An Over-the-Air Programming (OTA Programming) is a software update that is performed via a radio interface (typically Wi-Fi or cellular network). Over-the-air updates are mainly used on smartphones and similar mobile devices and use the devices’ existing Internet connection. Delta encoding is sometimes used to drastically reduce the amount of data to be transferred.
Firmware Over-the-Air (FOTA) refers to the fresh installation of the system software (firmware) on a terminal device. Devices that support this functionality are called “FOTA-compatible”. Various standards have already been agreed for FOTA, including OMA-DM from the Open Mobile Alliance (OMA). In order to use FOTA, it must be supported by the end device and the firmware already installed. The receipt of the new firmware and the subsequent installation must be able to take place. Support from the mobile network operator is not necessary. After calling a function called “update service”, for example, the new firmware is transmitted via the radio interface and then installed. It may be necessary to restart the device or re-register the SIM card.
Different Entities of an OTA Transaction
An OTA transaction involves four major entities:
---
- A sending application (SA): this is any application capable of issuing an OTA command. For example, it can be an application residing in the SIM card or simply an application interface residing at the operator;
- A receiving application (RA): this is the recipient application of the OTA command. It can therefore also be an application residing in the SIM card or simply an application interface residing at the operator;
- A sending entity (SE): it is responsible for converting the commands sent by the SA and adds the necessary security parameters for a safe sending on the network. This can be for example an SMS-SC (acting as an OTA gateway) or a simple SIM card that sends commands;
- A receiving entity (RE): this is the entity that receives secure packets from the OS. It is therefore responsible for reconstituting them and removing all the security headers previously added in order to allow the exploitation of the data.
Products and Criticism
There are a number of products that enable, for example, remote management of end devices via the OMA-DM protocol, for example to implement FOTA. Furthermore, there are also products, which combine the function of an OMA-DM server with the possibilities of OSGi and TR-069. OSGi can, for example, serve as a service-oriented architecture (SOA), which forms the framework on the end device on which an OMA DM client itself as well as other paid services can be dynamically installed and administered. This is particularly interesting if incremental updates of the device software should be possible, or if the remote maintenance possibilities of OMA DM are not sufficient.
Toyota has equipped its Lexus LS and Mirai with over-the-air technology. BMW uses over-the-air to make additional sales. Volkswagen introduced over-the-air in some models.
Over-the-air updates allow, at least theoretically, to install software with unwanted features (such as eavesdropping on the phone owner). Software packages are typically digitally signed by the manufacturer to be accepted by the device. Therefore, malicious software can only be created by someone who has the appropriate secret key.
