[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-81997-en":3,"doc-seo-81997-105":30,"detail-sidebar-cat-0-en-105":96},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},81997,687197207639,"Asher","https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd",8,"Research & Report","Zk-ScalHard Scalable and Hardware-Rooted Privacy-Preserving Authentication for Secure OTA Updates in Zonal SDVs","Automotive software-defined vehicles adopt zonal-oriented architecture to enable frequent OTA updates across 100+ ECUs, improving efficiency and patching security bugs. Yet OTA introduces safety-critical cyber risks, creates bandwidth bottlenecks in IV and V2I authentication, exposes sensitive configuration and passenger data, and relies on centralized trust that forms a single point of failure. zk-ScalHard proposes a scalable, privacy-preserving silicon-to-cloud authentication protocol using hardware-rooted PUFs and zero-knowledge proof circuits with MPC and recursive aggregation, achieving O(1) communication and GDPR-compliant privacy guarantees.","zk-ScalHard: Scalable and Hardware-Rooted Privacy-Preserving Authentication  \nfor Secure OTA Updates in Zonal SDVs  \nShrikant Tangade 1,2,3,* , Bansi Pambhar2 , Valeria Loscr`ı1 , and Mauro Conti4,5  \n1 SERENDIPITY Team, Inria Lille – Nord Europe, France  \n2autoMoTIVe-X Lab, Belagavi, India  \n3 Anuvartik Mirji Bharatesh Institute of Technology, Belagavi, India  \n4 University of Padua, Padua, Italy  \n5 ¨Orebro University, ¨Orebro, Sweden  \nEmails: {shrikant.tangade, [valeria.loscri](valeria.loscri}@inria.fr)[}](valeria.loscri}@inria.fr)[@inria.fr](valeria.loscri}@inria.fr), {shrikant.tangade, [bansi.pambhar](bansi.pambhar}@motivex.in)[}](bansi.pambhar}@motivex.in)[@motivex.in](bansi.pambhar}@motivex.in), [mauro.conti@unipd.it](mauro.conti@unipd.it)  \narXiv :2607 .0737 1v2 [ cs .CR] 10 Jul 2026  \nAbstract—Today’s automotive industry is transitioning to a zonal-oriented architecture (ZoA) for software-defined vehicles (SDVs). This enables frequent, flexible software updates for 100+ electronic control units (ECUs) via over-the-air (OTA) updates. Although OTA updates improve vehicle efficiency and fix security bugs, they can also pose security risks that may lead to safety-critical issues. To provide secure OTA updates, current industry standards include the Uptane framework and the AUTOSAR adaptive platform. These solutions are based on public-key infrastructure (PKI). However, vehicle authentication during OTA updates creates a significant bandwidth bottleneck in in-vehicle (IV) and vehicle-to-cloud (V2I) communications as ECU density increases. It also exposes a vehicle’s sensitive configuration and passenger data. Furthermore, their centralised architecture creates a single point of failure. The new Zonal SDV requires decentralised, scalable vehicle authentication with data privacy. To address these issues, we propose zk-ScalHard, a scalable and privacy-preserving silicon-to-cloud authentication protocol. To design and implement zk-ScalHard,(1) we introduce a decentralised, hybrid, and hierarchical trustpromotion architecture model which utilises hardware-rooted silicon physical unclonable functions (PUFs). We design and code two zero-knowledge proof (ZKP) circuits: (2) zonal identity and integrity (ZIDI) and (3) high-performance computing aggregation (HPCA). These ZIDI and HPCA circuits employ multi-party computation (MPC) and recursive aggregation to achieve decentralisation and scalability, respectively. The integration of ZKPs and silicon PUFs ensures 100% vehiclelevel data sovereignty. We benchmark zk-ScalHard against the industry-standard Uptane framework. Evaluation results demonstrate that zk-ScalHard achieves constant O(1) commu-  \n*Corresponding author: shrikant.tangade@motivex.in. S. Tangade is an MSCA SoE Fellow at Inria Lille, Director of the autoMoTIVe-X Lab, and a Professor at AMBIT, Belagavi, India. B. Pambhar is a Research Assistant at the autoMoTIVe-X Lab. V. Loscr`ı is the Head of the SERENDIPITY Team at Inria Lille. M. Conti is a Professor with the University of Padua and ¨Orebro University, and Head of the SPRITZ Research Group. This work was supported by the MSCA Seal of Excellence (SoE), awarded by the European Commission and funded by the University of Lille. Source code: [https:// github.com/autoMoTIVe-X/zk-ScalHard](https:// github.com/autoMoTIVe-X/zk-ScalHard).  \nnication and verification complexity, down from linear O (n). Further, it reduces authentication bandwidth and the temporal attack surface by 99.2% and 99.9%, respectively. These results demonstrate that zk-ScalHard provides a scalable, secure, and GDPR-compliant architecture for next-generation Zonal SDVs.  \n1. Introduction  \nThe next-generation automotive industry is moving towards software-defined vehicles (SDVs) . Advanced SDVs equipped with 100+ electronic control units (ECUs) are also called computers-on-wheels. Each ECU performs its task, such as automatic braking or steering control, using specific software/ firmware. This software e","cbCaidSoifD6blYL","https://ap.wps.com/l/cbCaidSoifD6blYL","pdf",690713,5,1,14,"English","en",105,"# Introduction\n## OTA updates and SDV security requirements\n## Limits of PKI-based authentication standards\n## zk-ScalHard approach and contributions","[{\"question\":\"What security problem does zk-ScalHard target for zonal SDVs?\",\"answer\":\"It targets secure authentication for OTA updates while preventing safety-critical attacks that can inject malicious software into ECUs. It also addresses privacy leakage of sensitive vehicle configuration and passenger data during authentication.\"},{\"question\":\"Why do existing OTA authentication standards create performance and privacy issues?\",\"answer\":\"PKI-based solutions introduce a bandwidth bottleneck as ECU density increases and can expose sensitive configuration and passenger information. Their centralized architecture also creates a single point of failure.\"},{\"question\":\"How does zk-ScalHard achieve scalability and privacy preservation?\",\"answer\":\"zk-ScalHard uses hardware-rooted silicon PUFs and two zero-knowledge proof circuits (ZIDI and HPCA). Multi-party computation and recursive aggregation decentralize trust and reduce communication/verification complexity to constant O(1).\"},{\"question\":\"What results demonstrate improvement over the Uptane framework?\",\"answer\":\"Benchmarking shows zk-ScalHard reduces authentication bandwidth complexity from linear to constant O(1). It also decreases authentication bandwidth and the temporal attack surface by 99.2% and 99.9%, while remaining GDPR-compliant.\"}]",1784177482,35,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":91,"head_meta":93,"extra_data":95,"updated_unix":28},"zk-scalhard-scalable-and-hardware-rooted-privacy-preserving-authentication-for-secure-ota-updates-in-zonal-sdvs","",{"@graph":36,"@context":90},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/zk-scalhard-scalable-and-hardware-rooted-privacy-preserving-authentication-for-secure-ota-updates-in-zonal-sdvs/81997/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":24,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-07-29","2026-07-16",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82,86],{"name":73,"@type":74,"acceptedAnswer":75},"What security problem does zk-ScalHard target for zonal SDVs?","Question",{"text":76,"@type":77},"It targets secure authentication for OTA updates while preventing safety-critical attacks that can inject malicious software into ECUs. It also addresses privacy leakage of sensitive vehicle configuration and passenger data during authentication.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"Why do existing OTA authentication standards create performance and privacy issues?",{"text":81,"@type":77},"PKI-based solutions introduce a bandwidth bottleneck as ECU density increases and can expose sensitive configuration and passenger information. Their centralized architecture also creates a single point of failure.",{"name":83,"@type":74,"acceptedAnswer":84},"How does zk-ScalHard achieve scalability and privacy preservation?",{"text":85,"@type":77},"zk-ScalHard uses hardware-rooted silicon PUFs and two zero-knowledge proof circuits (ZIDI and HPCA). Multi-party computation and recursive aggregation decentralize trust and reduce communication/verification complexity to constant O(1).",{"name":87,"@type":74,"acceptedAnswer":88},"What results demonstrate improvement over the Uptane framework?",{"text":89,"@type":77},"Benchmarking shows zk-ScalHard reduces authentication bandwidth complexity from linear to constant O(1). It also decreases authentication bandwidth and the temporal attack surface by 99.2% and 99.9%, while remaining GDPR-compliant.","https://schema.org",{"og:url":52,"og:type":92,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":94,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":97},[98,102,106,110,114,119,124,127,132,135,139],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},"Exam",70,"exam",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":111,"show_sort_weight":112,"slug":113},"Comic",60,"comic",{"id":115,"doc_module":4,"doc_module_name":46,"category_name":116,"show_sort_weight":117,"slug":118},6,"Technology",50,"technology",{"id":120,"doc_module":4,"doc_module_name":46,"category_name":121,"show_sort_weight":122,"slug":123},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":125,"slug":126},30,"research-report",{"id":128,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":130,"slug":131},9,"Religion & Spirituality",20,"religion-spirituality",{"id":130,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":130,"slug":134},"World Cup","world-cup",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":136,"slug":138},10,"Lifestyle","lifestyle",{"id":140,"doc_module":4,"doc_module_name":46,"category_name":141,"show_sort_weight":20,"slug":142},19,"General","general"]