Threat Analysis of Over-the-Air Updates in Distributed, Domain-Based, and Zonal E/E Architectures

Modern vehicles depend on over-the-air (OTA) updates to maintain security, safety, and functionality, but the attack surface of an update campaign depends on the underlying electrical/electronic architecture and on the controls assumed for update orchestration. This article reports a bounded, model-based TARA study for distributed, domain-based, and zonal vehicle architectures, which is implemented in Medini Analyze and interpreted against ISO/SAE 21434, UNECE Regulations R155 and R156, and ISO 24089 guidance. The comparison unit is not an architecture’s absolute security level. It is the architecture-conditioned instantiation of OTA trust anchors, update paths, STRIDE threat classes, evidence obligations, control-dependency assumptions, and sensitivity of model outputs under a harmonized TARA workflow. The model indicates that distributed architectures expose heterogeneous endpoints and legacy buses, and domain architectures reduce endpoint sprawl while elevating telematics and domain controllers as trust anchors. Moreover, zonal architectures can consolidate orchestration and monitoring under hardening assumptions while concentrating assurance obligations around high-performance computers, backbones, and Zone Controllers. Sensitivity checks show that raw threat counts, High/Critical counts, and severity distributions are model-granularity- and assumption-sensitive; they are therefore reported as diagnostics for traceability and evidence planning, not as real-world security rankings. The contribution is a reproducible interpretation of where OTA threat instances, trust boundaries, and regulatory evidence burdens move as vehicle E/E architectures change.