Application of Security Update Mechanism SUM in 4G Wireless Routers

The Secure Update Mechanism (SUM) is a system and process that ensures device software can securely and reliably receive and install updates. The core of this mechanism is to ensure that these update packages are genuine, untampered, and can be efficiently installed.

▶ The SUM mechanism primarily includes the following aspects:

SUM-1: Applicability of update mechanisms

• The SUM mechanism determines which software parts in a device affect its security assets or privacy assets (e.g., Wi-Fi passwords, user data), and these parts must be updatable. For most network devices, all software parts should be designed to be updatable. However, there are some exceptions: for example, if a software part involves functional safety (e.g., industrial equipments control, where arbitrary updates might cause danger), or if it is immutable (e.g., using read-only memory), or if other physical or logical security measures already protect it, then an update mechanism might not be needed or a different approach might be used.

SUM-2: Secure updates

SUM-2 ensures that software updates have integrity and authenticity at the time of installation.

• Authenticity: Update files must genuinely come from the device’s authorized manufacturer or vendor. This is typically achieved by verifying the firmware’s digital signature using the manufacturer’s root certificate. If the signature does not match, the device will refuse to install the update, preventing malicious software or counterfeit updates from infiltrating.
• Integrity: Update files must not be maliciously altered or corrupted during transmission. This is typically verified by encrypting the hash value of the firmware using the manufacturer’s private key. Additionally, the update process can be performed via secure communication mechanisms, and only authorized users can initiate updates.

SUM-3: Automated updates

SUM-3 defines how updates can be delivered and installed to ensure timeliness and user convenience.

• Automated updates without human intervention: Devices can automatically download and install updates in the background, for example, during periods of low user activity, without requiring manual user operation. This is particularly crucial for critical security patches, enabling rapid defense against new threats.
• Scheduled or triggered updates with human approval: Devices can notify users that new updates are available and provide options for users to choose when to install them (e.g., install immediately or schedule for a specific time).
• Roll-back policy: When there is sufficient storage space in device, a good practice is to have the capability to roll back to the previous stable software version if an update installation fails, to prevent the device from becoming “bricked” or malfunctioning.

▶ Application example of the SUM mechanism in a 4G wireless router

SUM-1 (Applicability)：

• The firmware of a 4G wireless router is its core software, responsible for handling network connections, Wi-Fi broadcasting, data encryption, user authentication, and other functions. These software components directly impact the router’s network assets (such as network configuration, connected device information) and security assets (such as administrator passwords, Wi-Fi keys, and user data). Therefore, in accordance with the requirements of SUM-1, all parts of this firmware must be designed to be updatable so that security vulnerabilities can be promptly patched when discovered. For instance, if the router’s web management interface code has a vulnerability, an update is needed to fix it.

SUM-2 (Secure updates)：

When the manufacturer releases a new firmware version to fix a security vulnerability:

• Digital signature verification: When downloading a new firmware file, the router will not install it directly. It will first verify whether the firmware file contains the manufacturer’s valid digital signature. If the signature verification fails (e.g., the file has been tampered with or comes from an unofficial source), the router will refuse to install it, thereby preventing attackers from uploading malicious fake firmware to control the router or steal data.
• Integrity check: In addition to the signature, the router will also perform an integrity check on the downloaded firmware file (e.g., calculating the file’s hash value and comparing it with the known hash value provided by the manufacturer). This ensures that the firmware file has not undergone any errors or malicious modifications during its transmission from the server to the router’s local storage.
• Secure communication channel: Firmware update files are typically transmitted from the manufacturer’s server to the router via encrypted communication protocols (such as HTTPS). This prevents data from being intercepted or tampered with by “man-in-the-middle” attacks during transmission.
• Access control: Even when manually uploading the firmware through the router’s web management interface, the router will require the administrator password for authentication, ensuring that only authorized users can initiate the update operation.

SUM-3 (Automated updates)：

To ensure the router is always protected by the latest security:

• Automatic silent updates: Routers are typically configured to automatically check for and download security updates during low-usage periods, such as at night. For urgent security patches, it may even automatically install them without any intervention. For example, when a zero-day vulnerability affecting the router is detected, the manufacturer can push mandatory automatic updates to quickly protect users.
• User notification and approval: For some non-urgent updates or those that may require a restart, the router may use LEDs or send notifications on the web management interface, providing options to “install now” or “schedule installation for a specific time”. This allows users to choose the update time without affecting normal internet usage.
• Rollback function: If, unfortunately, a power outage or file corruption occurs during the firmware update process, leading to update failure, a well-designed router will automatically roll back to the last stable firmware version. This ensures the device can continue to operate normally and prevents it from becoming “bricked” and unusable.