![](bg8.png)
tack and defense trees. This results in quantitative
analysis techniques using tools such as Uppaal (Ku-
mar and Stoelinga, 2017) or PRISM (Aslanyan et al.,
2016). In our work, we identified threats and coun-
termeasures but did not organise them in a systematic
attack-defense tree. This could be another comple-
mentary approach to analyse the system security.
6 CONCLUSION AND NEXT
STEPS
In this work, we reviewed a representative sample of
firmware update protocols and identified how they can
cope with security requirements and related attacks.
We highlighted the need of a more formal verifica-
tion approach. We proposed a partial modelling of
the UpKit protocol and could successfully verify key
integrity and freshness properties. Although partial
and anchored in a specific protocol, our results so far
show several commonalities and the modelling and
verification approach can be generalised to most pro-
tocols and security properties. The sketched approach
can also be used to verify security properties on the
MQTT or Uptane protocols. The distributed nature of
the blockchain design requires specific techniques to
get security assurance. They can however be captured
by assumptions to carry out proofs on the interaction
between the device and the blockchain.
In the next steps of our research, we plan to cover
the lasts steps of the UpKit protocol and then to model
the more complex Uptane protocol, including mul-
tiple roles with related keys, secondary ECUs and
the use of a timeserver. We also plan to investigate
more deeply the blockchain-based designs and to bet-
ter structure security requirements, attacks and design
countermeasures using an attack-defense tree.
REFERENCES
Acosta Padilla, F. J. et al. (2016). The Future of IoT Soft-
ware Must be Updated. In IAB Workshop on Internet
of Things Software Update (IoTSU). Internet Archi-
tecture Board (IAB).
Aslanyan, Z., Nielson, F., and Parker, D. (2016). Quanti-
tative verification and synthesis of attack-defence sce-
narios. In Proc. 29th IEEE Computer Security Foun-
dations Symposium (CSF’16), pages 105–119. IEEE.
Asokan, N. et al. (2018). Assured: Architecture for secure
software update of realistic embedded devices. IEEE
Transactions on Computer-Aided Design of Integrated
Circuits and Systems, 37(11).
AWS (2020). FreeRTOS User Guide. https://docs.aws.
amazon.com/freertos/latest/userguide.
Basin, D., Cremers, C., Dreier, J., and Sasse, R. (2017).
Symbolically Analyzing Security Protocols Using
Tamarin. ACM SIGLOG News, 4(4):19–30.
Blanchet, B., Abadi, M., and Fournet, C. (2005). Auto-
mated verification of selected equivalences for secu-
rity protocols. In 20th Annual IEEE Symposium on
Logic in Computer Science (LICS’ 05), pages 331–
340.
Dolev, D. and Yao, A. (1983). On the security of public key
protocols. IEEE Transactions on Information Theory,
29(2):198–208.
Galibus, T. (2019). Securing software updates for trains.
In Critical Information Infrastructures Security - 14th
International Conference, CRITIS 2019, Link
¨
oping,
Sweden, Sept. 23-25,, volume 11777, pages 137–148.
Springer.
Gartner (2019). IoT endpoints 2020: the industries and
use cases driving growth. https://www.i-scoop.eu/
internet-of-things-guide/iot-endpoints-2020.
Grisham, P. S., Chen, C. L., Khurshid, S., and Perry, D. E.
Validation of a security model with the alloy analyzer.
Hong, D. (2020). On decentralized clocks: How time be-
came the biggest security threat on blockchain sys-
tems. https://unifiedh.medium.com.
Iansiti, M. and Lakhani, K. R. (2017). The Truth About
Blockchain. Harvard Business Review https://hbr.org/
2017/01/the-truth-about-blockchain.
Kim, J. Y., Holz, R., Hu, W., and Jha, S. (2017). Auto-
mated analysis of secure internet of things protocols.
In Proc. of the 33rd Annual Computer Security Appli-
cations Conference, ACSAC 2017, page 238–249.
Kumar, R. and Stoelinga, M. (2017). Quantitative security
and safety analysis with attack-fault trees. In 2017
IEEE 18th International Symposium on High Assur-
ance Systems Engineering (HASE).
Kuppusamy, T. K., DeLong, L. A., and Cappos, J. (2018).
Uptane: Security and customizability of software up-
dates for vehicles. IEEE Vehicular Technology Maga-
zine, 13(1):66–73.
Langiu, A., Boano, C. A., Schuß, M., and R
¨
omer, K.
(2019). Upkit: An open-source, portable, and
lightweight update framework for constrained iot de-
vices. In IEEE 39th Int. Conference on Distributed
Computing Systems (ICDCS), pages 2101–2112.
Lee, B. and Lee, J.-H. (2017). Blockchain-based se-
cure firmware update for embedded devices in an
internet of things environment. J. Supercomput.,
73(3):1152–1167.
Legay, A. et al. (2019). Statistical Model Checking, pages
478–504. Springer International Publishing, Cham.
Lo, N.-W. and Hsu, S.-H. (2019). A secure iot firmware
update framework based on mqtt protocol. In Proc.
of 40th Anniversary Int. Conf. on Information Systems
Architecture and Technology – ISAT 2019, pages 187–
198.
Mtetwa, N. S., Tarwireyi, P., Abu-Mahfouz, A. M., and Adi-
gun, M. O. (2019). Secure firmware updates in the
internet of things: A survey. In International Multi-
disciplinary Information Technology and Engineering
Conference (IMITEC), pages 1–7.
Towards Formal Security Verification of Over-the-Air Update Protocol: Requirements, Survey and UpKit Case Study
807