Software Updates for the Internet of Things: An Extension and Evaluation of the SUIT Implementation in RIOT

Autor	Vera Clemens
Date	1. July 2021
Degree	Master
Topic	SUIT Based OTA Updates for RIOT
Title	Software Updates for the Internet of Things: An Extension and Evaluation of the SUIT Implementation in RIOT
Abstract	Firmware updates are essential for the secure operation of Internet of Things (IoT) devices, as several recent examples of uncovered security flaws in IoT device firmware show. Firmware update mechanisms must fulfil several requirements. Firstly, as IoT devices are constrained in terms of available computing power, memory, battery power, and network bandwidth, firmware update processes must be designed with special consideration to these constraints. Secondly, firmware update mechanisms must be secure; if they are not, they allow an attacker to exhaust the device’s resources through a Denial of Service (DoS) attack, block the installation of security patches, or even install arbitrary firmware. Thirdly, ease of use for the IoT device owner must be considered; ideally, it should be possible to install firmware updates without manual user intervention and they should cause minimal service downtime. The Software Updates for Internet of Things (SUIT) working group at the Internet Engineering Task Force (IETF) has published a draft for a standardized firmware update process that is designed to fulfil these requirements. SUIT has already been implemented for the IoT operating system RIOT using Constrained Application Protocol (CoAP) as the application layer protocol to transmit the update. In this work, we first analyse the requirements for secure software update mechanisms in the context of the IoT and provide a survey of existing mechanisms. We then design a new transport mechanism that uses MQTT For Sensor Networks (MQTT-SN) and extend RIOT’s implementation with it. Finally, we evaluate and compare the transport mechanisms MQTT-SN and CoAP in a realistic testbed environment with respect to their resource requirements (flash memory, RAM and energy consumption), network protocol overhead, total update duration, and their scalability, i.e. ability to update multiple devices in parallel.