ETSI TS 102 941 V1.4.1 (2021-01)

Intelligent Transport Systems (ITS); Security; Trust and Privacy Management

RTS/ITS-00559

General Information

• Status: Not Published
• Technical Committee: ITS WG5 - Security
• Current Stage: 12 - Completion
• Due Date: 07-Jan-2021
• Completion Date: 14-Jan-2021

Standards Content (Sample)

ETSI TS 102 941 V1.4.1 (2021-01)






TECHNICAL SPECIFICATION
Intelligent Transport Systems (ITS);
Security;
Trust and Privacy Management

---------------------- Page: 1 ----------------------
2 ETSI TS 102 941 V1.4.1 (2021-01)



Reference
RTS/ITS-00559
Keywords
interoperability, ITS, management, security

ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE

Tel.: [phone]  Fax: [phone]

Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88

Important notice
The present document can be downloaded from:
http://www.etsi.org/standards-search
The present document may be made available in electronic versions and/or in print. The content of any electronic and/or
print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any
existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI
deliverable is the one made publicly available in PDF format at www.etsi.org/deliver.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at
https://portal.etsi.org/TB/ETSIDeliverableStatus.aspx
If you find errors in the present document, please send your comment to one of the following services:
https://portal.etsi.org/People/CommiteeSupportStaff.aspx
Copyright Notification
No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying
and microfilm except as authorized by written permission of ETSI.
The content of the PDF version shall not be modified without the written authorization of ETSI.
The copyright and the foregoing restriction extend to reproduction in all media.

© ETSI 2021.
All rights reserved.

DECT™, PLUGTESTS™, UMTS™ and the ETSI logo are trademarks of ETSI registered for the benefit of its Members.

3GPP™ and LTE™ are trademarks of ETSI registered for the benefit of its Members and
of the 3GPP Organizational Partners.
oneM2M™ logo is a trademark of ETSI registered for the benefit of its Members and
of the oneM2M Partners.
®
GSM and the GSM logo are trademarks registered and owned by the GSM Association.
ETSI

---------------------- Page: 2 ----------------------
3 ETSI TS 102 941 V1.4.1 (2021-01)
Contents
Intellectual Property Rights . 6
Foreword . 6
Modal verbs terminology . 6
1 Scope . 7
2 References . 7
2.1 Normative references . 7
2.2 Informative references . 8
3 Definition of terms, symbols, abbreviations and notations . 9
3.1 Terms . 9
3.2 Symbols . 9
3.3 Abbreviations . 9
3.4 Notations . 10
4 ITS authority hierarchy . 11
5 Privacy in ITS . 12
6 Trust and privacy management . 13
6.1 ITS-S Security Lifecycle . 13
6.1.1 ITS-S Life-cycle management . 13
6.1.2 Manufacture . 13
6.1.3 Enrolment . 14
6.1.4 Authorization . 14
6.1.5 Maintenance . 15
6.1.6 End of life . 16
6.2 Public Key Infrastructure . 16
6.2.0 General . 16
6.2.0.1 Messages format . 16
6.2.0.2 Signed and encrypted data structures . 17
6.2.1 CA certificate request . 19
6.2.2 Enrolment/Authorization assumption and requirements . 21
6.2.3 Message Sequences. 24
6.2.3.1 Introduction . 24
6.2.3.2 Enrolment Management . 24
6.2.3.2.0 Overview . 24
6.2.3.2.1 Enrolment request . 25
6.2.3.2.2 Enrolment response . 27
6.2.3.3 Authorization Management . 29
6.2.3.3.0 Overview . 29
6.2.3.3.1 Authorization request . 30
6.2.3.3.2 Authorization response . 35
6.2.3.4 Authorization Validation protocol . 36
6.2.3.4.0 Overview . 36
6.2.3.4.1 Authorization validation request . 37
6.2.3.4.2 Authorization validation response . 38
6.3 Generation, distribution and use of Trust information lists . 40
6.3.1 Generation and distribution of CTL by TLM . 40
6.3.2 Generation and distribution of CTL by RCA . 41
6.3.3 Generation and distribution of CRL by RCA . 42
6.3.4 Specification of Full CTL and Delta CTL . 42
6.3.5 Transmission of CTL and CRL. 44
6.3.6 CTL and CRL use by ITS-Ss . 44
6.4 Generation and distribution of TLM / RCA Link Certificates . 44
6.4.1 General . 44
6.4.2 Generation of Link Certificate Messages . 45
6.4.2.1 Generation of Link Certificate Message by the TLM . 45
ETSI

---------------------- Page: 3 ----------------------
4 ETSI TS 102 941 V1.4.1 (2021-01)
6.4.2.2 Generation of Link Certificate Message by a Root CA. 46
7 Security association and key management between ITS Stations . 50
7.0 Introduction . 50
7.1 Broadcast SAs . 50
7.2 Multicast SAs . 50
7.3 Unicast SAs . 51
Annex A (normative): ITS security management messages specified in ASN.1 . 53
A.1 ITS trust and privacy messages specified in ASN.1 . 53
A.2 Security management messages structures . 53
A.2.1 Security data structures . 53
A.2.2 Security Management messages for CA . 53
A.2.3 Security Management messages for ITS-S_WithPrivacy . 53
A.2.4 Security Management messages for ITSS_NoPrivacy . 54
A.2.5 Enrolment and authorization data types . 54
A.2.5.1 Enrolment . 54
A.2.5.2 Authorization . 54
A.2.5.3 AuthorizationValidation . 55
A.2.6 Offline message structures . 55
A.2.7 Trust lists data types . 55
A.2.8 Link certificate message data types . 56
Annex B (normative): Service specific parameters (SSPs) definition . 57
B.1 Overview . 57
B.2 CTL SSPs definition . 57
B.3 CRL SSPs definition . 58
B.4 Certificate request messages SSPs definition . 59
B.5 Security Management certificate permissions . 59
Annex C (informative): Communication profiles for security credential provisioning services
(EC request, AT request) . 61
C.0 General . 61
C.1 Communication profiles description . 62
Annex D (normative): Communication profiles for CTL and CRL . 66
D.1 CTL request and response protocol . . 66
D.2 CRL request and response protocol . 66
D.3 Broadcast communication of CTL/CRL . 67
Annex E (normative): Communication profiles for TLM Certificates, TLM Link Certificate
Messages, ECTLs and delta ECTLs access . 68
E.1 CPOC HOST URL Definition . 68
E.2 Request of TLM certificate . 68
E.3 Request of TLM link certificate message . 69
E.4 Request of full ECTL . 69
E.5 Request of delta ECTL . 70
Annex F (informative): Encryption of a message from a sender to a receiver . 71
Annex G (informative): Bibliography . 73
ETSI

---------------------- Page: 4 ----------------------
5 ETSI TS 102 941 V1.4.1 (2021-01)
Annex H (informative): Change history . 74
History . 75

ETSI

---------------------- Page: 5 ----------------------
6 ETSI TS 102 941 V1.4.1 (2021-01)
Intellectual Property Rights
Essential patents
IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web
server (https://ipr.etsi.org/).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web
server) which are, or may be, or may become, essential to the present document.
Trademarks
The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners.
ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no
right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does
not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks.
Foreword
This Technical Specification (TS) has been produced by ETSI Technical Committee Intelligent Transport Systems
(ITS).
Modal verbs terminology
In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and
"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of
provisions).
"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.
ETSI

---------------------- Page: 6 ----------------------
7 ETSI TS 102 941 V1.4.1 (2021-01)
1 Scope
The present document specifies the trust and privacy management for Intelligent Transport System (ITS)
communications. Based upon the security services defined in ETSI TS 102 731 [1] and the security architecture defined
in ETSI TS 102 940 [5], it identifies the trust establishment and privacy management required to support security in an
ITS environment and the relationships that exist between the entities themselves and the elements of the ITS reference
architecture defined in ETSI EN 302 665 [2].
The present document identifies and specifies security services for the establishment and maintenance of identities and
cryptographic keys in an Intelligent Transport System (ITS). Its purpose is to provide the functions upon which systems
of trust and privacy can be built within an ITS.
2 References
2.1 Normative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
Referenced documents which are not found to be publicly available in the expected location might be found at
https://docbox.etsi.org/Reference.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are necessary for the application of the present document.
[1] ETSI TS 102 731: "Intelligent Transport Systems (ITS); Security; Security Services and
Architecture".
[2] ETSI EN 302 665: "Intelligent Transport Systems (ITS); Communications Architecture".
[3] ETSI TS 103 097: "Intelligent Transport Systems (ITS); Security; Security header and certificate
formats".
[4] ETSI TS 102 942: "Intelligent Transport Systems (ITS); Security; Access control".
[5] ETSI TS 102 940: "Intelligent Transport Systems (ITS); Security; ITS communications security
architecture and security management".
[6] ISO/IEC 8824-1:2015: "Information technology -- Abstract Syntax Notation One (ASN.1):
Specification of basic notation; Part 1".
[7] Recommendation ITU-T X.696 (10/2015): "ASN.1 encoding rules: Specification of Octet
Encoding Rules (OER)".
[8] Void.
[9] ETSI TS 102 943: "Intelligent Transport Systems (ITS); Security; Confidentiality services".
[10] ETSI EN 302 637-2: "Intelligent Transport Systems (ITS); Vehicular Communications; Basic Set
of Applications; Part 2: Specification of Cooperative Awareness Basic Service".
[11] ETSI EN 302 637-3: "Intelligent Transport Systems (ITS); Vehicular Communications; Basic Set
of Applications; Part 3: Specifications of Decentralized Environmental Notification Basic
Service".
[12] ETSI TS 103 301: "Intelligent Transport Systems (ITS); Vehicular Communications; Basic Set of
Applications; Facilities layer protocols and communication requirements for infrastructure
services".
ETSI

---------------------- Page: 7 ----------------------
8 ETSI TS 102 941 V1.4.1 (2021-01)
[13] NIST FIPS PUB 198-1: "The Keyed-Hash Message Authentication Code (HMAC)".
[14] Void.
[15] IETF RFC 4862: "IPv6 Stateless Address Autoconfiguration".
[16] ETSI EN 302 636-6-1: "Intelligent Transport Systems (ITS); Vehicular Communications;
GeoNetworking; Part 6: Internet Integration; Sub-part 1: Transmission of IPv6 Packets over
GeoNetworking Protocols".
[17] Void.
[18] ETSI EN 302 636-4-1: "Intelligent Transport Systems (ITS); Vehicular communications;
GeoNetworking; Part 4: Geographical addressing and forwarding for point-to-point and point-to-
multipoint communications; Sub-part 1: Media-Independent Functionality".
[19] ETSI TS 102 965: "Intelligent Transport Systems (ITS); Application Object Identifier (ITS-AID);
Registration".
[20] IEEE Std 802.11™: "IEEE Standard for Information technology -- Telecommunications and
information exchange between systems -- Local and metropolitan area networks-Specific
requirements -- Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY)
Specifications".
[21] ETSI TS 103 601: "Intelligent Transport Systems (ITS); Security; Security management messages
communication requirements and distribution protocols".
2.2 Informative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are not necessary for the application of the present document but they assist the
user with regard to a particular subject area.
[i.1] ISO/IEC 15408-2: "Information technology -- Security techniques -- Evaluation criteria for IT
security; Part 2: Security functional components".
[i.2] ETSI TR 102 638: "Intelligent Transport Systems (ITS); Vehicular Communications; Basic Set of
Applications; Definitions".
[i.3] IETF RFC 4046: "Multicast Security (MSEC) Group Key Management Architecture".
[i.4] IETF RFC 4301: "Security Architecture for the Internet Protocol".
[i.5] IETF RFC 4302: "IP Authentication Header".
[i.6] IETF RFC 4303: "IP Encapsulating Security Payload (ESP)".
[i.7] IETF RFC 5246: "The Transport Layer Security (TLS) Protocol Version 1.2".
[i.8] IETF RFC 3547: "The Group Domain of Interpretation".
[i.9] IETF RFC 3830: "MIKEY: Multimedia Internet KEYing".
[i.10] IETF RFC 4535: "GSAKMP: Group Secure Association Key Management Protocol".
[i.11] IETF RFC 4306: "Internet Key Exchange (IKEv2) Protocol", December 2005.
[i.12] IETF RFC 4877: "Mobile IPv6 Operation with IKEv2 and the Revised IPsec Architecture".
ETSI

---------------------- Page: 8 ----------------------
9 ETSI TS 102 941 V1.4.1 (2021-01)
[i.13] ETSI TS 102 723-8: "Intelligent Transport Systems (ITS); OSI cross-layer topics; Part 8: Interface
between security entity and network and transport layer".
[i.14] CVRIA: "Connected Vehicle Reference Implementation Architecture".
NOTE: Available at http://www.iteris.com/cvria/.
[i.15] ISO 21210-2010: "Intelligent Transport Systems (ITS) - Communications access for land mobiles
(CALM) - Ipv6 networking".
[i.16] IETF RFC 5280: "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation
List (CRL) Profile".
[i.17] Certificate Policy for Deployment and Operation of European Cooperative Intelligent Transport
Systems (C-ITS), Release from preparatory phase of C-ITS Delegated Regulation, 13rd March
2019.
NOTE: Available at https://cpoc.jrc.ec.europa.eu/.
[i.18] Annex I of CPOC Protocol: Requirements & best practices of TLM certificates, RCA certificates
and the ECTL.
NOTE: Available at https://cpoc.jrc.ec.europa.eu/.
3 Definition of terms, symbols, abbreviations and
notations
3.1 Terms
For the purposes of the present document, the terms given in ETSI TS 102 731 [1], ETSI TS 102 940 [5],
ISO/IEC 15408-2 [i.1] and the following apply:
delta CTL: partial CTL that only contains CTL entries that have been updated since the issuance of the prior, base CTL
nextUpdate: information (in a CRL or CTL) indicating the date by which the next CRL (respectively the next CTL)
will be issued
NOTE: The next CRL (respectively the next CTL) could be issued before the indicated date, but it will not be
issued any later than the indicated date (as specified in IETF RFC 5280 [i.16]).
thisUpdate: information (in a CRL) indicating the issue date of this CRL
NOTE: This information is specified in IETF RFC 5280 [i.16].
3.2 Symbols
Void.
3.3 Abbreviations
For the purposes of the present document, the abbreviations given in ETSI TS 103 097 [3], ETSI TS 102 940 [5], ETSI
EN 302 636-4-1 [18] and the following apply:
AA Authorization Authority
AES Advanced Encryption Standard
ASN Abstract Syntax Notation
AT Authorization Ticket
CA Certification Authority
CBC-MAC Cipher Block Chaining Message Authentication Code
ETSI

---------------------- Page: 9 ----------------------
10 ETSI TS 102 941 V1.4.1 (2021-01)
CCH Control CHannel
CCM Counter with CBC-MAC
CCMS Cooperative-ITS Certificate Management System
COER Canonical Octet Encoding Rule
CPOC C-ITS Point Of Contact
CRL Certificate Revocation List
CTL Certificate Trust List
CVRIA Connected Vehicle Reference Implementation Architecture
DC Distribution Centre
DEN Decentralized Environmental Notification
DENM Decentralized Environmental Notification Message
EA Enrolment Authority
EC Enrolment Credential
ECC Elliptic Curve Cryptography
ECTL European Certificate Trust List
EV Electric Vehicle
FIPS Federal Information Processing Standard
GET command HTTP GET
GN/BTP GeoNetworking/Basic Transport Protocol
GN6 GeoNetworking-IPv6
HMAC keyed-Hash Message Authentication Code
HTTP Hyper Text Transfer Protocol
IETF Internet Engineering Task Force
IP Internet Protocol
ITS-AID ITS Application ID
ITU-T International Telecommunication Union - Telecommunication Standardization Sector
KDF Key Derivation Function
LTE Long Term Evolution (4G)
MSB Most Significant Bit
MSEC Multicast SECurity
OBD On-Board Diagnosis
PA Policy Authority
PDU Protocol Data Unit
PII Personally Identifiable Information
POP Proof Of Possession
PSID Provider Service Identifier
RCA Root Certification Authority
RFC Request For Comment
SA Security Association
SCH Service CHannel
SLAAC StateLess Address Auto Configuration
SM Security Management
SSP Service Specific Permissions
TCP Transmission Control Protocol
TLM Trust List Manager
TLS Transport Layer Security
URL Uniform Resource Locator
V2I Vehicle-to-Infrastructure
WLAN Wireless Local Area Network
XOR eXclusive OR function
3.4 Notations
The requirements identified in the present document include:
a) mandatory requirements strictly to be followed in order to conform to the present document. Such
requirements are indicated by clauses without any additional marking;
b) requirements strictly to be followed if applicable to the type of ITS Station concerned.
ETSI

--------------
...