Parent Service Package: SU08
< < SU07.1 : SU08.1 : SU09.1 > >

SU08.1: Security and Credentials Management Implementation

This 'implementation' is a holistic view of the SU08 service package, including all Physical Objects, Functional Objects, and Triples associated with the service package. It distinguishes between items that are fundamental to the service and items that are optional. Your specific implementation is likely to include the fundamental items and selected optional items, based on your specific project requirements.

Relevant Regions:

Enterprise

Development Stage Roles and Relationships

Installation Stage Roles and Relationships

Operations and Maintenance Stage Roles and Relationships
(hide)

Source Destination Role/Relationship
Cooperative ITS Credentials Management System MaintainerCooperative ITS Credentials Management System Maintains
Cooperative ITS Credentials Management System ManagerCooperative ITS Credentials Management System Manages
Cooperative ITS Credentials Management System ManagerCredentials Management System Operator System Usage Agreement
Cooperative ITS Credentials Management System OwnerCooperative ITS Credentials Management System Maintainer System Maintenance Agreement
Cooperative ITS Credentials Management System OwnerCooperative ITS Credentials Management System Manager Operations Agreement
Cooperative ITS Credentials Management System OwnerITS Object Maintainer Maintenance Data Exchange Agreement
Cooperative ITS Credentials Management System OwnerITS Object Owner Security Credentials License and Usage Agreement
Cooperative ITS Credentials Management System OwnerITS Object User Service Usage Agreement
Cooperative ITS Credentials Management System OwnerOther Credentials Management Systems Maintainer Maintenance Data Exchange Agreement
Cooperative ITS Credentials Management System OwnerOther Credentials Management Systems Operator Application Usage Agreement
Cooperative ITS Credentials Management System OwnerOther Credentials Management Systems Owner Information Exchange Agreement
Cooperative ITS Credentials Management System OwnerOther Credentials Management Systems User Service Usage Agreement
Cooperative ITS Credentials Management System SupplierCooperative ITS Credentials Management System Owner Warranty
Credentials Management System OperatorCooperative ITS Credentials Management System Operates
Identifier Registry MaintainerIdentifier Registry Maintains
Identifier Registry ManagerIdentifier Registry Manages
Identifier Registry ManagerIdentifier Registry Operator System Usage Agreement
Identifier Registry OperatorIdentifier Registry Operates
Identifier Registry OwnerCooperative ITS Credentials Management System Maintainer Maintenance Data Exchange Agreement
Identifier Registry OwnerCooperative ITS Credentials Management System Owner Information Provision Agreement
Identifier Registry OwnerCooperative ITS Credentials Management System User Service Usage Agreement
Identifier Registry OwnerCredentials Management System Operator Application Usage Agreement
Identifier Registry OwnerIdentifier Registry Maintainer System Maintenance Agreement
Identifier Registry OwnerIdentifier Registry Manager Operations Agreement
Identifier Registry SupplierIdentifier Registry Owner Warranty
ITS Object MaintainerITS Object Maintains
ITS Object ManagerITS Object Manages
ITS Object OwnerCooperative ITS Credentials Management System Maintainer Maintenance Data Exchange Agreement
ITS Object OwnerCooperative ITS Credentials Management System Owner Expectation of Information Provision
ITS Object OwnerCooperative ITS Credentials Management System User Service Usage Agreement
ITS Object OwnerCredentials Management System Operator Application Usage Agreement
ITS Object OwnerITS Object Maintainer System Maintenance Agreement
ITS Object OwnerITS Object Manager Operations Agreement
ITS Object SupplierITS Object Owner Warranty
Other Credentials Management Systems MaintainerOther Credentials Management Systems Maintains
Other Credentials Management Systems ManagerOther Credentials Management Systems Manages
Other Credentials Management Systems ManagerOther Credentials Management Systems Operator System Usage Agreement
Other Credentials Management Systems OperatorOther Credentials Management Systems Operates
Other Credentials Management Systems OwnerCooperative ITS Credentials Management System Maintainer Maintenance Data Exchange Agreement
Other Credentials Management Systems OwnerCooperative ITS Credentials Management System Owner Information Exchange Agreement
Other Credentials Management Systems OwnerCooperative ITS Credentials Management System User Service Usage Agreement
Other Credentials Management Systems OwnerCredentials Management System Operator Application Usage Agreement
Other Credentials Management Systems OwnerOther Credentials Management Systems Maintainer System Maintenance Agreement
Other Credentials Management Systems OwnerOther Credentials Management Systems Manager Operations Agreement
Other Credentials Management Systems SupplierOther Credentials Management Systems Owner Warranty

Physical

The physical diagram can be viewed in SVG or PNG format and the current format is SVG.
SVG Diagram
PNG Diagram


Display Legend in SVG or PNG

Includes Physical Objects:

Physical Object Class Description
Cooperative ITS Credentials Management System Support The 'Cooperative ITS Credentials Management System' (CCMS) is a high-level aggregate representation of the interconnected systems that enable trusted communications between mobile devices and other mobile devices, roadside devices, and centers and protect data they handle from unauthorized access. Representing the different interconnected systems that make up a Public Key Infrastructure (PKI), this physical object represents an end user view of the credentials management system with focus on the exchanges between the CCMS and user devices that support the secure distribution, use, and revocation of trust credentials.
Credentials Management System Operator Support The 'Credentials Management System Operator' represents the person or people that monitor and manage the Cooperative ITS Credentials Management System. These personnel monitor and manage the secure distribution, use, and revocation of trust credentials.
Identifier Registry Support The 'Identifier Registry' maintains identifiers that must be unique to facilitate interoperability in the connected vehicle environment.
ITS Object ITS The general 'ITS Object' includes core capabilities common to any class of object.
Other Credentials Management Systems Support Representing another Cooperative ITS Credentials Management System (CCMS), 'Other Credentials Management Systems' is intended to provide a source and destination for information exchange between peer credentials management systems. It supports modeling of projects or regions that include multiple interconnected CCMS that manage credentials distribution and management in the connected vehicle environment.

Includes Functional Objects:

Functional Object Description Physical Object
CCMS Authorization 'CCMS Authorization' components provide authorization credentials (e.g., pseudonym certificates) to end entities. The end entity applies for and obtains authorization credentials, enabling the end entity to enter the “Operational” state. This function requires an interactive dialog, including at minimum a Certificate Request from the end entity desiring certificates. This request will be checked for validity, with the embedded enrollment certificate checked against an internal blacklist. If all checks are passed, this function will distribute a bundle of linked pseudonym certificates suitable for use by the requesting end entity, with the characteristics and usage rules of those certificates dependent on the operational policies of the CCMS. It also provides the secure provisioning of a given object’s Decryption Key in response to an authorized request from that object. The retrieved Decryption Key will be used by the receiving object to decrypt the “next valid” batch within the set of previously retrieved Security Credential batches. Cooperative ITS Credentials Management System
CCMS Misbehavior Reporting and Action 'CCMS Misbehavior Reporting and Action' components process misbehavior reports from end entities. Misbehavior reports are analyzed and investigated if warranted. Investigated misbehavior reports are correlated with end entities and systemic issues are identified. If revocation is warranted, this component provides information to Authorization or Revocation components to initiate revocation and/or blacklisting, as appropriate. Cooperative ITS Credentials Management System
CCMS Provisioning 'CCMS Provisioning' components provide the end entity with material that allows it to enter the 'Unenrolled' state. This consists of root certificates and the crypto material that allows it to communicate securely with the Enrollment components. This function ensures the requesting entity meets requirements for provisioning and provides the certificates and relevant policy information to entities that meet the requirements. Cooperative ITS Credentials Management System
CCMS Revocation 'CCMS Revocation' components generate the internal blacklist and Certificate Revocation List (CRL) and distribute them to other CCMS components and end entities. Once placed on the CRL, an end entity is in the Unauthorized state. Once placed on the blacklist, an end entity is in the Unenrolled state. Cooperative ITS Credentials Management System
ITS Management Support 'ITS Management Support' provides management of the ITS Object. This includes management of regulatory information and policies, management of application processes, management of communication system configuration and update management, communications interfaces, protocol-specific techniques to ensure interoperability such as service advertisements, communications congestion management and interference management, local device states and communications information, billing management, fault management, service level and performance monitoring. ITS Object
ITS Security Support 'ITS Security Support' provides communications and system security functions to the ITS Object, including privacy protection functions. It may include firewall, intrusion management, authentication, authorization, profile management, identity management, cryptographic key management. It may include a hardware security module and security management information base. ITS Object

Includes Information Flows:

Information Flow Description
authorization coordination Sharing of pseudonym certificate policies and end entity enrollments and revocations to support authorization of end entities that are enrolled with another trusted CCMS.
credentials management operator input User input from the credentials management system operator including requests to monitor current system operation and inputs to affect system operation.
credentials management operator presentation Presentation of information to the credentials management system operator including current operational status of the credentials management system.
misbehavior analysis coordination Sharing of misbehavior policy, reports, and analysis results, including suspected and convicted end entities and other information that coordinates misbehavior detection, analysis, and resolution with another CCMS.
misbehavior report Notification of potential security issues encountered in processing messages, including message authentication or integrity failures, plausibility failures, or other issues appropriate to the CCMS’ misbehavior policies.
revocation coordination Sharing of revocation policies, Certificate Revocation Lists (CRLs), and internal blacklists, and other information that supports revocation process coordination with another CCMS.
security credential revocations Certificate Revocation List; lists the certificates whose trust has been revoked by the CCMS.
security credentials The material used by an end-entity (vehicle, personal device, field device, center system etc.) to ensure privacy, integrity and authenticability of its data transmissions. This includes certificates with associated public and private verifying/signing and decrypting/encrypting keys.
security policy and networking information Security policy information describing the CCMS’ enrollment, authorization, misbehavior and revocation policies, and communications information related to CCMS components; including contact information and public credentials of those components.
service identifiers Identifiers assigned to particular services, and the context necessary when and how to use these identifiers.

Goals and Objectives

Associated Planning Factors and Goals

Planning Factor Goal

Associated Objective Categories

Objective Category

Associated Objectives and Performance Measures

Objective Performance Measure

 
Since the mapping between objectives and service packages is not always straight-forward and often situation-dependent, these mappings should only be used as a starting point. Users should do their own analysis to identify the best service packages for their region.

Needs and Requirements

Need Functional Object Requirement

Related Sources

Document Name Version Publication Date
None


Security

In order to participate in this service package, each physical object should meet or exceed the following security levels.

Physical Object Security
Physical Object Confidentiality Integrity Availability Security Class
Cooperative ITS Credentials Management System  
Identifier Registry  
ITS Object  
Other Credentials Management Systems  



In order to participate in this service package, each information flow triple should meet or exceed the following security levels.

Information Flow Security
Source Destination Information Flow Confidentiality Integrity Availability
Basis Basis Basis
Cooperative ITS Credentials Management System Credentials Management System Operator credentials management operator presentation Not Applicable High High
System core flows should have some protection from casual viewing, as otherwise imposters could gain illicit control over core equipment Backoffice operations flows should generally be correct and available as these are the primary interface between operators and system. Backoffice operations flows should generally be correct and available as these are the primary interface between operators and system.
Cooperative ITS Credentials Management System ITS Object security credential revocations Low High High
Revocations should be available to all entities in the C-ITS environment. There may be a point where a third party may learn something they shouldn't by observing this flow, but such a use case has not been defined to date. Thus, LOW. Revocations must be correct, or one of two potentially disastrous scenarios could occur: an entity with important information becomes untrusted and receivers ignore messages with high potential impact, or an untrustworty transmitter maintains its ability to be listened to, and receivers erroneously react to messages from what should be an untrustworthy source. It is unlikely that revocations will be sent more than a few times per day. However, when provided the information needs to be delivered, or the receiving party may trust entities that have been revoked and should not trust.
Cooperative ITS Credentials Management System ITS Object security credentials High High Moderate
Credentials need to be delivered to their intended target only. Interception and potential use by a third party compromises the C-ITS trust model. Credentials need to be correct and intact on delivery, or they will not be functional. Without functional credentials, the end entity cannot operate Credentials will be granted as needed but generally not in real-time; that is, an end entity will request credentials a significant time in advance of actually needing them. Thus, occasional downtime can be managed. For those entities accessing the Credentials Registry through wireless mediums only, the additional uncertainties provided by those mediums reinforce MODERATE availability.
Cooperative ITS Credentials Management System ITS Object security policy and networking information Low High High
Policy information is expected to be made generally available to all C-ITS devices. Likely no harm in observation by actors outside of ITS. Certificate policy for example is often openly published. Policy information must be correct, or end entities may make decisions that lead to them becoming untrusted, which if occuring over a wide scale, would cripple the C-ITS environment. Policy information distribution must occur prior to an end entity encountering a change in policy. For example, at border crossings.
Cooperative ITS Credentials Management System Other Credentials Management Systems authorization coordination High High High
Coordination of credentialing and revocation should be maintained between the trust authorities and no one else. Outside observers may learn CCMS behaviors and may gain understanding of the timings between revocation/granting at one authority vs. propogation to another, which may enable attacks. Coordination of credentialing and revocation needs to be correct at all times, or trust/lack-of-trust may not be correctly propagated and end entities improperly served. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment. Coordination of credentialing and revocation needs to be correct at all times, or trust/lack-of-trust may not be correctly propagated and end entities improperly served. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment.
Cooperative ITS Credentials Management System Other Credentials Management Systems misbehavior analysis coordination High High High
Coordination of misbehavior handling should be maintained between the trust authorities and no one else. Outside observers may learn CCMS behaviors related to misbehavior analysis and detection, and devise attacks to exploit that behavior. Coordination of misbehavior analysis needs to be correct at all times, or trust/lack-of-trust may not be correctly revoked. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment. Coordination of misbehavior analysis needs to be correct at all times, or trust/lack-of-trust may not be correctly revoked. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment.
Cooperative ITS Credentials Management System Other Credentials Management Systems revocation coordination High High High
Coordination of credentialing and revocation should be maintained between the trust authorities and no one else. Outside observers may learn CCMS behaviors and may gain understanding of the timings between revocation/granting at one authority vs. propogation to another, which may enable attacks. Coordination of credentialing and revocation needs to be correct at all times, or trust/lack-of-trust may not be correctly propagated and end entities improperly served. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment. Coordination of credentialing and revocation needs to be correct at all times, or trust/lack-of-trust may not be correctly propagated and end entities improperly served. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment.
Credentials Management System Operator Cooperative ITS Credentials Management System credentials management operator input Not Applicable High High
System core flows should have some protection from casual viewing, as otherwise imposters could gain illicit control over core equipment Backoffice operations flows should generally be correct and available as these are the primary interface between operators and system. Backoffice operations flows should generally be correct and available as these are the primary interface between operators and system.
Identifier Registry Cooperative ITS Credentials Management System service identifiers Low High Low
Likely openly published information. Identifiers are used with associated permissions to determine who/what can perform various activities. A compromise in this information would significantly compromise all of C-ITS that was affected. Identifiers are expected to be updated infrequently, thus requiring only intermittent connectivity to the CCMS.
ITS Object Cooperative ITS Credentials Management System misbehavior report Moderate Moderate Low
Misbehavior reports will contain some kind of identification, in many cases pseudonyms, but at some point in the life cycle linkable to a device and device owner. Even if a pseudonym is the reference, the contents of the report should not be openly readable as compromised could be used to further abuse the target, such as by spamming other (false) misbehavior reports, or simply not trusting that party when the actual trust anchor has made no such determination. Misbheavior reports provide the basic data for misbehavior analysis, the purpose of which is the removal of misbehaving or malfunctioning actors from the C-ITS environment. So naturally the misbehavior report must be correct. This is not HIGH because presumably, multiple reports must be received regarding the same actor in order to process a revocation. Successful revocation depends on receipt of accurate and timely misbehavior reports. Reports from center-based objects are more likely to be taken with greater weight, and due to the structure of the system, also likely to be less frequent. This makes center-based reports more dependent on availability, so center-based reports receive a MODERATE availability, while those from more frequent generating field sources (RSEs, OBEs, PIDs etc.) LOW availability.
Other Credentials Management Systems Cooperative ITS Credentials Management System authorization coordination High High High
Coordination of credentialing and revocation should be maintained between the trust authorities and no one else. Outside observers may learn CCMS behaviors and may gain understanding of the timings between revocation/granting at one authority vs. propogation to another, which may enable attacks. Coordination of credentialing and revocation needs to be correct at all times, or trust/lack-of-trust may not be correctly propagated and end entities improperly served. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment. Coordination of credentialing and revocation needs to be correct at all times, or trust/lack-of-trust may not be correctly propagated and end entities improperly served. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment.
Other Credentials Management Systems Cooperative ITS Credentials Management System misbehavior analysis coordination High High High
Coordination of misbehavior handling should be maintained between the trust authorities and no one else. Outside observers may learn CCMS behaviors related to misbehavior analysis and detection, and devise attacks to exploit that behavior. Coordination of misbehavior analysis needs to be correct at all times, or trust/lack-of-trust may not be correctly revoked. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment. Coordination of misbehavior analysis needs to be correct at all times, or trust/lack-of-trust may not be correctly revoked. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment.
Other Credentials Management Systems Cooperative ITS Credentials Management System revocation coordination High High High
Coordination of credentialing and revocation should be maintained between the trust authorities and no one else. Outside observers may learn CCMS behaviors and may gain understanding of the timings between revocation/granting at one authority vs. propogation to another, which may enable attacks. Coordination of credentialing and revocation needs to be correct at all times, or trust/lack-of-trust may not be correctly propagated and end entities improperly served. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment. Coordination of credentialing and revocation needs to be correct at all times, or trust/lack-of-trust may not be correctly propagated and end entities improperly served. Depending on the scale of the integrity/availability failure, this could affect a small or large amount of the C-ITS environment.

Standards

The following table lists the standards associated with physical objects in this service package. For standards related to interfaces, see the specific information flow triple pages. These pages can be accessed directly from the SVG diagram(s) located on the Physical tab, by clicking on each information flow line on the diagram.

NameTitlePhysical Object
FIPS 140-2 Security Requirements for Cryptographic Modules ITS Object
ISO 21217 Architecture Intelligent transport systems -- Communications access for land mobiles (CALM) -- Architecture ITS Object




System Requirements

No System Requirements