The software-identification number at the heart of UN R156.
Over-the-air updates let you fix and improve a vehicle after it ships. UN R156 makes sure you can do that without opening a new way in for an attacker.
UN R156 requires an approved Software Update Management System (SUMS), the processes that govern how software updates are produced, approved and delivered safely. It is the update-side counterpart to the CSMS that UN R155/R156 requires.
Integrity and authenticity
The two properties every OTA pipeline has to guarantee are that an update is genuinely from you (authenticity) and that it has not been altered in transit (integrity). In practice that means updates are cryptographically signed, the vehicle verifies the signature before installing, and the process resists downgrade and rollback attacks that try to force older, vulnerable software back on.
Knowing what is running: RXSWIN
UN R156 introduces RXSWIN, a software-identification number that links approved software versions to a vehicle type. It is how an approval authority, and you, can tell exactly which certified software configuration a vehicle is running, and whether a change needs re-approval.
Making it practical
- Sign updates and verify them on-target before install; never trust the transport alone.
- Protect against rollback so an attacker can't re-introduce a patched flaw.
- Track RXSWIN so every shipped configuration maps to an approved one.
- Keep an audit trail: what was updated, when, and on which vehicles.
OTA security and type approval are tightly linked. A gap assessment maps your update pipeline against what R156 expects.