Design a protocol for secure OTA (Over-the-Air) updates in autonomous vehicle systems.

Instruction: Consider aspects such as authentication, data integrity, and rollback mechanisms.

Context: This question tests the candidate's ability to ensure the security and reliability of OTA updates, which are critical for the maintenance and enhancement of autonomous vehicles.

Updated

Example Answer

I would use an established secure-update framework and verify updates independently of the transport channel. TLS can protect delivery, while signed metadata binds authorized images to devices, versions and hashes. Verification also needs freshness and rollback protections, key rotation and compromise recovery. Before installation, check multi-component compatibility and permitted vehicle state. Recovery should restore an authorized compatible release, not blindly accept any older image because it was once signed.

Make it your own

Illustrative rejection cases: expired metadata, an older trusted version, validly signed software for the wrong ECU, power loss during installation and incompatible component versions.

Why this works

Signatures alone cannot reject a replayed vulnerable release. Follow-up: how would recovery remain possible while resisting an attacker-induced downgrade?

Sources: Uptane 2.0 update verification, NHTSA vehicle cybersecurity practices.

Related Questions