How ISO 21217 works

Please view as a “Slide Show”

CEN PT1605
The basic situation
• Two devices cooperate in a trusted way, i.e. exchange information in
secure application sessions.

September 2018 SSTD - Budapest 2

Example: Multiple after-market services
using OEM installed SVI Manufacturer CV /
Services C-ITS
Applications Applications

Facilities Facilities

Management
Management

Security
Security
In-vehicle domain
Network & Network &

External domain
(security & translation )
Transport
Applications Transport
Access
Proprietary stack

Access

Management Facilities Diagnostic Insurance Fleet Mngt

Security
Applications Applications Applications
Network &
Transport Facilities Facilities Facilities

Management

Management

Management
Security

Security

Security
Network & Network & Network &
Access Transport Transport Transport
Access Access Access

Proprietary
Network
Proprietary
Network
Proprietary
Network
SVI
Node Node Node Interface can be wireless (DSRC, WiFI, 4G/5G, OBD, etc)
Security: CV/C-ITS
Applications

Authentication / Facilities

Manageme

Security
Network &

Authorization

nt
Transport
Access

Fleet Mngt
Applications Policy
Facilities

Manageme

Security
Network &

nt
(security & translation )

Transport
Applications Access
Proprietary stack

Insurance
Facilities
Applications
Management

Security

Network & Facilities

Managemen

Security
Network &
Transport

t
Transport
Access
Access Diagnostic
Applications

Facilities

Managemen

Security
Network &

t
Transport
Access
 Proof: valid C-ITS Application
Security: CV/C-ITS
Applications

Authentication / Facilities

Manageme

Security
Network &

Authorization

nt
Transport
Access

Fleet Mngt
Applications Policy
Facilities

Manageme

Security
Network &

nt
(security & translation )

Transport
Applications Access
Proprietary stack

Insurance
Facilities
Applications
Management

Security

Network & Facilities

Managemen

Security
Network &
Transport

t
Transport
Access
Access Diagnostic
Applications

Facilities

Managemen

Security
Network &

t
Transport
Access
 Proof: valid C-ITS Application
Security: CV/C-ITS
Applications

Authentication / Facilities

Manageme

Security
Network &

Authorization

nt
Transport
Access

Fleet Mngt
Certificate
Applications Policy
Facilities

Manageme

Security
Network &

nt
(security & translation )

Transport
Applications Access
Proprietary stack

Insurance
Facilities
Applications
Management

Security

Network & Facilities

Managemen

Security
Network &
Transport

t
Transport
Access
Access Diagnostic
Applications

Facilities

Managemen

Security
Network &

t
Transport
Access
 Proof: valid C-ITS Application
Security: CV/C-ITS
Applications

Authentication / Facilities

Manageme

Security
Network &

Authorization

nt
Transport
Access

Fleet Mngt
Certificate
I have a C-
ITS Applications Policy
Facilities
certificate

Manageme

Security
Network &

nt
(security & translation )

Transport
Applications Access
Proprietary stack

Insurance
Facilities
Applications
Management

Security

Network & Facilities

Managemen

Security
Network &
Transport

t
Transport
Access
Access Diagnostic
Applications

Facilities

Managemen

Security
Network &

t
Transport
Access
 Proof: valid C-ITS Application
Security: CV/C-ITS
Applications

Authentication / Facilities

Manageme

Security
Network &

Authorization

nt
Transport
Access

Fleet Mngt
Certificate
I have a C-
ITS Applications Policy
Facilities
certificate

Manageme

Security
Network &

nt
(security & translation )

Transport
Applications Access
Proprietary stack

Insurance
Facilities
Applications
Management

Security

Network & Facilities

Managemen

Security
Network &
Transport

t
You can Transport
Access
Access do C-ITS
activities Diagnostic
Applications

Facilities

Managemen

Security
Network &

t
Transport
Access
 I have a Fleet
Security: Management
certificate
CV/C-ITS
Applications
I’m owned
Authentication / by Facilities
the right

Manageme

Security
Network &

Authorization fleet owner

nt
Transport
Access Valid fleet
Fleet Mngt management
Applications
device Policy
Facilities

Manageme

Security
Network &

nt
(security & translation )

Transport
Applications Access
Proprietary stack

Insurance
Facilities
Applications
Management

Security

Network & Facilities

Managemen

Security
Network &
Transport

t
Transport
Access
Access Diagnostic Ownership
Applications

Facilities

Managemen

Security
Network &

t
Transport
Access
 I have a Fleet
Security: Management
certificate
CV/C-ITS
Applications
I’m owned
Authentication / by Facilities
the right

Manageme

Security
Network &

Authorization fleet owner

nt
Transport
Access Valid fleet
Fleet Mngt management
Applications
device Policy
Facilities

Manageme

Security
Network &

nt
(security & translation )

Transport
Applications Access
Proprietary stack

Insurance
Facilities
Applications
Management

Security

Network & Facilities

Managemen

Security
Network &
Transport You can do

t
Transport
Fleet Access
Access Management Diagnostic Ownership
activities Applications

Facilities

Managemen

Security
Network &

t
Transport
Access
 I have a
Security: Diagnostics
CV/C-ITS
Applications

Authentication / certificate Facilities

Manageme

Security
Network &

Authorization

nt
Transport
Access

Fleet Mngt
Applications

Facilities

Manageme

Security
Network &

nt
Valid diagnostic
(security & translation )

Transport
Applications Access
Policy
Proprietary stack

Insurance device
Facilities
Applications
Management

Security

Network & Facilities

Managemen

Security
Network &
Transport

t
Transport
Access
Access Diagnostic
Applications

Facilities

Managemen

Security
Network &

t
Transport
Access
Ownership
 I have a
Security: Diagnostics
CV/C-ITS
Applications

Authentication / certificate Facilities

Manageme

Security
I’m owned
Network &

Authorization

nt
Transport
by the right
Access
repair shop
Fleet Mngt
Applications

Facilities

Manageme

Security
Network &

nt
Valid diagnostic
(security & translation )

Transport
Applications Access
Policy
Proprietary stack

Insurance device
Facilities
Applications
Management

Security

Network & Facilities

Managemen

Security
Network &
Transport

t
Transport
Access
Access Diagnostic
Applications

Facilities

Managemen

Security
Network &

t
Transport
Access
Ownership
 I have a
Security: Diagnostics
CV/C-ITS
Applications

Authentication / certificate Facilities

Manageme

Security
I’m owned
Network &

Authorization

nt
Transport
by the right
Access
… and I’m
repair shop right next to
Fleet Mngt you
Applications

Facilities

Manageme

Security
Network &

nt
Valid diagnostic
(security & translation )

Transport
Applications Access
Policy
Proprietary stack

Insurance device
Facilities
Applications
Management

Security

Network & Facilities

Managemen

Security
Network &
Transport

t
Transport
Access
Access Diagnostic
Applications

Facilities

Managemen

Security
Network &

t
Transport
Access
Ownership
 I have a
Security: Diagnostics
CV/C-ITS
Applications

Authentication / certificate Facilities

Manageme

Security
I’m owned
Network &

Authorization

nt
Transport
by the right
Access
… and I’m
repair shop right next to
Fleet Mngt you
Applications

Facilities

Manageme

Security
Network &

nt
Valid diagnostic
(security & translation )

Transport
Applications Access
Policy
Proprietary stack

Insurance device
Facilities
Applications
Management

Security

Network & Facilities

Managemen

Security
Network &
Transport

t
You can do Transport
Access
Access Diagnostic
activities Diagnostic
Applications

Facilities

Managemen

Security
Network &

t
Transport
Access
Ownership
ISO 21177
• Uses internet-standard secure
communications protocol, Transport Layer ITS-SU

Security (TLS) 1.3

• Enables use of C-ITS (IEEE 1609.2)
certificates to directly state permissions Responder Application Initiator Application

• More appropriate than identity-based

Access Access
Security Control Control Security
Policy Policy
permissions in Mobile Ad Hoc Network
Subsystem Subsystem

(MANET) setting Resource(s)

ISO 21177 Security
Adaptor Layer
ISO 21177 Security
Adaptor Layer
Resource(s)

• Allows each party to present a series of Secure Session (TLS

Server)
Secure Session (TLS

certificates to establish a detailed

Client)

“authorization state” with the other party

• Becoming adopted by application standards
• SAE J2945/3 – authenticate / authorize weather
reporting applications
 Requirements
• Secure sessions – confidentiality,
Application
integrity, authorization, anti-replay
• Each party can establish the
Pre-send security
Access Control
processing Security Subsystem
Post-receive security Policy
processing
permissions of the other
Access Access
APDU APDU
out in
Control
out
Control
in • Each party can present multiple
authorization statements and maintain
“authorization state” with respect to
ISO 21177 Security Adaptor Layer

SAPDU TLS handshake proxy

SAPDU the other party
out in
• A secure session can be bootstrapped
TLS within another secure session so
eavesdroppers learn nothing, not even
what application is acting
 Requirements
• Secure sessions – confidentiality,
Application
integrity, authorization, anti-replay
• Each party can establish the
Pre-send security
Access Control
processing Security Subsystem
Post-receive security Policy
processing
permissions of the other
Access Access
APDU APDU
out in
Control
out
Control
in • Each party can present multiple
authorization statements and maintain
“authorization state” with respect to
ISO 21177 Security Adaptor Layer

SAPDU TLS handshake proxy

SAPDU the other party
out in
• A secure session can be bootstrapped
TLS within another secure session so
eavesdroppers learn nothing, not even
what application is acting
 Requirements
• Secure sessions – confidentiality,
Application
integrity, authorization, anti-replay
• Each party can establish the
Pre-send security
Access Control
processing Security Subsystem
Post-receive security Policy
processing
permissions of the other
Access Access
APDU APDU
out in
Control
out
Control
in • Each party can present multiple
authorization statements and maintain
“authorization state” with respect to
ISO 21177 Security Adaptor Layer

SAPDU TLS handshake proxy

SAPDU the other party
out in
• A secure session can be bootstrapped
TLS within another secure session so
eavesdroppers learn nothing, not even
what application is acting
 Requirements
• Secure sessions – confidentiality,
Application
integrity, authorization, anti-replay
• Each party can establish the
Pre-send security
Access Control
processing Security Subsystem
Post-receive security Policy
processing
permissions of the other
Access Access
APDU APDU
out in
Control
out
Control
in • Each party can present multiple
authorization statements and maintain
“authorization state” with respect to
ISO 21177 Security Adaptor Layer

SAPDU TLS handshake proxy

SAPDU the other party
out in
• A secure session can be bootstrapped
TLS within another secure session so
eavesdroppers learn nothing, not even
what application is acting
 Requirements
• Secure sessions – confidentiality,
Application
integrity, authorization, anti-replay
• Each party can establish the
Pre-send security
Access Control
processing Security Subsystem
Post-receive security Policy
processing
permissions of the other
Access Access
APDU APDU
out in
Control
out
Control
in • Each party can present multiple
authorization statements and maintain
“authorization state” with respect to
ISO 21177 Security Adaptor Layer

SAPDU TLS handshake proxy

SAPDU the other party
out in
• A secure session can be bootstrapped
TLS within another secure session so
eavesdroppers learn nothing, not even
what application is acting
Security: Authentication / Authorization
• Policy authorities and certificate authorities
are already being established to support C-ITS
• This organizational structure can also support
authentication and authorization for SVI
• OEMs can enforce reasonable security Valid diagnostic Policy
policies on certificate issuance and freshness device
• OEM security concerns are real and must be
taken into account
• However, in this model OEMs are not real-
time gatekeepers of access to the information
• Nevertheless, their security requirements are
met

Ownership