Abstract: An apparatus and a method for recovering from a fault on a device, the method performed at the device comprising: initiating, with a bootloader, a recovery mechanism in response to detection of a fault with a first application, where the recovery mechanism comprises: obtaining, from storage on the device, location information identifying a first storage location for recovery software; obtaining, from the first storage location, the recovery software; obtaining, using the recovery software, a software update from a second storage location.

Abstract: A method of generating an output differential firmware update. Differential firmware update characteristic data is sent from a trusted execution environment (TEE) to an authorizing entity. The differential firmware update characteristic data indicates at least one characteristic associated with generation of the output differential firmware update within the TEE. The TEE obtains a key from the authorizing entity, and is thereby authorized by the authorizing entity to generate the output differential firmware update. The TEE obtains an encrypted version of a firmware portion of the firmware. The encrypted version of the firmware portion is decrypted using the key to obtain a decrypted version of the firmware portion. The output differential firmware update is generated using the decrypted version of the firmware portion.