only the specific details relevant to understanding the embodiments of this disclosure, so as not to clutter the drawing with details that are readily apparent to those skilled in the art after reading this description. Detailed description of the invention

[0017] For a better understanding of the inventive principles, reference is made below to the embodiment shown in the drawing, which is described in specific terminology. However, this does not limit the scope of the invention. Changes and further modifications of the illustrated system, as well as further applications of the inventive principles, are possible, as would normally occur to a person skilled in the art in the field of invention.

[0018] It is clear to the person skilled in the art that the preceding general description and the following detailed description are exemplary and explanatory of the invention and are not intended as a limitation of it.

[0019] References in this specification to “an aspect”, “another aspect”, or similar expressions mean that a particular feature, structure, or property described in connection with the embodiment is included in at least one embodiment of the present disclosure. Therefore, occurrences of the expressions “in one embodiment”, “in another embodiment”, and similar expressions in this specification may all refer to the same embodiment, but need not.

[0020] The terms "includes," "include," or other variations thereof are intended to cover non-exclusive inclusion, such that a process or method that includes a list of steps may not only contain those steps but may also include other steps not expressly listed or inherent in such process or method. Likewise, the statement "includes..." in the case of one or more devices, subsystems, elements, structures, or components does not, without further limitations, preclude the existence of other devices, subsystems, elements, structures, components, or additional devices, subsystems, elements, structures, or components.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as understood by a person skilled in the art in the field of the invention. The system, methods, and examples provided here serve only for illustration and are not to be construed as a limitation.

[0022] Embodiments of the present disclosure are described in detail below with reference to the attached drawing.

[0023] The present invention relates to a lightweight, cryptography-based, secure firmware update system for IoT devices. Fig.Figure 100 shows a block diagram of a secure firmware update system in IoT devices with lightweight cryptographic mechanisms. The system comprises a communication interface (102) configured to receive firmware update data packets from an update server over a wired or wireless network; a secure update processing unit (104) operationally coupled to the communication interface, the secure update processing unit comprising: a cryptographic verification processing unit (104a) configured to authenticate the firmware update data packets using a simple digital signature scheme selected from hash-based signatures, restricted-environment optimized signatures based on elliptic curves, or message authentication codes (MACs) generated by reduced-round block ciphers;a decryption module (106) configured to decrypt encrypted firmware payload using simple symmetric encryption techniques stored in secure, non-volatile memory, with the decryption keys provided in a tamper-proof form; an integrity verification control unit (108) configured to perform rolling hash-based validation of decrypted firmware segments to ensure end-to-end update integrity while minimizing RAM usage; and a memory management unit (110) configured to store the validated firmware payload in a secondary memory partition separate from a primary execution partition, thus enabling atomic firmware switching and rollback protection;the secure update processing unit also includes freshness validation using device-specific counters, timestamps or nonces to prevent replay or downgrade attacks.

[0024] In one embodiment, the cryptographic verification processing unit (104a) is implemented in a dedicated cryptographic coprocessor or hardware accelerator integrated on a circuit board of the IoT device. The coprocessor is configured to offload the main processor by performing simple signature verifications, hash calculations, and decryption operations, thereby reducing power consumption and minimizing update latency.

[0025] In one embodiment, the memory management unit (110) comprises a firmware memory structure with two partitions, each partition being configured as a physically isolated flash memory segment such that the primary partition retains the currently running firmware image while the secondary partition stores an incoming update image, and wherein a bootloader controller automatically switches execution control to the secondary partition after successful validation of the update, with the possibility of returning to the primary partition if validation fails.

[0026] The secure firmware update system is implemented using dedicated hardware modules and circuitry specifically designed for embedded IoT devices. The communication interface is implemented as a physical transceiver or wired network controller with associated circuitry to enable the reception of update data packets. The secure update processing unit is implemented in hardware logic and includes a dedicated cryptographic verification unit, implemented via dedicated hardware accelerators or processor extensions, optimized for simple calculations of digital signatures and message authentication. The decryption module is a hardware-embedded unit operationally coupled with secure non-volatile memory for key storage. Tamper-proof provisioning of physical keys is employed.The integrity check control unit is implemented as a hardware control block configured to perform rolling hash-based checks using finite-state machine logic with minimal RAM overhead. The memory management unit is implemented as a hardware partition controller that enforces the physical separation of primary and secondary memory partitions, thus enabling atomic firmware switching and rollback protection through deterministic hardware operations.

[0027] In one embodiment, the secure update processing unit (104) is configured to perform block-wise rolling hash calculations, so that each data block of the firmware update is individually validated before being stored in non-volatile memory. The rolling hash implementation is optimized to reuse partial calculations from previous blocks, thereby reducing both the computational load and the volatile memory requirement during the update process.

[0028] In one embodiment, the update validity mechanism is implemented by embedding a monotonic counter value in the firmware update metadata. The counter is managed in a secure, one-time programmable memory or equivalent non-volatile secure registers, such that the device rejects any firmware update whose counter value is less than or equal to the last stored value.

[0029] In one embodiment, the decryption module (106) uses lightweight symmetric cryptographic primitives selected from the block ciphers PRESENT, SIMON or SPECK and configured in counter mode (CTR) or cipher block chaining mode (CBC), wherein the encryption keys are device-specific and stored in a tamper-proof memory module, thereby ensuring the confidentiality of the firmware payload without excessive computational effort.

[0030] In one embodiment, the cryptographic coprocessor is implemented as an ASIC-based or FPGA-based hardware module, which also includes an energy harvesting subsystem operationally coupled to the coprocessor, wherein the subsystem is configured to harvest ambient energy from sources such as solar radiation, mechanical vibration or RF energy and uses the harvested energy specifically for performing cryptographic operations during firmware update procedures without discharging the primary device battery.

[0031] In one embodiment, the bootloader controller is equipped with a watchdog circuit that continuously monitors the update process, so that the device is automatically reset and returns to the stable firmware partition if an anomaly, interruption, or power failure occurs during the update installation. This ensures operational continuity and prevents permanent device failure.

[0032] In one embodiment, the communication interface (102) includes a lightweight network stack configured for operation over restricted wireless networks such as LoRaWAN, NB-IoT, Sigfox, or Bluetooth Low Energy. The network stack is adapted to segment large firmware updates into encrypted micropackets, and each packet is independently authenticated and validated before being reassembled within the device.

[0033] In one embodiment, the communication interface (102) also includes a fault-resistant reassembly protocol, wherein the protocol is configured to buffer and rearrange firmware micropackets that are not in the correct order using sequence identifiers and authentication tags, so that the integrity of the firmware is ensured even in networks with high packet loss or high latency.

[0034] The present invention will now be described in detail with reference to the system claims stated above. The focus is on the techniques and processes that enable secure firmware updates in IoT devices using simple cryptographic mechanisms. The detailed description concentrates on the architecture, operational flow, and technical foundations of the secure update process and integrates both hardware and software elements of the system.

[0035] In one embodiment, the system comprises an IoT device with a communication interface capable of receiving firmware update packets over limited wireless networks such as LoRaWAN, NB-IoT, Sigfox, or Bluetooth Low Energy. These networks inherently suffer from bandwidth limitations and are susceptible to packet loss, latency, and interrupted connectivity. To address these challenges, the update data is split into micropackets on the server side. Each micropacket is individually encrypted and tagged with an authentication tag. Upon arrival, the IoT device's communication interface buffers the packets, reordering them as needed and discarding corrupted or unauthenticated packets. A fault-tolerant reassembly protocol ensures that firmware updates can be correctly reconstructed with minimal retransmissions, even under adverse network conditions.

[0036] The device's secure update processing unit performs the cryptographic verification technique that forms the basis of the security model. At the start of the update process, the device extracts metadata from the incoming firmware package. This metadata includes the firmware version identifier, a monotonic counter, timestamps, and a digital signature. The signature is verified using a simple cryptographic scheme. This can be a hash-based signature such as XMSS or LMS, or a variant of an elliptic curve signature optimized for limited hardware, such as a shortened form of Ed25519. The signature verification technique is offloaded to a dedicated cryptographic coprocessor that performs modular arithmetic, hash-based signature tree traversal, or elliptic curve scalar multiplication in hardware.By offloading these tasks from the main microcontroller, the system reduces verification time and conserves battery power.

[0037] Once the authenticity of the update metadata has been verified, the device performs an update validation. This validation compares the monotonic counter embedded in the update package with the counter value securely stored in uniquely programmable memory or tamper-proof, non-volatile registers. The counter comparison follows a strict inequality rule: any firmware update with a counter value less than or equal to the stored reference value is automatically rejected to prevent replay or downgrade attacks. If the received counter value is higher, it is securely and irrevocably stored, preventing previously valid updates from being reapplied. This simple yet effective technique ensures that firmware states are only ever updated in a forward-facing manner.

[0038] After authentication and freshness validation, the firmware payload is decrypted. The decryption technique uses light symmetric block ciphers such as PRESENT, SIMON, or SPECK, configured in either counter (CTR) or cipher block chaining (CBC) mode. In the CTR configuration, the technique generates keystream blocks by encrypting incremental counter values ​​with the secret key. These keystream blocks are XORed with the ciphertext firmware payload to recover the firmware's plaintext. This approach allows block-level decryption without requiring the entire firmware to be stored in RAM, thus saving memory. In the CBC configuration, each ciphertext block is decrypted and XORed with the previous ciphertext block to recover the plaintext.To further optimize performance, the technology integrates hardware acceleration into the cryptographic coprocessor. This reduces the number of CPU cycles required per block and enables energy-efficient decryption of large firmware images.

[0039] After decryption is complete, the system initiates an incremental integrity check. Unlike traditional hash calculations, which require the entire firmware to be present in memory, the system uses a rolling hash approach. Each incoming firmware block is processed sequentially, and a hash digest is updated based on the result of the previous block. The rolling hash technique uses partial hash calculations, so only a small window of data needs to be stored at a time. This allows the device to validate firmware blocks in real time as they are written to secondary storage, thus avoiding memory congestion on devices with limited RAM. In another embodiment, a Merkle hash tree technique is used, where block-level hashes are recursively combined at intermediate nodes until a single root hash is obtained.The root hash is pre-calculated and digitally signed by the update server. By verifying the root hash, the device ensures that each individual firmware block has not been tampered with, while simultaneously reducing the computational effort required to re-verify the entire image.

[0040] The validated firmware is then written to a secondary partition in non-volatile memory. The dual-partition architecture ensures that the primary partition retains the last known working firmware while the secondary partition receives the new update. The memory management technique is designed for partition isolation, so data corruption in one partition does not affect the other. After the update process is complete, the system performs a final verification step, hashing the complete firmware image in the secondary partition and comparing it to the signed root hash or cumulative hash in the update metadata. If validation is successful, a bootloader controller automatically transfers execution control to the secondary partition upon the next reboot.If validation fails or the update process is interrupted by a power outage or communication error, the watchdog circuit resets the device and redirects execution back to the primary partition. This rollback technique prevents permanent bricking of the device and thus ensures continuous operation.

[0041] An extension of the system includes a differential update handler that reconstructs new firmware images from delta updates. The reconstruction technique applies binary patching operations to the firmware image stored in the primary partition, generating an updated candidate image. Each reconstructed segment undergoes rolling hash verification. Upon completion, the entire reconstructed image is validated using a cryptographic checksum provided by the update server. This technique enables the efficient distribution of updates in bandwidth-constrained networks, reduces the amount of data transferred, and ensures that the integrity of the reconstructed firmware is indistinguishable from that of a full image update.

[0042] The system also features a logging technique that ensures the traceability and forensic analysis of firmware update processes. Each update event generates metadata entries, including timestamps, firmware version, update status, signature verification results, and counter values. These entries are stored in a tamper-proof memory and cryptographically linked using a simple hash function. The linking technique combines the current log entry with the hash of the previous entry to create a new hash. Any attempt to modify a previous entry breaks the chain, making any tampering immediately detectable. This log serves as an immutable audit trail that can be accessed for compliance or diagnostic purposes.

[0043] To increase hardware resilience, the device architecture incorporates intrusion detection technology within a tamper-proof enclosure. Sensors inside the enclosure detect attempts at physical tampering, voltage manipulation, or invasive error injection. Upon detecting such anomalies, the system executes a key invalidation technique that deletes or invalidates cryptographic keys stored in secure memory, preventing the device from processing malicious firmware. This self-protection technology ensures that even physical attacks cannot lead to key exfiltration or unauthorized firmware installation.

[0044] In environments with limited power, the system integrates an energy-conscious allocation technique linked to a power harvesting subsystem. This technique monitors the availability of harvested power and prioritizes its use for computationally intensive processes such as digital signature verification or block decryption. During these periods, non-critical sensor or communication tasks can be temporarily suspended to ensure the successful completion of cryptographic processes. Through dynamic power redistribution, the technique guarantees that updates can be performed securely even on devices with limited or harvested power sources.

[0045] Upon receiving an update, the IoT device uses its secure update processing unit to verify metadata such as firmware version, timestamp, and device-specific identifiers. A simple digital signature verification process is performed in the cryptographic coprocessor to authenticate the firmware source. The system prevents replay attacks by integrating a monotonic nonce into the firmware metadata. The encrypted firmware payload is decrypted using pre-shared symmetric keys stored in tamper-proof, non-volatile memory. After authentication and decryption, the firmware image is deployed to a secondary storage partition. The device validates the image's integrity using rolling hash checks, which incrementally calculate block-wise hash values ​​to minimize RAM consumption.Upon successful validation, the device automatically switches the execution control to the updated firmware partition on the next restart. In case of an error, the device reverts to the original firmware partition to ensure operational continuity.

[0046] The device structure comprises a printed circuit board (PCB) housing the microcontroller unit, the lightweight cryptographic coprocessor, the secure memory module, and dual flash partitions for firmware storage. The coprocessor can be implemented as a dedicated ASIC or FPGA core within the device. The system also includes a watchdog circuit that monitors the update progress and resets the device in case of an error during the firmware update. A tamper-proof enclosure protects the hardware, preventing physical attacks on the cryptographic keys. The structure also incorporates a power harvesting subsystem, such as a solar- or vibration-based generator, which provides additional power for cryptographic operations without draining the primary battery.

[0047] In an industrial configuration, the system is integrated into a smart dispensing device or automated manufacturing control system, where frequent firmware updates are required to address vulnerabilities and enable new features. The device architecture ensures secure firmware updates without disrupting critical real-time machine operations. In another configuration, the device is integrated into a medical monitoring system. Firmware updates are validated using simple cryptographic signatures to ensure patient safety while maintaining energy-efficient operation suitable for portable medical devices.

[0048] The drawing and the preceding description show examples of embodiments. Those skilled in the art will recognize that one or more of the described elements can be combined to form a single functional element. Alternatively, certain elements can be divided into several functional elements. Elements of one embodiment can be added to another embodiment. For example, the sequence of the processes described here can be changed and is not limited to the manner described here. Furthermore, the actions of a flowchart need not be implemented in the sequence shown; nor does it necessarily have to be performed by all actions. Actions that are not dependent on other actions can also be performed in parallel with the other actions. The scope of the embodiments is in no way limited by these specific examples.Numerous variations are possible, whether explicitly stated in the specification or not, such as differences in structure, dimensions, and material use. The range of embodiments is at least as broad as specified in the following claims.

[0049] Advantages, further benefits, and problem solutions have been described above with reference to specific embodiments. However, the advantages, benefits, problem solutions, and all components that can lead to an advantage, benefit, or solution occurring or becoming more apparent are not to be construed as critical, necessary, or essential features or components of individual or all claims. REFERENCES 100 A Secure Firmware Update System in IoT Devices Using Lightweight Cryptographic Mechanisms. 102 Communication interface 104 Secure Update Processing Unit 104a Cryptographic Verification Processing Unit 106 Decryption module 108 Integrity Check Control Unit 110 Memory Management Unit

Claims

[1] A secure firmware update system in Internet of Things (IoT) devices using simple cryptographic mechanisms. The system includes: a communication interface configured to receive firmware update data packets from an update server over a wired or wireless network; a secure update processing unit that is operationally coupled with the communication interface, wherein the secure update processing unit comprises the following: a cryptographic verification processing unit configured to authenticate firmware update data packets using a simple digital signature scheme selected from hash-based signatures, restricted-environment optimized elliptic curve signatures, or message authentication codes (MACs) generated by block ciphers with reduced rounds; a decryption module configured to decrypt encrypted firmware payloads using light symmetric encryption techniques stored in secure non-volatile memory, with the decryption keys provided in a tamper-proof form; an integrity check control unit configured to perform rolling hash-based validation of decrypted firmware segments to ensure end-to-end update integrity while minimizing RAM usage; and a memory management unit configured to store the validated firmware payload in a secondary memory partition separate from a primary execution partition, thereby enabling atomic firmware switching and rollback protection. [2] System according to claim 1, wherein the processing unit for cryptographic verification is implemented in a dedicated cryptographic coprocessor or hardware accelerator integrated on a printed circuit board of the IoT device, wherein the coprocessor is configured to offload the main processor by performing simple signature verifications, hash calculations and decryption operations, thereby reducing power consumption and minimizing update latency. [3] System according to claim 1, wherein the memory management unit comprises a firmware memory structure with two partitions, each partition being configured as a physically isolated flash memory segment such that the primary partition retains the currently running firmware image while the secondary partition stores an incoming update image, and wherein a bootloader controller automatically switches execution control to the secondary partition after successful validation of the update, with the possibility of returning to the primary partition if validation fails. [4] System according to claim 1, wherein the secure update processing unit is configured to perform block-wise rolling hash calculations, such that each data block of the firmware update is individually validated before being stored in non-volatile memory, wherein the rolling hash implementation is optimized to reuse partial calculations from previous blocks, thereby reducing both the computational load and the need for volatile memory during the update process. [5] System according to claim 1, wherein the update validation mechanism is implemented by embedding a monotonic counter value in the metadata of the firmware update, wherein the counter is managed in a secure, uniquely programmable memory or equivalent non-volatile secure registers, such that the device rejects any firmware update whose counter value is less than or equal to the last stored value. [6] System according to claim 2, wherein the cryptographic coprocessor is implemented as an FPGA-based hardware module (Field-Programmable Gate Array) and further comprises an energy harvesting subsystem operationally coupled with the coprocessor, wherein the subsystem is configured to harvest ambient energy from sources such as solar radiation, mechanical vibration or RF energy and allocates the harvested energy specifically for performing cryptographic operations during firmware update procedures without discharging the primary device battery. [7] System according to claim 3, wherein the bootloader controller is configured with a watchdog circuit that continuously monitors the update process so that the device is automatically reset and returns to the stable firmware partition if an anomaly, interruption or power failure occurs during the installation of the update, thereby ensuring continuity of operation and preventing permanent device failure. [8] System according to claim 1, wherein the communication interface comprises a lightweight network stack configured for operation over restricted wireless networks, the network stack being adapted to segment large firmware updates into encrypted micropackets, each packet being independently authenticated and validated before reassembly within the device. [9] System according to claim 8, wherein the communication interface further comprises a fault-resistant reassembly protocol, the protocol being configured to buffer and rearrange firmware micropackets that are out of order using sequence identifiers and authentication tags, so that the integrity of the firmware is ensured even in networks with high packet loss or high latency.

Images