Why Secure OTA Firmware Updates Matter

Firmware updating has become a standard component in any product. A viable OTA solution gives manufacturers the flexibility to react fast to unforeseen events after the product has been deployed, such as security issues, problems with reliability, incompatibility with wireless standards, or customer requests.

When updates are impossible, the available solutions count on USB programming, technician assistance, SD cards, device exchange, among others. This is a cumbersome process and increases the difficulty of managing hundreds or thousands of devices.

A good secure OTA firmware update solution allows product teams to:

  • Implement bug fixes and deliver performance improvements remotely
  • Remediate security flaws before being exploited
  • Deploy new functions without redesigning the hardware
  • Handle different hardware and firmware versions
  • Lower the cost of field-service operations and device downtime
  • Keep an update history available for auditing purposes
  • Recover from unsuccessful or interrupted updates

For devices sensitive to security issues, the firmware update method can be a weak point, leading to hacker attacks. Consequently, the focus of our technology is on firmware authenticity, integrity; and confidentiality when this is warranted.

Case Study: Secure OTA Foundation for a European Smart Lock Platform

Secure OTA firmware for smart locks
Phase 01 · Client

Client and Platform Context

Client: Plento Trading ApS, Denmark
Product: Zafe Connect Multi-Brand Smart Lock Platform

Adequate Infosoft delivered embedded and connected-product engineering for Plento Trading ApS, a Denmark-based smart security company operating through its Zafe Connect platform. The product ecosystem required reliable management of smart locks across property-management environments where access, security, device availability, and remote operations directly affect guests and building operators.

The platform was supposed to accommodate multiple smart-lock processes that included mobile access, time-sensitive passcodes, remote locking, access automation due to reservation-making, and alarm integrated process.

Phase 02 · Architecture

Secure Bootloader and OTA-Ready Firmware

When the various installations across Europe took place, it was time to approach firmware life cycle planning. A lock device cannot simply cease functioning because of the updates, and the way updates are handled might lead to the risk of physical security.

Our engineering approach incorporated a secure bootloader and OTA-ready firmware architecture for supported lock hardware. The bootloader was responsible for validating firmware integrity before handover to the primary application.

Firmware images were prepared with version metadata, checksum validation, and cryptographic verification requirements so the device could reject corrupted or unauthorized update packages.

The architecture also considered the practical constraints of battery-powered connected locks. Firmware transfer must be efficient, resilient to intermittent connectivity, and designed around safe reboot behaviour.

In designing the update process, we ensured that a partial package cannot overwrite the version of the application operating at that time. The lock should hold the last working version of the firmware till it receives and authenticates the new version completely.

Phase 03 · Outcome

Platform Outcome and Scale

The bigger Zafe Connect platform included mobile applications, cloud connectivity services, integrations with smart locks, booking flows, and Ajax alarms. This allowed property managers to manage access to properties through one system instead of using separate systems and distributing physical keys.

The public project outcome demonstrates the scale required from the platform: Zafe Connect manages more than 25,000 smart locks for over 1,500 active property managers across Denmark, Germany, and France. The platform also reduced check-in time by 90 percent by replacing many physical handovers with digital access workflows.

The project demonstrates the discipline involved in the secure development of over-the-air firmware. Rather than considering the bootloader in isolation, it is seen as part of a complete product lifecycle that includes secure firmware release, compatibility verification, recovery strategies, cloud connectivity, mobile integration, product monitoring, and ongoing product support.

Zafe Connect on the App Store
Zafe Connect on Google Play

Relevant Delivered Projects That Strengthen Our OTA and Bootloader Expertise

Our team has delivered connected products where firmware security, remote management, reliable device operation, and production-readiness are practical requirements rather than theoretical features.

Nordic nRF52 BLE Smart Lock Access Control System
Smart Lock

Nordic nRF52 BLE Smart Lock Access Control System

This smart-lock project included nRF52-based embedded firmware, BLE communication, RFID and fingerprint access workflows, secure credential handling, encrypted commands, and secure bootloader support for OTA updates. It demonstrates our experience with battery-powered access-control devices where a reliable recovery path and firmware trust are essential.

Read the smart lock case study
Smart Industrial Vibration Monitoring System Using NXP i.MX RT1060
Industrial Monitoring

Smart Industrial Vibration Monitoring System Using NXP i.MX RT1060

For an industrial predictive-maintenance solution, Adequate Infosoft developed the device, firmware, cloud platform, and monitoring workflows. The project included secure boot and OTA update capability to support the trusted lifetime of industrial assets deployed at scale.

Read the vibration monitoring case study
Silicon Labs EFR32 Wireless Industrial IoT Sensor
Industrial IoT

Silicon Labs EFR32 Wireless Industrial IoT Sensor

This industrial wireless sensor project combined EFR32 firmware with BLE, Zigbee, Thread, cloud integration, remote telemetry, and OTA update capabilities. It shows our experience in designing device software that can evolve after installation without interrupting industrial operations.

Read the EFR32 sensor case study
AI-Powered Smart Camera with Firmware and Bootloader Updates
Smart Camera

AI-Powered Smart Camera with Firmware and Bootloader Updates

This complete camera solution was built using NXP i.MX RT1060 firmware, featuring edge AI processing, PLC integration, MQTT telemetry, diagnostics, and Ethernet-based OTA updates for firmware, bootloader, and AI model upgrades. It is applicable in complicated devices that require controlled updates among several software components.

Read the AI camera case study

Our Custom Bootloader Development Services

Each type of embedded device requires its own level of memory, connectivity, power, compliance, and security. While generic bootloaders can be used successfully for proof of concept, devices that are ready for production usually require a bootloader unique to the product.

We create lightweight bootloaders customized for each device's flash structure and operation. Depending on the product in question, the bootloader can allow wired update methods over USB, UART, CAN, RS-485, Ethernet, SWD recovery or wireless methods using BLE, Wi-Fi, cellular networks, Thread, Zigbee, LoRaWAN or any proprietary radio protocol.

Secure Boot and Firmware Authentication

The process of validating whether the firmware is legitimate is secure boot. The secure boot process is accomplished using various encryption techniques like ECDSA, RSA, and SHA-256 for verification of image integrity.

It is the bootloader that authenticates the firmware image by using a public key kept in secure memory. Only the firmware that production companies have signed with the recognized private signing key will run on the device, thus ensuring that unrecognized or tampered firmware cannot be installed on the device, no matter how much the hacker tries to access the update channel.

Where the MCU supports it, we use hardware-backed security features including secure key storage, readout protection, TrustZone, one-time programmable memory, secure debug configuration, and hardware cryptographic acceleration.

A/B Firmware Images and Safe Rollback

An OTA update must not make a device unusable if the battery dies, network disconnects, or power is removed during installation. To address this, we can implement dual-bank or A/B firmware architecture.

The operational firmware runs from one memory area while a newer version of the firmware is being loaded into another memory area.

The bootloader checks the new firmware for validity and after having successfully rebooted, it waits for the health status to be confirmed. If the new firmware fails boot or self-tests, the system resets back to the last known working firmware version.

For smaller MCUs with limited flash memory, we can design swap-based update mechanisms using external flash, staging areas, compression, delta updates, or carefully managed single-bank recovery flows.

Firmware Encryption and Anti-Rollback Protection

Digital signatures serve to account for the individual responsible for the creation of firmware as well as the ability to ascertain its integrity.

In the case of devices whose firmware is protected by IP, safety, and security rules, it is possible to design firmware images encrypted with AES technologies, as well as to use key management solutions in the process of manufacturing and provisioning.

In addition, our solutions are provided with anti-rollback features that inhibit an attacker from reloading an older firmware version that contains a known vulnerability.

Secure OTA Firmware Architecture

A complete OTA solution includes more than device code. It requires a reliable relationship between the embedded device, cloud platform, mobile app or gateway, and operations team.

Our OTA firmware architecture typically includes:

  • Bootloader with secure boot and image validation
  • Main application firmware with OTA client logic
  • Firmware packaging and signing process
  • Release versioning and hardware compatibility rules
  • Cloud storage for firmware images and metadata
  • Secure API or MQTT-based update notifications
  • Download resume support for unstable networks
  • Device-side progress reporting and error logs
  • Fleet dashboards for rollout monitoring
  • Staged deployment, rollback, and release control

For instance, one may first deploy an update to a new version to an internal device, later to five percent of the production devices, and ultimately to the entire fleet once performance checks are successful. This strategy minimizes consequences on operations while giving greater insight to the team before widespread rollout.

The approach helps integrate Over-The-Air (OTA) workflows with numerous robust platforms such as AWS IoT Core, Azure IoT Hub, Firebase, third-party .NET/Node.js backends, MQTT brokers, REST APIs, and mobile apps. The innovation is anchored on existing connectivity capabilities, enabling the devices to pick their preferred cloud.

Development Process for Reliable Firmware Updates

The very first thing in our development process is to do the architecture review of all essential MCU components, present firmware, connection mechanisms, power requirements, fleet size, and security requirements.

In terms of flash partitioning, application slots, firmware signature, rollback flags, and recovery mechanisms are defined to deal with failed operations like power loss, corrupted downloads, disconnected gateways, or inappropriate hardware.

The engineers develop the bootloader, OTA update programs, firmware signing procedures, and the system for release management from the cloud.

Testing procedures will include cases with connection problems, forced resets, low battery conditions, wrong signing, corrupted firmware images, and rollback procedures.

Before production, we support factory programming, key provisioning, device registration, firmware version tracking, and technical documentation for manufacturing and support teams.

Build a Firmware Update System That Protects Your Product

An OTA firmware system that is secure should be designed early in the product development process — rather than being tacked on as an afterthought after deployment of devices. This architecture potentially minimizes long-term support costs, leads to improved security response times, and gives your product team the confidence to steadily enhance devices in their life span.

Adequate Infosoft helps them design custom bootloaders, secure firmware update workflows, OTA cloud integration, firmware signing pipelines, device recovery mechanisms, and scalable fleet-management capabilities.

Whether you are building a new IoT product or improving an existing embedded device, our team can create a secure, maintainable firmware update foundation for production deployment.

Ashok Patel
Ashok Patel
Senior Engineering Project Manager
AI/ML, DevOps, Data Science & Automation | IoT & C#/.NET | Azure & AWS Expert | Certified AI & Cloud Engineer | 1,500+ LinkedIn Followers
Facebook LinkedIn Stack Overflow nRF9151 NB-IoT / NTN Satellite Development