EN ISO 19299:2020

Electronic fee collection - Security framework (ISO 19299:2020)

This document defines an information security framework for all organizational and technical entities of an EFC scheme and for the related interfaces, based on the system architecture defined in ISO 17573-1. The security framework describes a set of security requirements and associated security measures.
Annex D contains a list of potential threats to EFC systems and a possible relation to the defined security requirements. These threats can be used for a threat analysis to identify the relevant security requirements for an EFC system.
The relevant security measures to secure EFC systems can then be derived from the identified security requirements.

Elektronische Gebührenerhebung - Sicherheitsgrundstruktur (ISO 19299:2020)

[Not available]

Perception de télépéage - Cadre de sécurité (ISO 19299:2020)

Ce document définit un cadre de sécurité de l'information pour toutes les entités organisationnelles et techniques d'un système EFC et pour les interfaces correspondantes, sur la base de l'architecture système définie dans la norme ISO 17573-1. Le cadre de sécurité décrit un ensemble d'exigences de sécurité et de mesures de sécurité associées.
L'Annexe D contient une liste des menaces potentielles pour les systèmes EFC et une relation possible avec les exigences de sécurité définies. Ces menaces peuvent être utilisées pour une analyse des menaces afin d'identifier les exigences de sécurité pertinentes pour un système EFC.
Les mesures de sécurité pertinentes pour sécuriser les systèmes EFC peuvent ensuite être dérivées des exigences de sécurité identifiées.

Elektronsko pobiranje pristojbin - Varnostni okvir (ISO 19299:2020)

General Information

• Status: Published
• Publication Date: 08-Sep-2020
• Withdrawal Date: 30-Mar-2021
• ICS: 03.220.20 - Road transport
• ICS: 35.240.60 - IT applications in transport
• Technical Committee: CEN/TC 278 - Road transport and traffic telematics
• Drafting Committee: CEN/TC 278/WG 1 - Electronic fee collection and access control (EFC)
• Current Stage: 6060 - Definitive text made available (DAV) - Publishing
• Start Date: 09-Sep-2020
• Completion Date: 09-Sep-2020
• Directive: 2010/40/EU - Directive 2010/40/EU of the European Parliament and of the Council of 7 July 2010 on the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other modes of transport Text with EEA relevance
• Mandate: M/338 - Standardisation mandate to CEN, CENELEC and ETSI in support of interoperabilty of electonic road toll systems in the community
• Ref Project: SIST EN ISO 19299:2020 - Electronic fee collection - Security framework (ISO 19299:2020)

Relations

• Replaces: CEN ISO/TS 19299:2015 - Electronic fee collection - Security framework (ISO/TS 19299:2015)
• Effective Date: 16-Sep-2020

Standards Content (Sample)

SLOVENSKI STANDARD
01-november-2020
Nadomešča:
SIST-TS CEN ISO/TS 19299:2016
Elektronsko pobiranje pristojbin - Varnostni okvir (ISO 19299:2020)
Electronic fee collection - Security framework (ISO 19299:2020)
Elektronische Gebührenerhebung - Sicherheitsgrundstruktur (ISO 19299:2020)
Perception de télépéage -- Cadre de sécurité (ISO 19299:2020)
Ta slovenski standard je istoveten z: EN ISO 19299:2020
ICS:
35.240.60 Uporabniške rešitve IT v IT applications in transport
prometu
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EN ISO 19299
EUROPEAN STANDARD
NORME EUROPÉENNE
September 2020
EUROPÄISCHE NORM
ICS 35.240.60; 03.220.20 Supersedes CEN ISO/TS 19299:2015
English Version
Electronic fee collection - Security framework (ISO
19299:2020)
Perception de télépéage - Cadre de sécurité (ISO Elektronische Gebührenerhebung -
19299:2020) Sicherheitsgrundstruktur (ISO 19299:2020)
This European Standard was approved by CEN on 10 August 2020.

CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this
European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references
concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN
member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management
Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,
Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and
United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2020 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN ISO 19299:2020 E
worldwide for CEN national Members.

Contents Page
European foreword . 3

European foreword
This document (EN ISO 19299:2020) has been prepared by Technical Committee ISO/TC 204
"Intelligent transport systems" in collaboration with Technical Committee CEN/TC 278 “Intelligent
transport systems” the secretariat of which is held by NEN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by March 2021, and conflicting national standards shall
be withdrawn at the latest by March 2021.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
This document supersedes CEN ISO/TS 19299:2015.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the
United Kingdom.
Endorsement notice
The text of ISO 19299:2020 has been approved by CEN as EN ISO 19299:2020 without any modification.

INTERNATIONAL ISO
STANDARD 19299
First edition
2020-08
Electronic fee collection — Security
framework
Perception de télépéage — Cadre de sécurité
Reference number
ISO 19299:2020(E)
©
ISO 2020
ISO 19299:2020(E)
© ISO 2020
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii © ISO 2020 – All rights reserved

ISO 19299:2020(E)
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Abbreviated terms . 3
5 Trust model . 4
5.1 Overview . 4
5.2 Stakeholders trust relations . 5
5.3 Technical trust model . 6
5.3.1 General. 6
5.3.2 Trust model for TC and TSP relations . 6
5.3.3 Trust model for TSP and service user relations . 7
5.3.4 Trust model for interoperability management relations . 7
5.4 Implementation . 7
5.4.1 Setup of trust relations . 7
5.4.2 Trust relation renewal and revocation . 8
5.4.3 Issuing and revocation of sub CA and end-entity certificates . 8
5.4.4 Certificate and certificate revocation list profile and format . 9
5.4.5 Certificate extensions . 9
6 Security requirements .10
6.1 General .10
6.2 Information security management system .11
6.3 Communication interfaces .12
6.4 Data storage .12
6.5 Toll charger .12
6.6 Toll service provider .14
6.7 Interoperability management .16
6.8 Limitation of requirements .17
7 Security measures — Countermeasures .17
7.1 Overview .17
7.2 General security measures .18
7.3 Communication interfaces security measures .18
7.3.1 General.18
7.3.2 DSRC-EFC interface . .19
7.3.3 CCC interface .20
7.3.4 LAC interface .21
7.3.5 Front End to TSP back end interface .21
7.3.6 TC to TSP interface .22
7.3.7 ICC interface .23
7.4 End-to-end security measures .24
7.5 Toll service provider security measures .25
7.5.1 Front end security measures .25
7.5.2 Back end security measures .26
7.6 Toll charger security measures .27
7.6.1 RSE security measures . .27
7.6.2 Back end security measures .28
7.6.3 Other TC security measures .28
8 Security specifications for interoperable interface implementation .29
8.1 General .29
8.1.1 Subject.
...