Firmware Security: Testing & Certification of your Firmware Update Loader

Various evaluation and certification schemes exist, each with the objective to increase the assurance that components and systems implement adequate protection against cybersecurity attacks. However, a certification can only address attacks known as of today, with limited outlook into the future. When studying today’s certification schemes a common ground to mitigate this restriction can be identified: the requirement on the product to provide means to fix a security vulnerability at any time, even after successful certification. While this may sound like a contradiction to security certification on first glance, it is rather a reflection of what consumers are well-used to already: frequent patches distributed to our Personal Computers on well-scheduled, regular patch days.

Another observation that can be made comparing nowadays’ certification schemes is that they address the security of product- or industry-specific functionalities of the component or system, and add the requirement for a (secure) patch mechanism.

However, reality is often different, especially when considering embedded devices such as Integrated Circuits (ICs) or System-on-Chips (SoCs). Here, in contrast to pure software development, processing time for wafer production and wafer testing become a decisive factor, and often build the bottleneck for time-to-market considerations. Therefore, it is beneficial to pull-in these time-consuming steps, and have a solution-agnostic, general purpose hardware, paired with a general purpose firmware loader, at hands even before solution-specific firmware development begins. At the same time decoupling these steps simplifies logistics at the manufacturers’ side, too.

To address this industry approach, the Firmware Update Evaluation Concept from TÜVIT introduced here assesses solely the patch or firmware update mechanism independently of the functionalities the component or system will eventually be used for.

Certification by TÜVIT provides proof of trust and security to business partners and customers, even though – or especially when – the ultimate use case has not yet been determined.

Absolutely! After a design and code review, the concept provides for penetration tests. If the TÜVIT experts discover weak points already in this phase, these are addressed to the manufacturer. In this way, both the product and the chances of successful certification can be improved.

The certificate is valid for two years.

Yes, in particular there is the possibility to adjust the evaluation depth, and thus the time and cost of the audit, to the expected attack potential. Further details on this can be found in the certification concept.

Basically yes. A secure firmware loader is the basis of every secure IT product. Certification methodologies such as Common Criteria or IEC 62443 therefore justifiably demand a security check of these functionalities. Therefore, when developing the set of criteria, we paid special attention to the possibility of reuse for a wide variety of use cases.