Master Thesis - Security Assessment of Over-the-Air (OTA) Software Updates in Connected Vehicles

Threat Modeling and Automated Security Validation of Over-the-Air Software Updates in Heavy-Duty Vehicles 

Introduction

Objective

The thesis worker will:

• Analyze the OTA update architecture and associated attack surfaces.
• Develop a threat model using STRIDE and attack trees.
• Investigate firmware authenticity, integrity, authorization, and anti-rollback protections.
• Develop automated security test cases for OTA update workflows.
• Evaluate resilience against interrupted updates, replay attempts, and manipulated update metadata. 
   

Research questions: 

1. What are the most significant cybersecurity threats affecting automotive OTA update mechanisms? 
2. How effectively do existing security controls prevent unauthorized or manipulated updates? 
3. How can OTA security validation be automated and integrated into release testing? 

Expected deliverables 

A complete OTA threat model, security requirements traceability matrix, automated Python-based test suite, and a technical evaluation report. 

Value for Scania:  

Strengthens OTA security assurance and provides reusable test cases supporting cybersecurity engineering under UN R155 and software update management under UN R156.