Centralized Management of BLE-BasedOTA Firmware Updates : Design and Prototype Implementation

Sammanfattning

As the number of connected embedded devices continues to grow, the need for secure andefficient firmware-over-the-air (FoTA) updates becomes increasingly important. This thesispresents the design and prototype implementation of a centralized OTA firmware updatesystem for resource-constrained BLE-based devices, with a particular focus on the STM32WB55microcontroller. The system integrates a cloud-hosted MQTT infrastructure, secure TLS 1.3communication, and an Android application that acts as a bridge between the back-end and theembedded device, enabling push-based firmware updates over BLE.Security considerations are central to the system architecture. TLS-secure MQTT channels,token-based session authentication, and role-based access control (RBAC) are implemented toprotect communication and restrict unauthorized firmware access. Although the currentbootloader lacks cryptographic integrity verification, structural validation ensures basicfirmware integrity, and future improvements are proposed to address this gap.Functional and security evaluations demonstrate that the system performs reliable segmentedfirmware transfers, recovers from interruptions such as power loss or app crashes, and resistsman-in-the-middle and token hijacking attacks. Limitations related to BLE stability, firmwarevalidation, and platform generalizability are identified and discussed. The resulting prototypeprovides a practical foundation for secure, reuseable, and maintainable FoTA solutions inconstrained embedded environments.