ISO/TS 21177:2019 高度道路交通システム—信頼できるデバイス間の安全なセッション確立と認証のためのITSステーションセキュリティサービス | ページ 3

Introduction

This document is about ITS station security services required to ensure the authenticity of the source and confidentiality and integrity of application activities taking place between trusted devices .

The trust relation between two devices is illustrated in Figure 1. Two devices cooperate in a trusted way, i.e. exchange information with optional explicit bi-directional protection.

According to ISO 21217, an ITS station unit (ITS-SU), i.e. the physical implementation of the ITS station (ITS-S) functionality, is a trusted device, and an ITS-SU may be composed of ITS station communication units (ITS-SCU) that are interconnected via an ITS station-internal network. Thus an ITS-SCU is the smallest physical entity of an ITS-SU that is referred to as a trusted device.

Four implementation contexts of communication nodes in ITS communications networks are identified in the ITS station and communication architecture ISO 21217, each comprised of ITS-station units (ITS-SU) taking on a particular role; personal, vehicular, roadside, or central. These ITS-SUs are ITS-secured communication nodes as required in ISO 21217 that participate in a wide variety of ITS services related to, e.g. sustainability, road safety and transportation efficiency.

Over the last decade, ITS services have arisen that require secure access to data from Sensor and Control Networks (SCN), e.g. from In-Vehicle Networks (IVN) and from Infrastructure/Roadside Networks (IRN), some of which require secure local access to time-critical information; see Figures 2 and 3.

Trust in the ITS domain primarily is between ITS Station Communication Units (ITS-SCUs) introduced in ISO 21217; see Figure 4.

ITS-SCUs are interconnected via an ITS station-internal network. Applying basic security means specified in this document, the ITS-SCUs trust each other. Additionally, protocol data units exchanged between ITS-SCUs may be further protected by additional means, e.g. applying encryption. Major application domains of secure communications between ITS-SCUs of the same ITS-SU are local station management specified in ISO 24102-1 ^[4] using station-internal management communications specified in ISO 24102-4 ^[7].

Trust in the ITS domain further is between ITS-SUs introduced in ISO 21217; see Figure 5.

Applying basic security means specified in this document, the ITS-SUs can establish secure application sessions. Establishment of sessions either needs a-priori knowledge about a session partner or can be achieved by means of service announcement specified in ISO 22418^[3]. Further on, broadcast of messages is secured by means of authenticating the sender of such a message, applicable for the service advertisement message (SAM) specified in ISO/TS 16460 ^[1] and used in ISO 22418^[3]. Additionally, other security means may be applied, e.g. encryption of messages.

A further trust relation in the ITS domain is between an ITS-SU consisting of one or several ITS-SCUs and a sensor and control network (SCN). Trust is achieved by applying security means in an interface as illustrated in Figure 6 with details specified in this document.

The interface presented in Figure 6 may be a stand-alone device, or may be integrated in the ITS-SU, or may be part of the SCN. Examples of SCNs are"In-Vehicle Networks" (IVN) and"Infrastructure/Roadside Networks" (IRN).

Related use cases of these ITS services have largely been derived from regulatory requirements and ITS operational needs, and they include:

• secure real-time access to time-critical vehicle-related data for safety of life and property applications, e.g. collision avoidance, emergency electronic brake light and event determination;
• secure local access to detailed real-time data for efficiency applications (traffic management), e.g. intersection interaction, congestion avoidance, dynamic priorities;
• protection of private data, e.g. in compliance with the European"General Data Protection Regulation" (GDPR)^[16];
• local access to certified real-time data for sustainability applications, e.g. dynamic emission zones (controlled zones as currently standardized in CEN TC 278 within the Project Team PT 1705 funded by the European Commission), intersection priorities based on emissions, interactive optimum vehicle settings to minimize fuel consumption.

There are many use cases of ITS services currently identified where real-time exchange of time-critical information between ITS-SUs in close proximity is essential, and the number will grow, see e.g. the US National ITS Reference Architecture^[17]. It is critical that ultimately all ITS-SUs in a given area are able to be engaged in these distributed services. This, in turn, requires vehicle ITS-SUs to have real-time access to vehicle data, and roadside ITS-SUs to have real-time access to infrastructure data. All ITS-SUs need being capable of secure software updates.

According to ISO 21217, an ITS-SCU of an ITS-SU can communicate with devices that, in a strict sense, are not compliant with the architecture specified in ISO 21217. However, in order to have trusted communications, a certain minimum level of security measures must be shared between an ITS-SCU and such an external device. Examples of such external devices are a node in the Internet, or a node in a sensor and control network. In this document, the assumption is made that ITS-S application processes operating on ITS-SUs are issued with certificates by a Certificate Authority (CA), and that the CA is a trusted third party in the sense that before issuing the certificate to the ITS-S application process, it ensures that the ITS-SU on which the ITS-S application process is resident meets the minimum security requirements for that application. This allows peer ITS-S application processes which observe that an ITS-S application process possesses a valid certificate to have a level of assurance that the ITS-S application process is in fact secure and trustworthy.

The subject of this document thus is three-fold:

• 1) Specify ITS station security services for enabling trust between ITS-S application processes running on different ITS-SCUs of the same ITS-SU, i.e. establishing a trusted processing platform, considering also trust inside an ITS-SCU:
  • protection of applications from the actions of other applications;
  • protection of shared information;
  • protection of shared processing resources such as communications software and hardware, which includes methods of prioritisation and restricted access.

• 2) Specify ITS station security services for enabling trust between ITS-S application processes running on the same ITS-SU.

• 3) Extend these ITS security services for enabling trust between an ITS-SCU and devices being part of a sensor and control network.