What is the best and easy way to verify a firmware in FOTA?

[MImda.1]

I am almost running out of limitations in my STM32L0 MCU as flash is divided into three sections.

bootloader+user application+ota firmware.

I have implemented a successful OTA at the moment. I am verifying the size of the OTA but I need to know if there is a quick and easy method to verify the OTA firmware before replacing the user application with it.

Thank you.

[Tesla DeLorean]

Sign the image with a CRC, or other checksum/hash, so that the loader can check its integrity.

Similarly the Loader should check the User application prior to jumping into it, and fall back into a safe/loader mode if the image is not intact.

[Piranha · Accepted solution]

The "best" is a rather non-specific description. And you need to verify what exactly?

https://security.stackexchange.com/a/93324

1. Integrity: CRC-32. Protects against inadvertent data corruption.
2. Authenticity: SHA-256. Protects against inadvertent and deliberate malicious data corruption.
3. Authentication: SHA-256 + ECDSA. The same as 2nd plus ensures the particular data source.

[MImda.1]

I got it. thank you. I think I should go with a CRC check. In the STM32WB OTA feature from STM32, they use a magic word method for verification purposes. In a known address, the address of the magic key is stored. then they read the magic key and verify it.

[Akuma.6]

Hi,

I am using STM32G0x MCU and would like to know the FOTA support using GSM network.

Can this be possible to upgrade the FW into the MCU dynamically?

Regards,

Kumar

[Tesla DeLorean]

All STM32 can be updated via code an methods the user provides for. Perhaps look at IAP methods/examples.

If you can stage the data locally, either via a QSPI memory, or file system within the modem, it will be less painful. Generally you'd want to validate or authenticate the entire image prior to starting the update process, that way there's less opportunity to fail mid-process. You'd also want a process that could be restarted.

With flow control one could pull a .HEX or .BIN file across from a HTTP/FTP server on the interwebs. Other methods might be practical depending on the support of Sockets, or Protocols on the modem.