Secure edge model updates

A downloaded hash provides integrity only relative to a trusted expected digest; an attacker who can replace both file and untrusted hash has not been stopped. Authenticate metadata under provisioned trust roots, enforce authorized signing roles, and bind the artifact bytes and compatibility fields to that metadata. Include model format, runtime and kernel requirements, tensor schema, preprocessor version, class map and resource limits. A cryptographically intact file can still fail initialization or exceed memory on one device revision.

TUF separates metadata roles and specifies signature, version and expiration checks to resist several update attacks. Its target files are opaque artifacts: the application remains responsible for interpreting and installing a model. Freshness checks need persistent trusted state and the scheme’s time assumptions; a disconnected device with an unreliable clock cannot infer current repository freshness merely from an old valid signature. Plan key rotation and recovery before deployment rather than making an emergency bypass the ordinary trust policy.

A security generation prevents installing artifacts below an established security floor. It should not wrap like a circular buffer index, and its stored state must resist the attacker capabilities in the threat model. Ordinary model version labels and security generations serve different purposes: several quality revisions can share a security floor. MCUboot 2.2.0 documents hardware-based rollback protection using a signed image security counter and trusted nonvolatile state, but that firmware mechanism does not automatically protect a separately loaded model file.

A deliberate return to a known-good candidate must remain consistent with the security floor. If the floor has advanced past the older artifact, recovering by silently lowering it defeats the antirollback policy. Define an authorized recovery path and when security state is committed relative to trial execution and confirmation. Retain enough compatible data to recover from interrupted updates without accepting forbidden artifacts. The ordering and persistence protocol require fault tests; a statement that the pointer change is atomic does not by itself make every related metadata write durable.

Write a candidate to an inactive location, verify authenticated metadata and content, validate compatibility and initialization, and run the required health or quality checks before promotion. Switch the active reference using a storage protocol that can recover to one consistent version after power loss, including related state migrations. MCUboot’s test-and-confirm firmware flow is a useful concrete analogy, not an automatic model-updater feature. Exercise failure after each persistent write, during verification, during promotion, and before confirmation; inspect both the active bundle and security state after restart.

The modular lab illustrates why wrapped counters are unsuitable as a freshness order. Reset, set modulus m to 8 and additive step a to 1, predict residue zero after eight Steps, then take those Steps. Compare a fresh Reset with both m at 16 and a at 1 before eight Steps: residue eight. One Step is one addition. This finite cyclic toy implements neither a monotonic trusted counter nor signatures, secure storage, authenticated metadata, or atomic promotion.