Securing Over-The-Air IoT Firmware Updates using Blockchain

Abstract

Over-the-air (OTA) firmware updates are very common in IoT (Internet of Things) devices with wireless capabilities. Although they are convenient, they may also be open to attack since physical access may not be needed. In addition, most frameworks use a centralized architecture to update a potentially large number of devices increasing the threat landscape. An alternative solution, that relies on a blockchain framework with smart contracts, is proposed in this paper to protect the integrity of the firmware update process. The proposed system is suitable for use in smart cities or scenarios with a large number of devices and service providers where nodes are authenticated, communications protected, and update conditions specified and enforced through smart contracts. A proof--of--concept system was implemented and tested using an open--source blockchain framework and a WiFi--capabable ESP8266--based board. The system was evaluated for scalability and response to denial of service (DoS) and man--in--the--middle (MitM) attacks. Preliminary experimental results show that the approach is feasible and a viable substitute for a centralized solution.