Firmware updates over the air
using	LoRaWAN
Jan	Jongboom	
The	Things	Conference	
1	February	2018
©	2018	Arm	Limited	2 ©	2018	Arm	Limited
©	2018	Arm	Limited	3
IoT	deployments	target	10	years	lifetime
But 10 years is a really long time!
https://www.buzzfeed.com/norbertobriceno/gimme-a-hell-yeah?utm_term=.xcKNDnloB#.rxa8VOlkm
©	2018	Arm	Limited
https://boygeniusreport.files.wordpress.com/2016/04/iphone-2g-1st-generation-jobs.jpg?quality=98&strip=all
©	2018	Arm	Limited
©	2018	Arm	Limited	6
©	2018	Arm	Limited	7
During	the	lifetime	of	a	device...
Devices	get	a	specific	purpose		
Requirements	change	
Standards	change	
Vulnerabilities	are	found
©	2018	Arm	Limited	©	2018	Arm	Limited	
How	to
©	2018	Arm	Limited	9
Naive	approach
TX RX TX RX TX RX
Firmware	fragment
Very	inefficient!
Device 1
TX RX TX RX TX RX
Device 2
©	2018	Arm	Limited	10
Better	approach
RX
Many	firmware	fragments
Device 1
Device 2
RX
Device N
RX
©	2018	Arm	Limited	11
But...	how	do	we	do	this?
1. Instruct	devices	to	use	a	new	set	of	keys	(same	for	everyone).	
2. Instruct	devices	to	wake	up	at	the	same	time.	
3. Gateway	can	transmit	to	all	devices	with	one	message.	
Problem:	low	QoS	and	uni-directional
©	2018	Arm	Limited	12
Setting	up	the	device
Device	Address:	0xCF32AB09	
Multicast	Key:		9310E28FA291...
©	2018	Arm	Limited	13
Setting	up	the	device
Packet	size:			204	bytes	
Packet	count:		491	
Padding:							16	bytes
©	2018	Arm	Limited	14
Starting	multicast	session
Frequency:						924.525	MHz	
Data	rate:						220	bytes	/	sec	
Time	to	start:		812	sec	after	UL	event	13
ULCounter	|	RTC	
----------------	
15								|	781	
14								|	704	
13								|	623	
12								|	491	
...
©	2018	Arm	Limited	15
Dealing	with	low	QoS
CRC	hash	of	firmware	
(sent	with	device's	own	credentials)
OK!
©	2018	Arm	Limited	16
Dealing	with	low	QoS
CRC	hash	of	firmware	
(sent	with	device's	own	credentials)
OK!
Forward	error	correction
http://www.inference.phy.cam.ac.uk/mackay/gallager/papers/ldpc.pdf
©	2018	Arm	Limited	17
Speed
220	bytes	per	second	on	SF9	125	KHz	
30KB	Typical	patch	size	
Transmission	costs	2m30s	(ideally)	@	10mA	current
https://www.reddit.com/r/Eyebleach/comments/68r4rt/tortoise_taxi/
©	2018	Arm	Limited	©	2018	Arm	Limited	
In	real	life
http://www.totalprosports.com/wp-content/uploads/2013/04/first-pitch-fail-baseball-fail-gifs.gif
©	2018	Arm	Limited	19
Gateway	selection
Plan	updates	in	advance,	reserve	slot	on	the	

Network	Server

Gateway	selection	strategies,	combination	possible:	
1. Use	highest	data	rate	
2. Round-robin	between	gateways	
3. Drive	over	to	site	and	deploy	temporary	gateway
©	2018	Arm	Limited	20
Gateway	selection
Use	highest	data	rate	
Limits	number	of	devices	that	gets	covered	by	one	gateway	
But:	higher	capacity	on	gateway	

(less	channel	utilization)	
And:	highest	throughput
©	2018	Arm	Limited	21
Gateway	selection
Round-robin	between	gateways	
Define	group	of	devices	that	are	covered	by	the	same	set	
of	gateways	
Downlink	scheduling	round	robin	across	gateways	
May	result	in	higher	packet	loss	on	specific	gateway-device	
links	
But:	higher	capacity	per	gateway	(less	channel	utilization)
©	2018	Arm	Limited	22
Gateway	selection
Temporary	gateway	
Dedicated	to	firmware	update	
Expensive,	but	cheaper	than	replacing	the	device	or	
performing	a	manual	per-device	update	through	cable	
(if	even	available)
©	2018	Arm	Limited	23
Spectrum	usage
US:	use	dedicated	band	
EU:	869.525	MHz	has	10%	duty	cycle	
Duty	cycle	is	measured	per	hour
©	2018	Arm	Limited	©	2018	Arm	Limited	
Device	

requirements
Picture	by	Yuri	Samoilov	https://www.flickr.com/photos/yusamoilov/13334048894
©	2018	Arm	Limited	25
Link	layer	security	is	not	enough
Firmware manifest
Contains	firmware	hash	
Contains	manufacturer	and	device	class	ID	
Signed	with	private	key	(held	by	OEM)
©	2018	Arm	Limited	26
Update	flow
Device
Network	/	
App	server
Update	
Server
OEM
Device	
Owner
Private	KeyPublic	Key
Signs	update
Schedules	update
Adds	error	correction	
Selects	frequency,	gateways,	data	rate	
Schedules	instructions	for	device	(through	NS)	
Calculates	hash
Delivers	update
Verifies	update	signature	
Applies	delta	update	
Reboots	&	flashes
Firmware	hash
©	2018	Arm	Limited	27
Components	required
Bootloader
Asymmetric	crypto
Storage	driver
Resilient	filesystem
Advanced	

LoRaWAN	stack
Radio	drivers
FlashIAP
Update	client
©	2018	Arm	Limited	27
Components	required
Bootloader
Asymmetric	crypto
Storage	driver
Resilient	filesystem
Advanced	

LoRaWAN	stack
Radio	drivers
FlashIAP
Update	client
©	2018	Arm	Limited	©	2018	Arm	Limited	
Mbed	OS	5
140	development	boards	supported	
Certified	LoRaWAN	stack	in	Mbed	OS	5.8	
Bootloader,	update	client	and	crypto	out	of	the	box	
Runs	on	32K	RAM	incl.	RTOS	
Apache	2.0	licensed
©	2018	Arm	Limited	29
Current	state
Multicast	and	data	fragmentation	close	to	
standardization	
Reference	implementation	by	Arm	+	TTN	
https://github.com/armmbed/lorawan-fota-demo/	
Workshop	at	13:30!
©	2018	Arm	Limited
©	2018	Arm	Limited	
Google:	"firmware	updates	lorawan"
https://www.youtube.com/watch?v=0NoshDOqmdM
©	2018	Arm	Limited	31
hnp://janjongboom.com
Thank	you!

Firmware updates over the air using LoRaWAN - The Things Conference 2018