## 1 Introduction  
Software updates over the air (SOTA) have gained high interest in the automotive industry. An electronic control unit (ECU) can only run a new version of received software after empirically verifying that it has successfully received the entire correct image file from the repository. Software updates need to be applied across a distributed system of automotive devices, which can be designed and serviced by different suppliers. The original equipment manufacturer (OEM) must shift from the traditional vehicle architecturestoward the more flexible and scalable approach required for the next generation architecture. Software-defined vehicles are the next evolution of the automotive industry [1]. New automotive trends such as e-mobility, automated driving, and connectivity services are made possible mainly by software. Main features and operations will be enabled and managed by software. Software updates not only allow for fixes of software defects or bugs but also enable management of new and paid features provided as a service throughout the entire life cycle. The change in business model is made possible by the separation of hardware and software. Significant variation is expected across the vehicle's various software. ECU software is becoming more similar to mobile software when different packages are provided separately and need to be integrated together in the vehicle. Virtualization, cloud-based approaches, AUTomotive Open System ARchitecture (AUTOSAR), and adaptive and flexible classic multi-layer software architecture [2; 3] are examples which split today's binary image into several software binary images which can be independently developed, integrated, tested, released, and programmed on the target ECU (Figure 1). Digital signatures [4] have been proven to be the most fundamental and useful strategies for securing software updates in the automotive industry. Existing solutions [5] range from full over-the-air update (OTA) frameworks to approaches based on online/offline, symmetric/asymmetric algorithms, full and partial verification, hardware and software implementation, and many other approaches. These solutions have mainly been applied to classic ECUs with single image application software (one image binary per ECU). With newer ECU architectures and frameworks, OEMs and suppliers face the challenge to enable on demand a flexible deployment of portable, consistent and interoperable software (multiple of software clusters) in the ECU throughout the entire lifecycle of the vehicle. Software clusters and data are selectively updated to add or remove software functionality, enable paid services, implement a security fix, or improve performance. OEMs have also to support both legacy ECUs (e.g., classic AUTOSAR architecture) in addition to the high-performance computing ECUs (e.g., adaptive AUTOSAR architecture). Among the existing approaches, we did not find any related work to verify at once the authenticity, integrity, compatibility, and harmonization of a single binary image with the remaining software images using the single authentication signature appended to the software code image. Different approaches should be considered for ECUs with multiple independent binary executions. Thus, our Merkle-tree-based software updates over the air concept (MT-SOTA) is proposed to complement existing approaches to address new software architectures in the automotive industry. The main contributions of this work can be summarized as the following:  
* An overview of the process for software updates over the air and the current solutions employed in the automotive industry. Figure 1: ECU binary images are divided into multiple software clusters, each of which can be developed, tested, released, and programmed onto the target ECU independently. An overview of the new vehicle architectures and the challenges in dynamically updating selective software clusters.