Secure OTA updates: secure boot, signing and rollback

The Cyber Resilience Act requires manufacturers to fix vulnerabilities and provide security updates throughout the support period. For embedded products installed at customer sites, that means a reliable and secure over-the-air (OTA) update chain.

1. Secure boot

Secure boot verifies, at every start-up, the signature of each software stage (bootloader, kernel, system). It creates a chain of trust anchored in hardware: modified software does not boot.

2. Signed updates

Each update package is signed by the manufacturer; the device checks the signature before installing. The private signing key is protected (ideally in a hardware module) and its use is logged.

3. Being able to roll back

An interrupted or faulty update must not brick the device. Dual-partition (A/B) schemes install the new version alongside the old one and switch only after a successful boot.

4. Blocking malicious downgrades

Conversely, an attacker must not be able to reinstall an old vulnerable version: anti-rollback protection (a version counter) prevents it.

5. Linking updates to the SBOM

Each shipped version has its SBOM: that is how you know which devices need updating when a vulnerability is published.

These architecture choices are hard to retrofit: better to validate them early, in a CRA gap analysis of the product.

Information current as of 29 September 2026. Regulations and timelines change: this article is not legal advice.