Join the early list

Over-the-air updates

Devices need software updates after they ship, and a failed update must not break the device. A/B slots and rollback handle both.

Core

Read firstSecure boot and the root of trust
An A/B update with a trial boot and fallback A new image is checked for a valid signature, written to the inactive slot and booted on trial. If it passes a health check it is made permanent; if not, the device falls back to the old slot. New image downloaded Check signature genuine, unchanged? Write image to the inactive slot Boot it on trial Health check fails Fall back to the old slot passes Make it permanent Two copies on the device Active slot the current image Inactive slot the new image is written here A signature check shows the update is genuine; encrypting the download alone does not prove who built it. Open-source frameworks for embedded Linux: Mender, RAUC, SWUpdate. On microcontrollers, MCUboot is a widely used secure bootloader with image swapping and rollback.
An A/B update writes the new image to the inactive slot, boots it on trial and keeps it only if a health check passes; otherwise the device falls back to the old slot.

Key points

  1. A/B (dual-copy) updates write the new image to the inactive slot, boot it on trial, and make it permanent only after it passes a health check, falling back to the old slot if it does not.12
  2. Open-source update frameworks for embedded Linux include Mender, RAUC and SWUpdate; on microcontrollers, MCUboot is a widely used secure bootloader that supports image swapping and rollback.1234
  3. A device must check that an update is genuine and unchanged before installing it, usually by verifying a digital signature on the image. Encrypting the download alone does not prove who built it.54

Where to go next

Sources

  1. Mender documentation: Introduction · Northern.tech (Mender) · Project docs
  2. RAUC: Basic concepts · RAUC project · Project docs
  3. SWUpdate: Update strategy examples · SWUpdate project · Project docs
  4. MCUboot: Bootloader design · MCUboot project (Linaro) · Project docs
  5. ETSI EN 303 645 V3.1.3 (2024-09): Cyber Security for Consumer Internet of Things: Baseline Requirements · ETSI · Standard