Standard No.:	YD/T 3957-2021
English Name:	LTE-based vehicular communication ——Technical requirement of security certificate management system
Chinese Name:	基于LTE的车联网无线通信技术 安全证书管理系统技术要求
Professional Classification:	YD    Professional Standard - Telecommunication
Source Content Issued by:	MIIT
Issued on:	2021-12-02
Implemented on:	2022-4-1
Status:	valid
Target Language:	English
File Format:	PDF
Word Count:	82500 words
Translation Price(USD):	900.0
Delivery:	via email in 1 business day

LTE-based vehicular communication - Technical requirement of security certificate management system 1 Scope This document specifies the technical requirement of LTE-based vehicular security certificate management system, mainly including the architecture of the security certificate management system and the related explicit certificate format and interaction process. This document is applicable to LTE-V2X equipment and security certificate management systems. 2 Normative references The following documents contain provisions which, through reference in this text, constitute provisions of this document. For dated references, only the edition cited applies. For undated references, the latest edition (including any amendments) applies. GB/T 16262 (All parts) Information technology - Abstract syntax notation one (ASN.1) GB/T 25056 Information security technology - Specifications of cryptograph and related security technology for certificate authentication system GB/T 32905 Information security techniques - SM3 cryptographic hash algorithm GB/T 32907 Information security technology - SM4 block cipher algorithm GB/T 32918 (All parts) Information security technology - Public key cryptographic algorithm SM2 based on elliptic curves GB/T 36624 Information technology - Security techniques - Authenticated encryption YD/T 3707-2020 Technical requirements of network layer of LTE-based vehicular communication 3GPP TS 33.220 Generic Authentication Architecture (GAA): Generic Bootstrapping Architecture (GBA) ISO/EC8825-7 Information technology - ASN.1 encoding rules Part 7: Specification of Octet Encoding Rules (OER) 3 Terms, definitions and abbreviations 3.1 Terms and definitions For the purposes of this document, the following terms and definitions apply. 3.1.1 V2X equipment safety equipment for on board unit (OBU), road side unit (RSU) and V2X service provider (VSP) 3.1.2 V2X communication certificate various certificates related to V2X communication and issued by certificate authority to V2X Equipment, for example, enrollment certificate, pseudonym certificate, application certificate and identity certificate 3.2 Abbreviations For the purposes of this document, the following abbreviation applies. AAA Authentication and Authorization Authority AC Application Certificate ACA Application Certificate Authority AID Application Identifier API Application Programming Interface ARA Application Certificate Registration Authority ASN.1 Abstract Syntax Notation dot one BSF Bootstrapping Server Function BSM Basic Safety Message CA Certificate Authority CRA Certificate Revocation Authority CRL Certificate Revocation List CTL Certificate Trust List DCM Device Configuration Manager EC Enrolment Certificate ECA Enrolment Certificate Authority GBA Generic Bootstrapping Architecture HTTP Hyper Text Transfer Protocol HTTPS Hyper Text Transfer Protocol Secure ICA Intermediate CA ID IDentity LA Linkage Authority LTE Long Term Evolution LTE-V2X LTE-Vehicle to Everything ls Linkage Seed lv Linkage Value MA Misbehavior Authority NAF Network Application Function OBU On Board Unit PC Pseudonym Certificate PCA Pseudonym Certificate Authority PDU Protocol Data Unit PKI Public Key Infrastructure PRA Pseudonym Certificate Registration Authority RA Registration Authority Rscm Security Credential Management Reference point Rsde Secure Data Exchange Reference point RSU Road Side Unit SCME Security Credential Management Entity SCMF Security Credential Management Function SDPF Secure Data Processing Function SPDU Secured Protocol Data Unit SSF Security Service Function SSP Service Specific Permission TCMF Trusted Certificate Management Function TDCL Trusted Domain CA Certificates List TLS Transport Layer Security TRCL Trusted Root Certificate List TRCLA Trusted Root Certificate List Authority USIM Universal Subscriber Identity Module V2X Vehicle to Everything VSP V2X Service Provider 4 General 4.1 Composition of V2X communication security system The reference model of vehicular communication security entity relationship is shown in Figure 1. The solid line in the figure represents the communication relationship between V2X equipment, and the dashed line represents the authorization relationship between entities. The reference model consists of the following entities. ——On Board Unit (OBU): An entity mounted on the vehicle and responsible for V2X communication. When data is sent, the OBU digitally signs the information it broadcasts using the private key corresponding to the digital certificate issued by CA and/or encrypts the data using the data recipient certificate; when the data is received, the OBU authenticates the message using the sender's public key and/or decrypts the encrypted message using the local private key. ——Road Side Unit (RSU): An entity responsible for V2X communication, installed in roadside traffic control equipment and traffic information distribution equipment. When data is sent, the RSU digitally signs the information it broadcasts using the private key corresponding to the digital certificate issued by CA and/or encrypts the data using the data recipient certificate; when the data is received, the RSU authenticates the message using the sender's public key and/or decrypts the encrypted message using the local private key. ——V2X Service Provider (VSP): A regulatory authority responsible for road traffic and a service authority that provides certain commercial services in a V2X system. When data is sent, the VSP digitally signs the information it broadcasts using the private key corresponding to the digital certificate issued by CA and/or encrypts the data using the data recipient certificate; when the data is received, the VSP authenticates the message using the sender's public key and/or decrypts the encrypted message using the local private key. Through a RSU with forwarding capability, the VSP can send and receive secure messages. ——Certificate Authority (CA): Responsible for issuing various communication certificates or certificate revocation list (CRL) to V2X equipment (OBU, RSU, VSP). For example eEnrollment CA, pPseudonym CA, application CA, Certificate Revocation Authority (CRA), etc.

1 Scope 2 Normative references 3 Terms, definitions and abbreviations 4 General 4.1 Composition of V2X communication security system 4.2 V2X communication security service architecture 5 Security requirements for LTE-V2X certification management 5.1 General 5.2 Security requirements for LTE-V2X messages 6 General technical requirements of LTE-V2X communication security authentication mechanism 6.1 Management system architecture of LTE-V2X certificate 6.2 LTE-V2X security certificate 6.3 Description of basic elements 6.4 Security protocol data unit 6.5 Digital certificate and certificate management data form 7 LTE-V2X communication security authentication interaction process and interface technical requirements 7.1 EC management process 7.2 PC application process 7.3 AC and identity certificate management process 7.4 CRL management process 7.5 Authority certificate management process 7.6 Misbehavior detection and reporting process 7.7 LA management architecture and process 8 Mutual trust technical requirements for LTE-V2X communication security authentication PKI 8.1 General 8.2 PKI mutual trust architecture 8.3 PKI mutual trust management procedures 8.4 PKI mutual trust authentication procedures 8.5 TRCL management policy 8.6 TDCL management policy 8.7 Checking on misbehavior of trusted domains Annex A (Informative) Basic application modes of V2X communication security Annex B (Informative) Token authorization mechanism based on OAUTH Annex C (Normative) ASN.1 template Annex D (Normative) Input and output of cryptographic algorithm Annex E (Normative) Data format of interface between V2X equipment and security certificate management system Annex F (Normative) Generation and usage of application layer session key of GBA mechanism Annex G (Informative) Certificate life cycle and update scenario Annex H (Informative) An algorithm proposal of key derivation process Annex I (Normative) Relevant definition of linkage value Annex J (Normative) Trusted domain CA certificates list and mutual trust authentication process Annex K (Informative) Coding examples of algorithm