YD/T 3594-2019General technical requirements of Security for Vehicular Communication based on LTE (English PDF)

4.1 Overview

The LTE-based vehicular communication system supports vehicle-to- Vehicle (V2V) applications, vehicle-to-infrastructure (V2I) applications, vehicle-to- network (V2N) applications, vehicle-to-pedestrian (V2P) applications. These applications can provide users with various businesses, such as road security, transportation efficiency improvement, infotainment.

4.2 PC5 and LTE-Uu based V2X communication architecture

4.2.1 PC5 and LTE-Uu based V2X communication architecture in non-

roaming scenarios

Figure 1 shows the PC5 and LTE-Uu based V2X communication architecture in

4.2.2 PC5 and LTE-Uu based V2X communication architecture in roaming

scenarios

4.2.3 PC5 and LTE-Uu based V2X communication architecture in cross-

PLMN scenarios

4.2.4 Reference point

The reference points of the PC5 and LTE-Uu based V2X communication architecture include the following points.

4.4 LTE-based vehicular communication security architecture

4.4.1 Security protocol architecture of LTE-based vehicular

communication

4.4.2 Communication security architecture of LTE-based Internet of

Vehicles application layer

Figure 7 shows the communication security architecture of LTE-based Internet of Vehicles application layer. The functions of each functional entity, in the security subsystem, include the following points.

5.1 General security requirements

- When a V2X device uses the service, which is provided by E-UTRAN that supports V2X communication, the 3GPP network shall provide a method

5.2 Security requirements for network elements

5.2.1 V2X device

For PC5 communication, V2X devices shall support certificate-based application layer security mechanisms. See V5 interface security for details.

For the Uu communication, V2X devices shall support LTE communication security mechanisms, including EPS-AKA-based mutual authentication, air interface encryption, integrity protection of signaling messages. Among the, for the air interface encryption, the V2X device and the LTE network shall, through negotiation, determine whether to enable it. For MBMS-based Uu

5.2.2 V2X control function

The V2X control function shall support the security mechanism, which is defined in Chapter 7.2, to protect the security of the V3 interface.

The V2X control function shall support the security mechanism, which is defined in Chapter 7.1, to protect the security of the interface with other network elements.

5.2.3 V1 interface security requirements

The security of the V1 interface is outside the scope of this standard.

5.2.4 V2 interface security requirements

The security of the V2 interface is outside the scope of this standard.

5.2.5 V3 interface security requirements

6.1 Overview

In V2X services, V2X devices interact through V5 interfaces; secure communication is handled by the application layer. V2X device includes V2X vehicles (OBU), V2X roadside units (RSU), etc. The communication integrity protection architecture, which is provided through the V5 interface, is as shown in Figure 8.The typical security process is as follows.

6.2 Description of security basic elements

6.2.1 Encoding rules

This standard uses ASN.1 to describe the data structure; uses octet encoding rules (OER) to encode various information, in the digital certificate format.

6.2.2 Definition of data structure

The atomic types, which are used in the data structure definition, shall meet the relevant requirements of GB/T 37376-2019.

The synonyms of the octet string, which are used in the data structure definition, shall meet the relevant requirements of GB/T 37376-2019.

The structure, which is used to clarify the definition, shall meet the relevant requirements of GB/T 37376-2019.

6.2.3 Hash Algorithm

The hash algorithm is defined as the HashAlgorithm type. The structure shall meet the relevant requirements of GB/T 37376-2019.

6.2.4 Elliptic curve

The elliptic curve is defined as the EccCurve type. The structure shall meet the relevant requirements of GB/T 37376-2019.

6.2.5 Symmetric encryption algorithm

The symmetric encryption algorithm is defined as the SymmetricAlgorithm type.

The structure shall meet the relevant requirements of GB/T 37376-2019.

6.2.6 Signature public key

The signature public key is defined as the PublicVerifyKey type. The structure shall meet the relevant requirements of GB/T 37376-2019.

The point on the ECC elliptic curve is defined as the ECCPoint type. The structure shall meet the relevant requirements of GB/T 37376-2019.

6.3 General requirements for security data structure

When carrying out security data communication, through the PC5 interface, the security data structure shall be unified; its content shall include at least the information in Table 1.

6.4 Public key certificate format

6.4.1 Message certificate

6.4.1.1 Certificate structure

The definition of V2X device certificate structure shall meet the relevant requirements of GB/T 37376-2019.

6.5 Message signing process

6.5.1 Overview

The signature algorithm is used to confirm the integrity and non-repudiation of the information, which is sent by the sender. The signature algorithm is used in but not limited to the following scenarios.

6.5.2 Signature data structure requirements

The signature data shall follow the data structure of 6.2, in which the data type shall be the signature data type. The information content shall at least contain the information as shown in Table 2.

7.1 V2X communication security process between network elements

For all interfaces between network elements.

7.2 Security process of V3 interface

7.2.1 Overview

In the V2X service, the V2X device interacts with the V2X control function, through the V3 interface. The security mechanism of the V3 interface can use the security mechanism of the PC3 interface (3GPP TS 33.303 5.3).

7.2.2 Security process of UICC configuration transmission

After the V2X device is deployed, the configuration parameters saved on the

UICC can be updated, to reflect the configuration changes.

7.2.3 Security process of data transmission

This article defines the protection process for data transmission, between V2X device and V2X control functions.

Between the V2X device and the network function, for the message which is initiated by the V2X device.

7.3 Security process of MB2 interface

It shall use the security mechanism, which is defined in Appendix N of 3GPP

TS 33.246.The V2X application server serves as the role of GCS AS in this mechanism.

......