Master Thesis - Security Assessment of Over-the-Air (OTA) Software Updates in Connected Vehicles

Threat Modeling and Automated Security Validation of Over-the-Air Software Updates in Heavy-Duty Vehicles 

Introduction

  Thesis work is an excellent way to get closer to Scania and build relationships for the future. Many of today's employees began their Scania career with their degree project.

Background:  

OTA updates are critical to maintaining and improving vehicle software. Compromised update processes can introduce unauthorized firmware, downgrade attacks, or disruption of vehicle functions. 

Objective

The thesis worker will:

• Analyze the OTA update architecture and associated attack surfaces.
• Develop a threat model using STRIDE and attack trees.
• Investigate firmware authenticity, integrity, authorization, and anti-rollback protections.
• Develop automated security test cases for OTA update workflows.
• Evaluate resilience against interrupted updates, replay attempts, and manipulated update metadata. 
   

Research questions: 

1. What are the most significant cybersecurity threats affecting automotive OTA update mechanisms? 
2. How effectively do existing security controls prevent unauthorized or manipulated updates? 
3. How can OTA security validation be automated and integrated into release testing? 

Expected deliverables 

A complete OTA threat model, security requirements traceability matrix, automated Python-based test suite, and a technical evaluation report. 

Value for Scania:  

Strengthens OTA security assurance and provides reusable test cases supporting cybersecurity engineering under UN R155 and software update management under UN R156. 

Education/program/focus
  Indicate education, program or focus: Software development  Number of students: 1 Start date for the thesis work: 2027-01-11  Estimated time required: <6 months    Contact persons and supervisors  

Adela Åberg, Unit Head, adela.aberg@scania.com,

Mostafa Imam, Master Thesis supervisor mostafa.imam@scania.com

  Application:   Your application must include a CV, personal letter and transcript of grades   A background check might be conducted for this position. We are conducting interviews continuously and may close the recruitment earlier than the date specified.     Publication date from - to   2026-11-05 to 2026-11-20.