Secure boot and secure OTA updates

Secure boot: the chain of trust

Each stage verifies the next before handing over control.

1. 01

   Root of trust

   Immutable boot code or a hardware security feature holds the first verification key.

2. 02

   Bootloader

   Verifies the signature of the firmware image before starting it.

3. 03

   Application

   Runs only after verification; debug access is locked in production.

Secure OTA updates

• Images signed with keys stored in a controlled environment
• Signature and version checks on the device before installation
• A/B slots or recovery mode for safe rollback after a failed update
• Protection against downgrading to vulnerable versions

Platform examples

Implementation details depend on the platform's security features. On STM32 and Nordic nRF devices we use the vendor's secure boot options where available; on Embedded Linux the bootloader and update framework carry the chain of trust.