ZT-OTA Software Update Framework for IoT Devices
Nobuo AOKI, Atsuko Takefusa, Yutaka Ishikawa, Yasushi ONO, Eisaku Sakane, Kento Aida · IEICE Transactions on Information and Systems · 2025
Internet of Things (IoT) is widely used as a fundamental technology for realizing various services. An IoT-based service system comprising cloud servers and many IoT devices connected via networks may be risky owing to the possibility of the entire system being be affected by cyberattacks on an IoT device. Moreover, new software vulnerabilities are frequently reported. From the perspective of security, IoT device software must be reliable and resilient. Consequently, a secure software update mechanism for IoT, assuring software reliability, and mitigation mechanisms are required. Overall, this study proposes a zero-trust over-the-air (ZT-OTA) software update framework for the reliable and resilient software update management of IoT devices via OTA software updates from remote locations. The ZT-OTA update software framework provides a strict software version-management mechanism that enhances the security of software updates. Further, the proposed framework collaborates with a Software Assessment Service (SAS) as an authorized third-party assessment organization and deploys reliable software assessed by the SAS to IoT devices. Upon discovering a software vulnerability following the deployment of the software, the SAS proactively revokes the assessment result of the vulnerable software.Subsequently, the ZT-OTA server notifies developers and users of IoT devices to arrange for new software that must be fixed, and updates reliable software invoking policies for IoT devices, which can minimize privileges. This study presents the design and implementation of the ZT-OTA software update framework and demonstrates its feasibility.