1. Vehicular Public Key Infrastructure Scalability
Pierpaolo Cincilla

2. New Threats Vehicles communicate and cooperate Context New Complexity
New Applications
Lane Keeping
Adaptive Cruise Control
Entertainment

3. Increasing needs for Security and Privacy
Context
Increasing needs for Security and Privacy
Share of connected vehicles
(Cisco)
Security technologies in vehicles
Estimated market for connected cars
(McKinsey 2014)

4. ITS Security (ISE) Project
Context
Start :
July 2014
3 Years
ITS Security (ISE) Project
Context
Vehicles Broadcasts / Geocasts information to neighbor
vehicle dynamics info (position, speed, heading …)
perception of dynamic environment
In EU, ETSI defines the PKI as the basis of trust
Challenges
Build security infrastructure (PKI)
Ensure scalability
Validation in large scale scenario
llllll

5. Roadside ITS-S gateway
Architecture
ISE Architecture Overview
ETSI TS 103 097, TS 102 940/941
Roadside ITS-S gateway
RSU
ITS Service Center EA
RCA
PKI AA
Backbone
Network
3G/4G G5
llllll

6. ISE PKI Architecture Architecture RCA EA AA Operator Autorization
Ticket (AT)
Enrollment
Certificate (EC)
ITS-S

7. Protocol
EC and AT
request protocol
register EC AT

8. Centralized PKI Deployement
Millions of ITSs, billions of (pseudonyms) identities
We must ensure the system scalability
A centralized system will saturate at some point
llllll

9. Replicated PKI Deployement
We need to distribute the system
Group communication channel EA
Operators AA AA WS AA WS WS
ITS-S

10. Replicated PKI Deployement
Distributed system performances
Replication implications
Authorization Tickets (reads) performance improve
Enrollment Tickets (writes) performance worsen
llllll

11. Replicated PKI Deployement
To boost the writes…Trade consistency!
Synchronous vs asynchronous updates propagation (Local vs Global)
Database operation’s execution order (FIFO vs ABCAST) AA
Communication channel EA
Operator WS
llllll

12. Replicated PKI Deployement
Update Propagation
Strong consistency: synchronous propagation
Operator
Register ITS EA WS
ACK
Communication channel

13. Replicated PKI Deployement
Update Propagation
Strong consistency: synchronous propagation
Weak consistency: asynchronous propagation
Operator
Register ITS EA WS
ACK
Communication channel
llllll

14. Replicated PKI Deployement
Operation Execution Order
Operators
Strong consistency: Atomic Broadcast (ABCAST)
Update brown ITS
Register red ITS
Set all SSP
Register brown ITS EA WS x y z t y z x t y z x t
ABCAST Communication channel y z x t
llllll

15. Replicated PKI Deployement
Operation Execution Order
Operators
Strong consistency: Atomic Broadcast (ABCAST)
Weak consistency: First In First Out (FIFO)
Update brown ITS
Register red ITS
Set all SSP
Register brown ITS EA WS y z t x x y z t y z t x
FIFO Communication channel y z x t
llllll

16. Replicated PKI Deployement
Weak consistency performances
llllll

17. Geographic ReplicationEA AA IP
Operator
ITS-S
Group Communication

18. Geographic Replication
Big Latency IP
Group Communication AA EA
Operator
ITS-S

19. 10 100 IP Base case: 10 AA in US 10 AA and 10 EA in EU
Group communication
10 AA in US
and 10 EA in Europe
Base case:
10 AA and 10 EA in EU IP
Group Communication 10
100

20. Geographic Replication
The idea: replicate EAs (and their storage)
Small Latency EA EA
Operator AA IP
Big Latency
Group Communication

21. Geographic ReplicationIP
Group communication
10 AA in US
and 10 EA in Europe IP
Group Communication
10 AA and
10 EA in US
100 10

22. Geographic Replication
Autorisation Ticket
all settings 10 IP
Group Communication 1 IP
Group communication 2 IP
Group Communication 3
llllll

23. Conclusion - Takeaway AT / EC Distributed Geographic Deployment
Enrollment Cerificate
weak consistency

25. AT Request format in SCMS EU

26. CAM Message Structure

27. DENM Message Structure

28. SAM Message Structure

29. Signed AT

30. US SCMS architecture

31. US SCMS architecture PCs provisioning steps

32. Certificates validity period in SCMS US.