Project Overview
Uptane is the first software update security system for the automotive industry capable of resisting even attacks by nation-state level actors. It is designed in such a manner that the security of software updates does not degrade all at once, but follows a hierarchy in which different levels of access to vehicles or the automaker’s infrastructure must be gained. By building these levels into the security system, even if an attacker compromises servers, bribes operators, or gains access to vehicular networks, he or she is prevented from causing many types of harm to the vehicle.
Equally important is that Uptane provides a method to authenticate software updates before they are installed on the connected units that control vital components, such as brakes and door locks, despite adversarial interference, In doing so, Uptane provides a solution to a growing threat vector targeting cars and trucks—malware disguised as software updates.
The Uptane framework is flexible and can be incorporated into the existing types of software update strategies already used by OEMs. Whether it is an end user updating his or her own vehicle using flash drives, over-the-air updates, or automated operations using package managers, all can benefit from Uptane’s security with very low operational overhead.
Uptane was developed as open source software under a grant from the U.S. Department of Homeland Security, and is completely free for anyone to use. It was created by a team of researchers from the New York University Tandon School of Engineering in Brooklyn, NY, the University of Michigan Transportation Research Institute in Ann Arbor, MI, and the Southwest Research Institute in Austin, TX. The three partner institutions worked in close collaboration with vehicle manufacturers and suppliers that are collectively responsible for 78% of the vehicles on U.S. roads.
In 2017, Popular Science named Uptane one of the top security inventions of 2017, and the OTAmatic program of Airbiquity, in which Uptane is a key security component, was awarded a BIG Award for Business in the New Product Category. In 2018, NYU Tandon School of Engineering became an associate member of the Linux Foundation, and a member of the Automotive Grade Linux project, in part due to the Foundation’s adoption of Uptane technology.
On July 2018, the Uptane Alliance, a non-profit under IEEE/ISTO, was formed to lead the future direction of Uptane research, development, and deployment. The primary task of the Alliance is to be a neutral arbiter that oversees the formal standardization of Uptane and promotes security of software updates for the automotive industry.