LedgerGuard: A Permissioned-DLT Control Plane for Policy-Aware and Auditable Firmware Updates in Heterogeneous IoT Fleets

Secure firmware updating requires authentic artifacts and auditable decisions about release approval, rollout progression, and reported outcomes. This paper presents LedgerGuard, a permissioned distributed ledger technology (DLT) control plane for multi-stakeholder firmware-update governance. LedgerGuard records release commitments, role-distinct approvals, signer revocation, rollout transitions, emergency controls, expected-cohort metadata, and compact outcome commitments on-chain, while firmware packages, software bills of materials, provenance records, and detailed receipts remain off-chain. Authenticated EIP-712 receipts are reconciled against a precommitted cohort, and separate aggregator and witness processes reconstruct receipt and terminal-outcome roots before finalization. Evaluation combines a local four-validator Hyperledger Besu network, a persistent HTTP/SQLite comparator, authenticated software-cohort execution, local IPFS and cache experiments, analytical accountability projections, and security and fault testing. Fifty governance paths produced 350 successful transactions; median submission-to-receipt latency was approximately 2.03 s and followed the configured block period. Across 180 cohort runs, 96,000 signed receipts were generated and reverified. For 500 identities and a batch size of 50, integrity-only and complete-cohort witnessed aggregation reduced transaction counts by 98% and 94%, respectively. The witnessed approach required less gas than per-device reporting for full batches of at least three identities. The results support LedgerGuard when several known organizations require shared authoritative policy state.