A Security Credential Management System for V2X Communications

Abstract

A Vehicle-to-Everything (V2X) communications safety system requires that people using a safety device can trust the information presented to them. To this end, each receiving device must be able to tell whether messages received over the air interface come from a trustworthy source and have not been tampered with during transmission. This trust relation needs to be established as soon as two devices receive messages from each other. At the same time, users care about privacy and will unlikely accept the system if it allows for tracking of an individual device. Providing both security and privacy to the utmost extent reasonable and possible is the primary challenge and design goal of the Security Credential Management System (SCMS) presented in this chapter. The Crash Avoidance Metrics Partnership (CAMP) under a Cooperative Agreement with the USDOT designed and developed the SCMS for vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communications. The design builds on public key infrastructure (PKI) principles and issues digital certificates to participating devices (vehicles and infrastructure nodes) for trustful communication among them, which is necessary for safety and mobility applications based on V2X communications. Standard solutions from literature, such as group signature schemes and management schemes for symmetric keys, do not meet the requirements of a V2X communications system. We briefly review these well-known schemes and show where they do not meet these criteria.

The SCMS supports four primary use cases, namely bootstrapping, certificate provisioning, misbehavior reporting, and revocation. Devices use pseudonym certificates to sign their messages, and multiple organizations are involved in the generation and provisioning of those certificates to achieve a reasonable level of privacy. One of the main challenges is to facilitate efficient revocation of misbehaving or malfunctioning vehicles, while at the same time preserving privacy against attacks from insiders. We present a revocation process which actively informs the fleet about misbehaving devices and is very efficient regarding revoking a high number of pseudonym certificates with only a small amount of data signaled over the air. Another challenge is to handle certificate authority revocations without requiring all affected devices to come back to dealerships or get updated in some form of secure environment. We present an approach called Elector-based Root Management to minimize the impact on devices.