MLS/160A – System Reference
D o c u m e n t R e v i s i o n 1 . 1
11
4.2
Secure Device Update (SDU)
The secure device update function allows the secure remote update of the MLS/160A’s
firmware. Therefore it uses the
A/B boot concept
(please see
chapter 4.1
).
To run a secure device update the
SDU app
must be installed on the remote station, e.g.
the remote maintenance gateway RMG/941. The SDU app contains an
SDU agent
, which
connects with the
SDU device driver
of the MLS/160A.
Figure 5:
Diagram of the Secure Device Update
Update Process
The update process follows these steps:
•
Invalidating
the inactive slot by setting its magic number from "RIOT" to "0000".
•
Writing the new header and firmware excluding the magic number into the inactive
slot. The slot remains invalid because its magic number is still "0000".
•
Verifying the written slot by an SHA256 HMAC (Keyed-Hash Message Authentica-
tion Code).
If the
HMAC is valid
, the magic number is set back to "RIOT" and the slot is valid
again and ready to boot.
If the
HMAC is invalid
, the magic number is not changed and the slot remains inva-
lid.
•
Resetting the MLS/160A and checking if the slots are valid. If both slots are valid,
the slot with the higher version number is used, which should be the updated one.
Please refer to
chapter 5.3
for a detailed description of the update process.
