Design of an Automotive OTA System with Zonal Gateways and PQC-Hybrid TLS

Abstract

This paper proposes an over-the-air (OTA) software update architecture for vehicles adopting zonal electrical/electronic (E/E) architectures. Overall proposed OTA between the server and the ECUs comprises four stages: ready, distribution, user consent, activation and supports functional safety with dual bank (A/B)switching and anti-roll back policy. Clear roles are assigned to an OEM server with a Key Management Interoperability Protocol (KMIP), a Vehicle Mobile Gateway (VMG) / Vehicle Central Computer (VCC) ingress, zonal gateways, and ECUs. To ensure long-term cybersecurity, we adopt post-quantum cryptography (PQC): a hybrid-PQC TLS 1.3 air interface using a PQC key-encapsulation mechanism (KEM), PQC-aware key lifecycle for long-lived artifacts such as firmware metadata and device credentials. Cryptographic workloads are concentrated at the VMG/VCC and zonal gate-ways and ECUs retain final signature verification to preserve end-to-end authenticity. The proposed architecture serves as a reference framework, showing how the VMG/VCC, zonal gateways, and ECUs coordinate OTA updates under PQC-aware security processes to prepare for the post-quantum era.