Secure V2X Systems: The Role of Certificates and Testing Tools
In V2X communication, vehicles exchange data with each other and with the infrastructure. For example, if there is an emergency braking situation, the vehicle in question sends this information to following vehicles so that they can react in time. But how can vehicles trust that the data they receive is reliable?
Introduction to V2X Security
This is where security mechanisms in V2X communication play a crucial role. To ensure that V2X communication between vehicles and their environment is protected, a Public Key Infrastructure (PKI) is used. PKIs are structured differently depending on the region.
The following describes the structure of a PKI according to European standards, but the structure is similar for US and China PKIs. A Root Certificate Authority (RCA) has a root certificate and is authorized to issue Authorization Authority (AA) certificates based on it. These AAs are responsible for issuing certificates for individual stations (e.g., vehicles), which are called Authorization Tickets (AT).
For a message from a station to be accepted, the sending and receiving stations must either have the same root certificate, or the root certificate of the sending station must be included in the Certificate Trust List (CTL) of the receiving station. Otherwise, the message is not accepted and discarded. The certificates must also contain the appropriate permissions for the content of the message. Not every certificate is allowed to send every message or container in a message. For example, the certificates of a regular car do not have the permission to send an Emergency Vehicle Container.
The certificate also contains the identity of the certificate issuer and its digital signature. This signature is crucial as it verifies the correctness of the certificate. The certificate issuer itself is also identified by a certificate, which is either self-signed in the case of the RCA or signed by another issuer in the case of AA or AT certificates.
Security Support in V2X Testing Tools
To test V2X-based applications, the control units are stimulated with various scenarios. The V2X stack of the testing tool generates the corresponding radio messages based on the defined scenarios. Additionally, the security header, which is also part of the message, must be generated. This is created based on the certificates and transmitted with the message.
For the testing tool, this means it must be able to handle the PKI. To assign certificates to the stations and thus calculate the security header, the PKI must be known and managed in the testing tool.
A good testing tool offers the ability to generate its own certificates. The attributes of the individual certificates, such as the validity period and permissions for individual services, should be configurable. These certificates are then used to sign the messages generated in the simulation. Additionally, the certificates matching the PKI must be exportable and transferable to the Device under Test (DuT). Certificates can also be created to test error cases, such as an expired certificate or a certificate with missing permissions.
Another approach is to import certificates from an external provider. Often, AT certificates are already present on the Device under Test (DuT) in a test environment, obtained from a PKI provider. Additional certificates for testing, which belong to the appropriate root certificate, are obtained from this provider. These are then imported into the testing tool and used accordingly when generating messages.
Straightforward Management of Certificates With the Vector Security Manager
Vector offers the Security Manager, which allows the management of security protocols in various domains, including V2X PKIs. The Security Manager can generate and export certificates as well as import certificates from external sources. It supports certificates for the EU, USA, and China regions.
For example, in an ECU test, AT certificates from an external PKI provider can be imported into the Security Manager for testing the DuT. Alternatively, a custom test PKI can be generated. The root of the test PKI can then be added to the CTL of the DuT, allowing messages signed with AT certificates of the test PKI to be accepted. Another option is to transfer the PKI’s AT certificates directly to the ECU. Test scenarios can be defined in CANoe to stimulate the DuT. The messages from the simulated stations are then signed with the AT certificates from the Security Manager.
To analyze V2X security, the testing tool must be able to verify the signature of received messages to confirm the correctness of the used certificate. Additionally, details of the received certificates should be examinable, such as the Application IDs and SSP bits for the individual permissions of V2X services or the validity period. This analysis can be performed in the Certificate Explorer window of CANoe, where details of the respective certificates are displayed. Important details about the certificates are also shown in the Trace window.
Learn more about handling V2X security with the Security Manager and CANoe in our new E-Learning !