Examkin

Question

Difficulty: HardHardware and Embedded Systems Security

An industrial IoT device manufacturer is designing a field-deployed microcontroller unit that operates in physically untrusted locations. Security engineers need to prevent attackers from executing anti-rollback (firmware downgrade) attacks—where an adversary physically unsolders external flash memory and writes a cryptographically valid, but older and vulnerable, firmware image. Which of the following hardware security controls best mitigates this physical firmware downgrade vector?

  1. One-Time Programmable (OTP) eFuses configured to permanently increment and enforce the minimum allowable firmware security version.Answer
  2. B
    Platform Configuration Registers (PCRs) inside a Trusted Platform Module (TPM) capturing runtime boot measurements.
  3. C
    Symmetric memory bus encryption operating between the system-on-chip (SoC) processor and external serial flash memory.
  4. D
    Network firewall rules restricting remote management traffic to dedicated administrative subnets.

Answer

One-Time Programmable (OTP) eFuses configured to permanently increment and enforce the minimum allowable firmware security version.
One-Time Programmable (OTP) eFuses provide an immutable, hardware-level state mechanism that is permanently burned whenever a new security version is introduced. Prior to booting, the hardware Root of Trust reads the eFuse register to verify that candidate firmware matches or exceeds the minimum allowed security version. This prevents execution of older, vulnerable firmware even if an attacker physically replaces the SPI flash memory chip.

Step-by-Step Solution

1
Analyze the attack vector specified in the scenario.
The adversary has physical access to the device, allows chip desoldering, and attempts to flash an older, cryptographically valid image to exploit fixed software vulnerabilities (anti-rollback attack).
Asymmetric signature verification alone succeeds on old legitimate firmware builds unless an irreversible hardware state maintains the revoked status of previous versions.
2
Evaluate hardware security primitives designed for non-reversible state retention.
One-Time Programmable (OTP) eFuses physically alter microscopic electrical connections on the chip when blown during firmware updates.
Because blown eFuses cannot be unburned or reset, the internal hardware Root of Trust checks candidate firmware version counters against the eFuse register before handing off execution.

Key Concept

Hardware Anti-Rollback and eFuse Revocation Mechanisms
Rate this question

Topics

Hardware and Embedded Systems Security

More questions from this topic