The new four modernizations of automobiles (electrification, intelligence, connectivity, and sharing) are recognized trends in the industry. In terms of intelligence and connectivity, OTA technology has become an important selling point for many car manufacturers to promote their products. If a new car does not have OTA, it may be considered a joke.So what is OTA? How should we properly understand OTA technology? Should we pay attention to this technology when buying a car?OTA technology stands for Over the Air Technology, which translates to air download technology.First, we need to understand what OTA is. OTA can simply be understood as remote upgrades. It was first introduced in the Android system on mobile phones, ending the complicated process of needing to connect to a computer to download software and then install updates. When applied to cars, it can be understood as being able to remotely upgrade your vehicle’s software system, even directly upgrading software to control the entire vehicle.A few years ago, the network speed, processor manufacturing process, and vehicle system were in a very primitive state, making it somewhat unrealistic to upgrade cars via OTA. Even now, vehicle OTA mainly upgrades in-car applications, multimedia systems, or the underlying systems of the entire vehicle. If the vehicle is equipped with a SIM card module or WiFi module, OTA can be realized, and the technology is not complicated.Unlike a car’s chassis or engine, software is very easy to update and iterate. In the past, when a vehicle encountered software failures or needed updates, we had to take the car to a 4S shop for staff to use professional computers for repairs. This process consumes a lot of manpower and resources, as well as the consumer’s time. OTA technology allows users to complete vehicle upgrades without leaving their homes, reducing costs and saving user time.Why is OTA technology often associated with electric vehicles?The answer is simple: electric vehicles are more suitable for OTA upgrades.Early cars were purely mechanical structures, so software could not upgrade the vehicle. Therefore, vehicle OTA generally focuses on online system updates for entertainment systems, navigation, etc. For example, updating the Android Auto and Apple CarPlay in the center console or updating navigation maps. However, electric vehicles have relatively simple structures; all systems related to vehicle movement, such as the power system, braking system, and battery management system, have turned to electronics, allowing OTA to “control” and “rewrite” them at any time, as long as the manufacturer leaves enough redundancy in the core three-electric systems, vehicle processors, and sensors during the design phase, making subsequent software enhancements much easier.Moreover, to achieve autonomous driving, many cars are equipped with a large number of sensors, and automotive manufacturers can use software to utilize these sensors to provide more functionalities.As the first to promote OTA functionality on a large scale in cars, Tesla has a clear competitive advantage over traditional car manufacturers. For example, Tesla previously claimed it would outperform Porsche on the Nürburgring Nordschleife, and subsequently, the well-known automotive media Top Gear conducted a comparison test between the Porsche Taycan Turbo S and Tesla Model S.In the case of both vehicles being original, the Porsche Taycan won comprehensively.This result made Tesla CEO Elon Musk very unhappy, so Tesla decided to increase the peak power of the Model S by 50 horsepower through OTA upgrades. If it were a gasoline car, achieving a 50 horsepower increase through OTA with current technology would be quite difficult; however, electric vehicles are a different story. Additionally, Tesla can reduce the 0-100 km/h acceleration time from 5.2 seconds to 4.7 seconds through OTA and can also shorten braking distances by 6 meters via OTA, as well as create Christmas eggs through OTA.Because electric vehicles are more suitable for online upgrades, many new energy vehicle brands have made OTA a major selling point. If OTA could only update the vehicle’s system interface, UI, in-car apps, and multimedia systems like before, how could these new force brands highlight the smart car concept they are promoting?Why is OTA rarely seen on traditional gasoline vehicles?Digitalization has become extremely common in our lives, and cars are also adapting to the changing times.The development cycle of a car usually takes 3-4 years or even longer. During the development process, car manufacturers will conduct extensive tests under various working conditions and driving environments to discover and resolve as many issues as possible before launching the product. Even so, we still hear about large-scale recalls of cars, which shows how important the reliability and safety of automotive products are.The power unit of traditional gasoline vehicles is very complex, with parameters such as fuel injection volume, throttle opening and closing, brake system, shifting logic, steering ratio, and suspension style calibrated, consuming the efforts and energies of thousands of engineers over several years. Achieving a production-ready state is definitely the best state within the cost range. Many modified car enthusiasts experience unstable power output and even decreased vehicle handling after modifying their cars because they change the factory’s very balanced settings.People have become accustomed to upgrading their mobile phones online, but achieving this in gasoline vehicles is not easy. Mobile phones often rush to market when 80% or 90% of the functionality is realized,and then continuously improve software issues through OTA to fix product bugs.Gasoline vehicles have too many aspects to match for OTA implementation, such as engine output characteristics, the matching of the transmission system and engine output, or the calibration of driving assistance systems. Moreover, these core mechanisms directly determine vehicle safety; it is very irresponsible for automotive manufacturers to push “semi-finished products” to the market. If a digital product has defects, it may just lose functionality, but if a car has problems or defects, it can lead to serious safety accidents, affecting the safety of the owner and passengers.Tuning the ECU for performance is no joke; it is not as straightforward as electric systems. Traditional automakers are not incapable of OTA; they are unwilling to do so,this is merely a “promotional selling point” that new energy vehicle brands are keen on.For instance, luxury brands like Audi, Jaguar I-PACE, and Mercedes EQC are criticized online by some brands’ army for not supporting full vehicle OTA, calling them “old-age transportation vehicles,” which is utterly meaningless. Even traditional automotive companies that produce pure electric products go through rigorous testing before launch and do not take the so-called OTA lightly.Recent Automotive OTA Upgrade ComponentsIn addition to the Zhiji L7, major car manufacturers are also focusing on OTA updates for ADAS and autonomous driving modules (including updates and improvements related to automatic parking and lane changing). As assisted/autonomous driving gradually matures, along with the improvement of national policy management, regulations, and guarantees, the future competition for OTA will mainly focus on assisted driving.Secondly, cockpit updates between vehicle machines, such as interaction updates, occur frequently. On one hand, many mainstream applications currently do not align well with in-car usage habits, and there is still significant room for improvement in how owners use vehicle machines. On the other hand, improvements in the vehicle machine and changes in UI can provide owners with clear perceptions.1. Comparison of OTA Upgrade Frequency and Content Between Domestic and Foreign Car Manufacturers2. OTA SolutionsOTA is a remote upgrade function based on automotive connectivity. Most vehicle manufacturers primarily adopt third-party OTA solutions rather than developing their own OTA platforms. According to data from the Gao Gong Intelligent Automotive Research Institute, most domestic independent and joint venture brands still primarily use third-party OTA solutions and do not yet have sufficient capabilities or organizational structures to develop, deliver, and expand OTA software platforms.3. Cooperation ModelsSupplier and OEM cooperation is becoming more flexible, and the main OTA cooperation models include three types: 1) Turnkey projects, building software for a fee, providing end-to-end overall solutions; 2) Building completely new functionalities, project development acceptance; 3) Pay-per-need (for functional modules), etc.4. OTA Technology Principles

5. Based on Symmetric Key Encryption Technology

In 2005, Mahmud et al. proposed a secure update technology for intelligent vehicles at the core journal IEEE Intelligent Vehicles Symposium. They proposed sharing a set of link keys between the original equipment manufacturer and the software supplier (SS). Before any software update, a link key is used to establish a secure connection between the software supplier and the vehicle, forming a trusted channel.In 2012, Mansour et al. designed a diagnostic and secure OTA system called AiroDiag for connecting vehicles. The architecture of AiroDiag is mainly divided into OEM, automotive, and cloud. AiroDiag adopts symmetric key technology, especially using advanced encryption standards to ensure communication security during the software update process. In AiroDiag, keys are stored in the OEM’s database. The AiroDiag application always maintains a connection to the network, handling any connection requests from the vehicle machine. In AiroDiag, the software update process is triggered by the client. Once the software update process is triggered, the vehicle first establishes a secure connection with the OEM. Next, the vehicle informs the OEM of the currently installed software version. If new software is available, the OEM will trigger the software update process and establish a secure connection with the vehicle.

6. Based on Hash Algorithm

In 2008, Nilsson and Larson proposed a secure OTA firmware update protocol for the Internet of Vehicles at the IEEE conference. Their architecture consists of four entities: vehicle, server backend, internet, and wireless base station. Here, the server backend is the main unit responsible for communicating with connected vehicles. The author first divides the updated binary file into multiple data blocks. Then, each segment is hashed in reverse order to create a hash table. Finally, the server backend encrypts each data block using a pre-shared encryption key pair and then transmits them to the vehicle terminal. Considering the limited resources in vehicles, the backend uses block hash encryption as the encryption technology. Although this method can ensure that it is not susceptible to eavesdropping, interception, and tampering attacks, it cannot prevent denial of service attacks.

7. Based on Blockchain Technology

In 2018, Steger et al. introduced a blockchain (BC) architecture in their work to address the security and privacy issues of OTA upgrades for intelligent vehicles. The main entities in this architecture include OEM, service center, vehicle, cloud server, and SW host. In this architecture, all participating entities form a cluster. Once a new OTA package appears, the program on the SW host triggers the software update process. First, the SW host sends a storage request with its signature to the cloud server. After successful verification, the cloud server sends a secondary confirmation package, including its signature and the file descriptor required during the software upload process to the SW host. After the new software is uploaded to the cloud server, the SW host creates an update event in the block, which contains information such as the new software’s location in the cloud. The SW host then uses a private key to sign this event and finally broadcasts the encrypted event to the vehicle. The author then conducted validation tests for this concept, and the results indicated that the performance of this architecture outperformed certificate-based architectures.

8. Combination of Symmetric and Asymmetric Key Encryption Algorithms

In 2016, Steger et al. proposed a framework called SecUp at the IEEE conference for secure and efficient OTA software updates for connected vehicles. This involves OEM, service center, vehicle terminal, and automotive maintenance personnel. SecUp uses both symmetric and asymmetric key encryption to protect the OTA update process. Automotive maintenance personnel use NFC smart cards and PIN codes for symmetric authentication with handheld devices, then the service backend returns a session key, which is used in conjunction with the vehicle’s RSA public key to encrypt the installation package sent to each vehicle. Upon successful reception, the vehicle verifies and decrypts the software using its private key before installation. The performance of SecUp was tested through ECU update experiments on Volvo vehicles. The results showed that the update duration for different types of software ranged from 6.77 seconds to 33.19 seconds.

9. Hardware Security Module

In 2016, Petri et al. proposed a secure OTA update mechanism based on a Trusted Platform Module (TPM) at the International Automotive Security Conference. First, the gateway ECU downloads the updated software from the remote server. Then the ECU uses the predefined hash in the TPM to verify the downloaded software. After successful verification, the ECU sends the updated software to the target ECU for installation. The benefit of using TPM is that it supports many popular encryption algorithms, such as RSA, SHA, and AES. The main limitation is that each ECU requires an HSM/TPM encryption machine, leading to additional costs.According to ABI market research data, by 2022, 203 million vehicles will be able to update software via OTA, of which at least 22 million vehicles can also update firmware via OTA. In the future, we will face challenges related to security issues arising from vehicle OTA updates.What are the drawbacks of OTA?Automotive OTA can be likened to mobile system upgrades, but there are significant differences, especially regarding security.When a mobile phone undergoes an OTA upgrade, the worst-case scenario is that the phone becomes a “brick”. However, for cars, if errors occur in the upgrade process related to steering, braking, or other driving-related components, it could lead to extremely serious consequences.As software, there is a possibility of being attacked, and vehicles also face such risks during OTA upgrades. During the process of downloading the upgrade package, attackers can use network means to send modified upgrade packages to the vehicle, thereby modifying the system or even remotely controlling the vehicle. In addition to being attacked, if there are network instability issues when the vehicle downloads the upgrade package, it may lead to vulnerabilities in the upgrade package, causing the vehicle upgrade to fail. Therefore, automotive OTA requires manufacturers to develop comprehensive upgrade strategies, such as establishing strict verification mechanisms during the upgrade process to ensure that the upgrade package is not tampered with and limiting upgrade conditions to ensure that vehicles can upgrade under appropriate conditions. Currently, network security regulations for automotive controllers have been introduced, with R155 and R156 being national policies to regulate the market and enhance information security.OTA gives manufacturers more control over vehicles and silently collects and uploads a lot of privacy from vehicle owners, such as vehicle location, trajectory, image information, and audio information, which is detailed in NIO’s privacy policy. Regardless of the purpose of car manufacturers, intelligence can only be developed under the premise of protecting privacy. To put it in an inappropriate analogy, if you buy a smart home and find that there are numerous cameras and hidden microphones collecting your information for safety or inexplicable reasons, wouldn’t you feel uncomfortable or even creeped out? Furthermore, if automotive companies are hacked at the server security level, not only could massive amounts of user data be leaked, but in the future, something like in “Fast and Furious” could happen, where hackers remotely control massive amounts of cars through OTA, easily opening doors, starting cars, and even activating autonomous driving modules to execute certain tasks or commands, potentially becoming large-scale dangerous weapons. Who will ensure safety then?Secondly, OEM OTA often becomes a shameful excuse,to rush to market and prematurely push out “semi-finished products” with incomplete functions,making paying consumers act as “guinea pigs” or “risk bearers” while manufacturers later use OTA upgrades to compensate for the deficiencies in the original testing phase, misleading consumers into thinking “this is a constantly evolving car.” Moreover, once mass-produced vehicles experience large-scale quality issues or production defects, OTA can easily become a substitute term for “mass recall” or a cover. Manufacturers can make arbitrary modifications to the vehicle’s driving computer’s underlying debugging and operation logic through OTA, making OTA even more dangerous.Many brands have rushed to seize the “new energy subsidy window period,” taking shortcuts in the vehicle manufacturing process with OTA, leading to disorganized product functionalities, and even embedding hardware, hoping to cover up the current reality of incomplete products through OTA promotion. Responsible automotive companies should focus on design, testing, and research and development, ensuring that their products are thoroughly refined before mass production and market launch. If issues arise, they should responsibly resolve them through the recall system, rather than resorting to gimmicks. In contrast to Tesla and domestic new force brands that promote their OTA features, Japanese companies like Toyota and Honda have always been accepted in the market for only equipping qualified and mature features, resulting in a relatively low accident rate.Of course, different corporate strategies do not mean one is necessarily better than the other.ConclusionOTA technology has both advantages and disadvantages for car manufacturers and consumers. For some entertainment features, OTA is fine since they are just entertainment functions and won’t cause major issues, allowing consumers to enjoy a better entertainment experience. However, for features related to autonomous driving assistance, a conservative attitude is advised, and OTA should be used cautiously since it concerns driving safety and allows no room for carelessness. Car manufacturers must be careful when implementing corresponding OTA strategies; this is responsible for consumers and a necessary condition to avoid incidents from OTA affecting their reputation.

Statement: This articleis sourced from Electric Control Knowledge Transporter, reprinted from Automotive Technologist,for learning and communication purposes only. If there is any infringement, please contact for deletion.

The new four modernizations of automobiles (electrification, intelligence, connectivity, and sharing) are recognized trends in the industry. In terms of intelligence and connectivity, OTA technology has become an important selling point for many car manufacturers to promote their products. If a new car does not have OTA, it may be considered a joke.So what is OTA? How should we properly understand OTA technology? Should we pay attention to this technology when buying a car?OTA technology stands for Over the Air Technology, which translates to air download technology.First, we need to understand what OTA is. OTA can simply be understood as remote upgrades. It was first introduced in the Android system on mobile phones, ending the complicated process of needing to connect to a computer to download software and then install updates. When applied to cars, it can be understood as being able to remotely upgrade your vehicle’s software system, even directly upgrading software to control the entire vehicle.A few years ago, the network speed, processor manufacturing process, and vehicle system were in a very primitive state, making it somewhat unrealistic to upgrade cars via OTA. Even now, vehicle OTA mainly upgrades in-car applications, multimedia systems, or the underlying systems of the entire vehicle. If the vehicle is equipped with a SIM card module or WiFi module, OTA can be realized, and the technology is not complicated.Unlike a car’s chassis or engine, software is very easy to update and iterate. In the past, when a vehicle encountered software failures or needed updates, we had to take the car to a 4S shop for staff to use professional computers for repairs. This process consumes a lot of manpower and resources, as well as the consumer’s time. OTA technology allows users to complete vehicle upgrades without leaving their homes, reducing costs and saving user time.Why is OTA technology often associated with electric vehicles?The answer is simple: electric vehicles are more suitable for OTA upgrades.Early cars were purely mechanical structures, so software could not upgrade the vehicle. Therefore, vehicle OTA generally focuses on online system updates for entertainment systems, navigation, etc. For example, updating the Android Auto and Apple CarPlay in the center console or updating navigation maps. However, electric vehicles have relatively simple structures; all systems related to vehicle movement, such as the power system, braking system, and battery management system, have turned to electronics, allowing OTA to “control” and “rewrite” them at any time, as long as the manufacturer leaves enough redundancy in the core three-electric systems, vehicle processors, and sensors during the design phase, making subsequent software enhancements much easier.Moreover, to achieve autonomous driving, many cars are equipped with a large number of sensors, and automotive manufacturers can use software to utilize these sensors to provide more functionalities.As the first to promote OTA functionality on a large scale in cars, Tesla has a clear competitive advantage over traditional car manufacturers. For example, Tesla previously claimed it would outperform Porsche on the Nürburgring Nordschleife, and subsequently, the well-known automotive media Top Gear conducted a comparison test between the Porsche Taycan Turbo S and Tesla Model S.In the case of both vehicles being original, the Porsche Taycan won comprehensively.This result made Tesla CEO Elon Musk very unhappy, so Tesla decided to increase the peak power of the Model S by 50 horsepower through OTA upgrades. If it were a gasoline car, achieving a 50 horsepower increase through OTA with current technology would be quite difficult; however, electric vehicles are a different story. Additionally, Tesla can reduce the 0-100 km/h acceleration time from 5.2 seconds to 4.7 seconds through OTA and can also shorten braking distances by 6 meters via OTA, as well as create Christmas eggs through OTA.Because electric vehicles are more suitable for online upgrades, many new energy vehicle brands have made OTA a major selling point. If OTA could only update the vehicle’s system interface, UI, in-car apps, and multimedia systems like before, how could these new force brands highlight the smart car concept they are promoting?Why is OTA rarely seen on traditional gasoline vehicles?Digitalization has become extremely common in our lives, and cars are also adapting to the changing times.The development cycle of a car usually takes 3-4 years or even longer. During the development process, car manufacturers will conduct extensive tests under various working conditions and driving environments to discover and resolve as many issues as possible before launching the product. Even so, we still hear about large-scale recalls of cars, which shows how important the reliability and safety of automotive products are.The power unit of traditional gasoline vehicles is very complex, with parameters such as fuel injection volume, throttle opening and closing, brake system, shifting logic, steering ratio, and suspension style calibrated, consuming the efforts and energies of thousands of engineers over several years. Achieving a production-ready state is definitely the best state within the cost range. Many modified car enthusiasts experience unstable power output and even decreased vehicle handling after modifying their cars because they change the factory’s very balanced settings.People have become accustomed to upgrading their mobile phones online, but achieving this in gasoline vehicles is not easy. Mobile phones often rush to market when 80% or 90% of the functionality is realized,and then continuously improve software issues through OTA to fix product bugs.Gasoline vehicles have too many aspects to match for OTA implementation, such as engine output characteristics, the matching of the transmission system and engine output, or the calibration of driving assistance systems. Moreover, these core mechanisms directly determine vehicle safety; it is very irresponsible for automotive manufacturers to push “semi-finished products” to the market. If a digital product has defects, it may just lose functionality, but if a car has problems or defects, it can lead to serious safety accidents, affecting the safety of the owner and passengers.Tuning the ECU for performance is no joke; it is not as straightforward as electric systems. Traditional automakers are not incapable of OTA; they are unwilling to do so,this is merely a “promotional selling point” that new energy vehicle brands are keen on.For instance, luxury brands like Audi, Jaguar I-PACE, and Mercedes EQC are criticized online by some brands’ army for not supporting full vehicle OTA, calling them “old-age transportation vehicles,” which is utterly meaningless. Even traditional automotive companies that produce pure electric products go through rigorous testing before launch and do not take the so-called OTA lightly.Recent Automotive OTA Upgrade ComponentsIn addition to the Zhiji L7, major car manufacturers are also focusing on OTA updates for ADAS and autonomous driving modules (including updates and improvements related to automatic parking and lane changing). As assisted/autonomous driving gradually matures, along with the improvement of national policy management, regulations, and guarantees, the future competition for OTA will mainly focus on assisted driving.Secondly, cockpit updates between vehicle machines, such as interaction updates, occur frequently. On one hand, many mainstream applications currently do not align well with in-car usage habits, and there is still significant room for improvement in how owners use vehicle machines. On the other hand, improvements in the vehicle machine and changes in UI can provide owners with clear perceptions.1. Comparison of OTA Upgrade Frequency and Content Between Domestic and Foreign Car Manufacturers2. OTA SolutionsOTA is a remote upgrade function based on automotive connectivity. Most vehicle manufacturers primarily adopt third-party OTA solutions rather than developing their own OTA platforms. According to data from the Gao Gong Intelligent Automotive Research Institute, most domestic independent and joint venture brands still primarily use third-party OTA solutions and do not yet have sufficient capabilities or organizational structures to develop, deliver, and expand OTA software platforms.3. Cooperation ModelsSupplier and OEM cooperation is becoming more flexible, and the main OTA cooperation models include three types: 1) Turnkey projects, building software for a fee, providing end-to-end overall solutions; 2) Building completely new functionalities, project development acceptance; 3) Pay-per-need (for functional modules), etc.4. OTA Technology Principles

5. Based on Symmetric Key Encryption Technology

In 2005, Mahmud et al. proposed a secure update technology for intelligent vehicles at the core journal IEEE Intelligent Vehicles Symposium. They proposed sharing a set of link keys between the original equipment manufacturer and the software supplier (SS). Before any software update, a link key is used to establish a secure connection between the software supplier and the vehicle, forming a trusted channel.In 2012, Mansour et al. designed a diagnostic and secure OTA system called AiroDiag for connecting vehicles. The architecture of AiroDiag is mainly divided into OEM, automotive, and cloud. AiroDiag adopts symmetric key technology, especially using advanced encryption standards to ensure communication security during the software update process. In AiroDiag, keys are stored in the OEM’s database. The AiroDiag application always maintains a connection to the network, handling any connection requests from the vehicle machine. In AiroDiag, the software update process is triggered by the client. Once the software update process is triggered, the vehicle first establishes a secure connection with the OEM. Next, the vehicle informs the OEM of the currently installed software version. If new software is available, the OEM will trigger the software update process and establish a secure connection with the vehicle.

6. Based on Hash Algorithm

In 2008, Nilsson and Larson proposed a secure OTA firmware update protocol for the Internet of Vehicles at the IEEE conference. Their architecture consists of four entities: vehicle, server backend, internet, and wireless base station. Here, the server backend is the main unit responsible for communicating with connected vehicles. The author first divides the updated binary file into multiple data blocks. Then, each segment is hashed in reverse order to create a hash table. Finally, the server backend encrypts each data block using a pre-shared encryption key pair and then transmits them to the vehicle terminal. Considering the limited resources in vehicles, the backend uses block hash encryption as the encryption technology. Although this method can ensure that it is not susceptible to eavesdropping, interception, and tampering attacks, it cannot prevent denial of service attacks.

7. Based on Blockchain Technology

In 2018, Steger et al. introduced a blockchain (BC) architecture in their work to address the security and privacy issues of OTA upgrades for intelligent vehicles. The main entities in this architecture include OEM, service center, vehicle, cloud server, and SW host. In this architecture, all participating entities form a cluster. Once a new OTA package appears, the program on the SW host triggers the software update process. First, the SW host sends a storage request with its signature to the cloud server. After successful verification, the cloud server sends a secondary confirmation package, including its signature and the file descriptor required during the software upload process to the SW host. After the new software is uploaded to the cloud server, the SW host creates an update event in the block, which contains information such as the new software’s location in the cloud. The SW host then uses a private key to sign this event and finally broadcasts the encrypted event to the vehicle. The author then conducted validation tests for this concept, and the results indicated that the performance of this architecture outperformed certificate-based architectures.

8. Combination of Symmetric and Asymmetric Key Encryption Algorithms

In 2016, Steger et al. proposed a framework called SecUp at the IEEE conference for secure and efficient OTA software updates for connected vehicles. This involves OEM, service center, vehicle terminal, and automotive maintenance personnel. SecUp uses both symmetric and asymmetric key encryption to protect the OTA update process. Automotive maintenance personnel use NFC smart cards and PIN codes for symmetric authentication with handheld devices, then the service backend returns a session key, which is used in conjunction with the vehicle’s RSA public key to encrypt the installation package sent to each vehicle. Upon successful reception, the vehicle verifies and decrypts the software using its private key before installation. The performance of SecUp was tested through ECU update experiments on Volvo vehicles. The results showed that the update duration for different types of software ranged from 6.77 seconds to 33.19 seconds.

9. Hardware Security Module

In 2016, Petri et al. proposed a secure OTA update mechanism based on a Trusted Platform Module (TPM) at the International Automotive Security Conference. First, the gateway ECU downloads the updated software from the remote server. Then the ECU uses the predefined hash in the TPM to verify the downloaded software. After successful verification, the ECU sends the updated software to the target ECU for installation. The benefit of using TPM is that it supports many popular encryption algorithms, such as RSA, SHA, and AES. The main limitation is that each ECU requires an HSM/TPM encryption machine, leading to additional costs.According to ABI market research data, by 2022, 203 million vehicles will be able to update software via OTA, of which at least 22 million vehicles can also update firmware via OTA. In the future, we will face challenges related to security issues arising from vehicle OTA updates.What are the drawbacks of OTA?Automotive OTA can be likened to mobile system upgrades, but there are significant differences, especially regarding security.When a mobile phone undergoes an OTA upgrade, the worst-case scenario is that the phone becomes a “brick”. However, for cars, if errors occur in the upgrade process related to steering, braking, or other driving-related components, it could lead to extremely serious consequences.As software, there is a possibility of being attacked, and vehicles also face such risks during OTA upgrades. During the process of downloading the upgrade package, attackers can use network means to send modified upgrade packages to the vehicle, thereby modifying the system or even remotely controlling the vehicle. In addition to being attacked, if there are network instability issues when the vehicle downloads the upgrade package, it may lead to vulnerabilities in the upgrade package, causing the vehicle upgrade to fail. Therefore, automotive OTA requires manufacturers to develop comprehensive upgrade strategies, such as establishing strict verification mechanisms during the upgrade process to ensure that the upgrade package is not tampered with and limiting upgrade conditions to ensure that vehicles can upgrade under appropriate conditions. Currently, network security regulations for automotive controllers have been introduced, with R155 and R156 being national policies to regulate the market and enhance information security.OTA gives manufacturers more control over vehicles and silently collects and uploads a lot of privacy from vehicle owners, such as vehicle location, trajectory, image information, and audio information, which is detailed in NIO’s privacy policy. Regardless of the purpose of car manufacturers, intelligence can only be developed under the premise of protecting privacy. To put it in an inappropriate analogy, if you buy a smart home and find that there are numerous cameras and hidden microphones collecting your information for safety or inexplicable reasons, wouldn’t you feel uncomfortable or even creeped out? Furthermore, if automotive companies are hacked at the server security level, not only could massive amounts of user data be leaked, but in the future, something like in “Fast and Furious” could happen, where hackers remotely control massive amounts of cars through OTA, easily opening doors, starting cars, and even activating autonomous driving modules to execute certain tasks or commands, potentially becoming large-scale dangerous weapons. Who will ensure safety then?Secondly, OEM OTA often becomes a shameful excuse,to rush to market and prematurely push out “semi-finished products” with incomplete functions,making paying consumers act as “guinea pigs” or “risk bearers” while manufacturers later use OTA upgrades to compensate for the deficiencies in the original testing phase, misleading consumers into thinking “this is a constantly evolving car.” Moreover, once mass-produced vehicles experience large-scale quality issues or production defects, OTA can easily become a substitute term for “mass recall” or a cover. Manufacturers can make arbitrary modifications to the vehicle’s driving computer’s underlying debugging and operation logic through OTA, making OTA even more dangerous.Many brands have rushed to seize the “new energy subsidy window period,” taking shortcuts in the vehicle manufacturing process with OTA, leading to disorganized product functionalities, and even embedding hardware, hoping to cover up the current reality of incomplete products through OTA promotion. Responsible automotive companies should focus on design, testing, and research and development, ensuring that their products are thoroughly refined before mass production and market launch. If issues arise, they should responsibly resolve them through the recall system, rather than resorting to gimmicks. In contrast to Tesla and domestic new force brands that promote their OTA features, Japanese companies like Toyota and Honda have always been accepted in the market for only equipping qualified and mature features, resulting in a relatively low accident rate.Of course, different corporate strategies do not mean one is necessarily better than the other.ConclusionOTA technology has both advantages and disadvantages for car manufacturers and consumers. For some entertainment features, OTA is fine since they are just entertainment functions and won’t cause major issues, allowing consumers to enjoy a better entertainment experience. However, for features related to autonomous driving assistance, a conservative attitude is advised, and OTA should be used cautiously since it concerns driving safety and allows no room for carelessness. Car manufacturers must be careful when implementing corresponding OTA strategies; this is responsible for consumers and a necessary condition to avoid incidents from OTA affecting their reputation.