GB/T 47325-2026Security technical requirements and test methods for over-the-air updates in the internet of vehicles (English PDF)

3.1 Over-the-air update; OTA update

Software update that is transferred to the vehicle wirelessly rather than using cables or other local connections.

Note 1: "Over-the-air update" is also called "remote update".

Note 2: "Local connection" generally refers to the physical connection made through the on-board diagnostics (OBD) interface, universal serial bus (USB) interface, etc. [Source: GB 44496-2024, 3.3]

3.2 Update package

Software package used for software update. [Source: GB 44496-2024, 3.6]

3.3 Internet of vehicles over-the-air update platform

Information system or platform that collects, stores, uses, processes, and provides data and related equipment data generated during the over-the-air update service of non-commercial motor vehicles (excluding special-purpose vehicles) during the operation phase, as well as system or platform that aggregates and manages the aforementioned data in a unified manner.

Note 1: Motor vehicles refer to wheeled vehicles that are driven or towed by a power unit and travel on roads for the purpose of carrying passengers or goods or carrying out special engineering operations. They do not include combination vehicles, motorcycles, wheeled special machinery vehicles, trailers, trolley buses, trams, tractors and tractor transport units, nor do they include motorized wheelchairs for the disabled and electric bicycles that meet the relevant national standards in terms of maximum design speed, unladen mass, and external dimensions, even if they have a power unit.

Note 2: Special-purpose vehicles include police vehicles, fire trucks, ambulances, engineering rescue vehicles, and other vehicles used for special transportation tasks or special operations, as well as other special purposes.

3.4 Smart mobile terminal

A terminal that can access the mobile communication network, has an operating system that provides application programmers development interfaces, and has the ability to install, load, and run application software. [Source: YD/T 3228-2023, 3.4]

3.5 Vehicle smart mobile terminal

An electronic device installed in a vehicle, equipped with computing, storage, and input/output interfaces, and capable of supporting over-the-air update applications.

6.1 Update package

The detailed requirements are as follows:

a) It shall have mechanisms to protect authenticity and integrity;

b) It shall not contain hard-coded sensitive information (e.g. private keys) or code debugging information;

c) The update package shall be checked for hidden debugging interfaces to ensure it does not contain debugging sections, symbol tables, or similar content.

d) Debugging interfaces and debugging log outputs shall be disabled by default;

e) It shall not contain any unremediated vulnerabilities rated as high severity or above that have been disclosed more than six months earlier by authoritative vulnerability platforms.

Note 1: The vulnerability risk severity levels are specified in relevant national standards such as GB/T 30279.

Note 2: Authoritative vulnerability platforms include National Vulnerability DataBase (NVDB), China Automobile Vulnerability Database (CAVD), which are recognized by the competent authorities.

f) It should incorporate code protection mechanisms, such as anti-decompilation measures;

g) It should undergo code security audit and comply with the requirements specified in GB/T 39412-2020.

6.2 Internet of vehicles over-the-air update platform

6.2.1 General requirements

The detailed requirements are as follows:

a) It shall comply with the Level 3 security-related requirements specified in GB/T 47324-2026.

b) It shall verify the authenticity of update packages and associated files (e.g. update package release notes).

c) It shall verify the integrity of update packages and associated files (e.g. update package release notes), and shall provide timely alerts when integrity is compromised.

d) It shall be capable of verifying the authenticity of the identity of over-the-air update applications to prevent spoofed over-the-air update applications from obtaining update packages and associated files. If verification of the authenticity of an over-the-air update application's identity fails, it shall promptly terminate the service response and record the abnormal information.

6.2.2 Access control

The detailed requirements are as follows:

a) An access control mechanism shall be set up to configure access control policies for update packages on the internet of vehicles over-the-air update platform and prevent unauthorized access to update packages;

b) A privilege separation mechanism shall be set up to allow for independent update and operation permissions for different vehicle models and different update packages, thereby preventing unauthorized updates;

c) A security management and control mechanism shall be provided to configure account and session policies and mitigate the risks of privilege abuse and insufficient traceability;

d) Different update permissions should be assigned to different vehicles to prevent unauthorized updates.

6.2.3 Security audit

The detailed requirements are as follows:

a) Auditing shall be conducted on all operations performed on update packages within the internet of vehicles over-the-air update platform, such as the uploading, downloading, modification, and deletion of update packages;

b) Auditing shall be conducted on the connection and transmission processes during the update process, such as auditing whether the connection between the internet of vehicles over-the-air update platform and the over-the-air update application has been authenticated;

c) Auditing shall be conducted on the execution of over-the-air updates, including pre-update and post-update status information, software version details, initiator of the update, date and time of the update, and execution results;

d) Auditing shall be conducted on errors, faults, alarms, failures, and security event logs generated during the update process;

e) Audit records shall be retained for 10 years after the discontinuation of production of the corresponding vehicle model and shall be protected by appropriate security measures.

6.2.4 Data security

The detailed requirements are as follows:

a) A graded protection mechanism shall be implemented for the data of the internet of vehicles over-the-air update platform;

b) Multi-factor authentication and role-based access control shall be applied to the source code of over-the-air update software, and unauthorized access shall be prevented;

c) The source code of over-the-air update software shall not contain hard-coded digital certificates, keys, critical parameters, or similar sensitive information, so as to ensure data confidentiality;

d) A unique identifier shall be assigned to the source code of over-the-air update software, and version records shall be maintained to ensure the traceability of the update process.

6.3 Communication link

6.3.1 Communication network

The detailed requirements are as follows:

a) If 4G is used, the security requirements of YD/T 2910-2015 shall be met;

b) If 5G is used, the security requirements of YD/T 4958-2024 shall be met;

c) A dedicated network should be used to provide communication isolation for the communication link used for over-the-air update command interactions. […]