標(biāo)準(zhǔn)編號(hào):	YD/T 3594-2019
中文名稱:	基于LTE的車聯(lián)網(wǎng)通信安全技術(shù)要求
英文名稱:	General technical requirements of Security for Vehicular Communication based on LTE
行業(yè)分類:	YD    通信行業(yè)標(biāo)準(zhǔn)
發(fā)布機(jī)構(gòu):	中華人民共和國(guó)工業(yè)和信息化部
發(fā)布日期:	2019-11-11
實(shí)施日期:	2020-1-1
標(biāo)準(zhǔn)狀態(tài):	valid
翻譯語(yǔ)言:	英文
文件格式:	PDF
中文字符數(shù):	50000 字
翻譯價(jià)格(元):	3200.0
交付時(shí)間:	付款后 1 個(gè)工作日

Codeofchina.com is in charge of this English translation. In case of any doubt about the English translation, the Chinese original shall be considered authoritative. This standard is developed in accordance with the rules given in GB/T 1.1-2009. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. The issuing body of this document shall not be held responsible for identifying any or all such patent rights. This standard was proposed by and is under the jurisdiction of China Communications Standards Association. General technical requirements of security for vehicular communication based on LTE 1 Scope This standard specifies the general technical requirements, interface security requirements and security procedure of security for vehicular communication based on LTE. It is applicable to vehicular communication system based on LTE. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced documents (including any amendments) applies. GB/T 37376-2019 Transportation - Digital certificate format GB/T 37374-2019 Intelligent transport - Digital certificate application interface 3GPP TS 33.210 3G security; Network domain security (NDS); IP network layer security 3GPP TS 33.223 Generic authentication architecture (GAA); Generic bootstrapping architecture (GBA) push function 3GPP TS 33.246 3G security; Security of multimedia broadcast / multicast service (MBMS) IEEE Std 1363 IEEE standard specifications for public-key cryptography IEEE Std 1363a IEEE standard specifications for public-key cryptography - Amendment 1: Additional techniques IEEE Std 1609.2-2016 IEEE standard for wireless access in vehicular environments (WAVE) - Security services for applications and management messages IETF RFC 5639 Elliptic curve cryptography (ECC) brainpool standard curves and curve generation FIPS-197 Advanced encryption standard FIPS PUB 180 Secure hash standard FIPS PUB 186-4 Digital signature standard GM/T 0002 SM4 block cipher algorithm GM/T 0003 Public key cryptographic algorithm SM2 based on elliptic curves GM/T 0004 SM3 cryptographic hash algorithm GM/T 0015 Digital certificate format based on SM2 algorithm NIST SP 800-38C Recommendation for block cipher modes of operation: the CCM mode for authentication and confidentiality NIST SP 800-56A Recommendation for pair-wise key establishment 3 Abbreviations For the purposes of this document, the following abbreviations apply. BM-SC Broadcast-Multicast Service Centre BSF Bootstrapping Server Function CA Certificate Authority E-UTRAN Evolved UTRAN GCSAS Group Communication System Application Server LTE Long Term Evolution MBMS Multimedia Broadcast/Multicast Service NAF Network Application Function PLMN Public Land Mobile Network USS User Security Setting V2I Vehicle to Infrastructure V2N Vehicle to Network V2P Vehicle to Pedestrian V2V Vehicle to Vehicle 4 Vehicular communication architecture based on LTE 4.1 General The vehicular communication architecture based on LTE system supports V2V application, V2I application, V2N application and V2P application, which can be used to provide users with various services such as road safety, traffic efficiency improvement and infotainment. V2X communication is provided with two operation modes: PC5-based V2X communication and LTE-Uu-based V2X communication. Wherein, the latter may be unicast or broadcast. The V2X equipment may receive and send messages using the two operation modes respectively. Example: a V2X equipment may receive V2X messages using downlink broadcast of LTE-Uu, but send V2X messages without using LTE-Uu. A V2X equipment may also receive V2X messages via LTE-Uu downlink unicast. The V2X communication is based on PC5 reuses one-to-many ProSe for direct communication transmission procedure. The PC5-U protocol stack as defined in proximity communication is used for the V2X communication transmission based on PC5 interface. The general technical requirements of security for V2X communication based on PC5 and LTE-Uu are prepared in this standard. 4.2 V2X communication architecture based on PC5 and LTE-Uu 4.2.1 V2X communication architecture based on PC5 and LTE-Uu in non-roaming scenarios Figure 1 shows the V2X communication architecture based on PC5 and LTE-Uu in non-roaming scenarios. Figure 1 V2X communication architecture based on PC5 and LTE-Uu in non-roaming scenarios 4.2.2 V2X communication architecture based on PC5 and LTE-Uu in roaming scenarios Figure 2 shows the V2X architecture based on PC5 and LTE-Uu in roaming scenarios, V2X equipment A home PLMNA, V2X equipment B home PLMNB, V2X equipment A roaming to PLMNB, and V2X equipment B non-roaming. The V2X application server may be connected to multiple PLMNs. Example: a V2X application server may be connected to V2X control function entities in PLMN A or those in PLMN B. Figure 1 V2X communication architecture based on PC5 and LTE-Uu in roaming scenarios 4.2.3 V2X communication architecture based on PC5 and LTE-Uu in cross-PLMN scenarios Figure 3 shows the V2X architecture based on PC5 and LTE-Uu in cross-PLMN roaming scenarios, V2X equipment A home PLMN A, V2X equipment B home PLMN B, V2X equipment A roaming to PLMN C, and V2X equipment B non-roaming. Figure 3 V2X architecture based on PC5 and LTE-Uu in cross-PLMN scenarios 4.2.4 Reference point Reference points of V2X communication architecture based on PC5 and LTE-Uu contain: ——V1: the reference point between the V2X application (in the V2X equipment) and the V2X application server. ——V2: the reference point between the V2X application server and V2X control function. The V2X application server may be connected to multiple V2X control functions belonging to PLMN. ——V3: the reference point between the V2X equipment and the V2X control function in home PLMN. It is applicable to V2X communication based on PC5 and LTE-Uu; the V2X communication based on LTE-Uu may support MBMS optionally. ——V4: the reference point between the HSS and the V2X control function in the operator's network. ——V5: the reference point between the V2X applications of different V2X equipment. ——V6: the reference point between the V2X control functions in different PLMNs. ——PC5: the reference point for ProSe direct communication in user plane between the V2X equipment using V2X service. ——S6a: in the V2X scenario, MME can download subscription information related to V2X communication during E-UTRAN attach procedure or to inform the subscription information in the HSS to MME when the information is changed. ——S1-MME: in the V2X scenario, the reference point is used to send the V2X service authorization from MME to eNodeB. ——LTE-Uu: the reference point between the UE and the E-UTRAN. 4.3 V2X communication architecture based on MBMS and LTE-Uu Figure 4 shows the V2X communication architecture based on MBMS and LTE-Uu. Figure 4 V2X architecture based on MBMS and LTE-Uu The reference points of this architecture are as follows: ——MB2: the reference point between V2X application server and BM-SC. ——SGmb/SGi-mb/M1/M3: the SGmb/SGi-mb/M1/M3 reference points in the MBMS system. 4.4 Vehicular communication security architecture based on LTE 4.4.1 Vehicular communication security protocol architecture based on LTE The vehicular communication security based on LTE contains bearing security (PC5 security or LTE-UU security) and V2X application security. Figure 5 shows the V2X security architecture based on PC5, and Figure 6 shows the V2X security architecture based on LTE-UU.

Foreword i 1 Scope 2 Normative references 3 Abbreviations 4 Vehicular communication architecture based on LTE 4.1 General 4.2 V2X communication architecture based on PC5 and LTE-Uu 4.3 V2X communication architecture based on MBMS and LTE-Uu 4.4 Vehicular communication security architecture based on LTE 5 Requirements of security for vehicular communication based on LTE 5.1 General security requirements 5.2 Security requirements of network elements 6 Security procedure of V5 interface 6.1 General 6.2 Description of basic security elements 6.3 General requirements for security data structure 6.4 Public key certificate format 6.5 Message signature process 6.6 Message encryption process 6.7 Key agreement 7 Other interface security procedures 7.1 V2X communication security procedure between network elements 7.2 Security procedure of V3 interface 7.3 Security procedure of MB2 interface Annex A (Normative) Algorithm description Annex C (Informative) Public key certificate management Annex D (Informative) V5 interface data message Annex E (Informative) Key agreement calculation process Annex F (Informative) Certificate request and response Annex G (Informative) Allocation suggestions on security-related AID value

基于LTE的車聯(lián)網(wǎng)通信安全技術(shù)要求 1 范圍 本標(biāo)準(zhǔn)規(guī)定了基于LTE的車聯(lián)網(wǎng)通信安全的總體技術(shù)要求、接口安全要求和安全過(guò)程。 本標(biāo)準(zhǔn)適用于基于LTE的車聯(lián)網(wǎng)通信系統(tǒng)。 2 規(guī)范性引用文件 下列文件對(duì)于本文件的應(yīng)用是必不可少的。凡是注日期的引用文件，僅注日期的版本適用于本文件。凡是不注日期的引用文件，其最新版本(包括所有的修改單)適用于本文件。 GB/T 37376-2019 交通運(yùn)輸 數(shù)字證書(shū)格式 GB/T 37374-2019 智能交通 數(shù)字證書(shū)應(yīng)用接口規(guī)范 3GPP TS 33.210 3G安全；網(wǎng)絡(luò)域安全；IP網(wǎng)絡(luò)層安全(3G security；Network Domain Security(NDS)；IP network layer security) 3GPP TS 33.223 通用認(rèn)證架構(gòu)；通用引導(dǎo)架構(gòu)推送功能(Generic Authentication Architecture(GAA)；Generic Bootstrapping Architecture(GBA)Push function) 3GPP TS 33.246 3G 安全；多媒體廣播/多播業(yè)務(wù)(3G Security；Security of Multimedia Broadcast/Multicast Service(MBMS)) IEEE Std 1363 IEEE公鑰加密標(biāo)準(zhǔn)規(guī)范(IEEE Standard Specifications for Public-Key Cryptography) IEEE Std 1363a IEEE公鑰加密標(biāo)準(zhǔn)規(guī)范-修正1：附加技術(shù)(IEEE Standard Specifications for Public-Key Cryptography—Amendment 1:Additional Techniques) IEEE Std 1609.2-2016 IEEE車載環(huán)境無(wú)線接入標(biāo)準(zhǔn) 應(yīng)用和管理消息的安全服務(wù)(IEEE Standard for Wireless Access in Vehicular Environments(WAVE)—Security Services for Applications and Management Messages) IETF RFC 5639 橢圓曲線密碼(ECC)Brainpool標(biāo)準(zhǔn)曲線和曲線生成(Elliptic Curve Cryptography(ECC)Brainpool Standard Curves and Curve Generation) FIPS-197 先進(jìn)的加密標(biāo)準(zhǔn)(ADVANCED ENCRYPTION STANDARD) FIPS PUB 180 安全散列標(biāo)準(zhǔn)(SECURE HASH STANDARD) FIPS PUB 186-4 數(shù)字簽名標(biāo)準(zhǔn)(Digital Signature Standard) GM/T 0002 SM4分組密碼算法 GM/T 0003 SM2橢圓曲線公鑰密碼算法 GM/T 0004 SM3密碼雜湊算法 GM/T 0015 基于SM2密碼學(xué)算法的數(shù)字證書(shū)格式規(guī)范 NIST SP 800-38C 分組密碼操作模式的建議：用于認(rèn)證和機(jī)密性的CCM模式(Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality) NIST SP 800-56A 建立成對(duì)密鑰的建議(RECOMMENDATION FOR PAIR-WISE KEY ESTABLISHMENT) 3 縮略語(yǔ) 下列縮略語(yǔ)適用于本文件。 BM-SC Broadcast-Multicast Service Centre 廣播多播服務(wù)中心 BSF Bootstrapping Server Function 引導(dǎo)服務(wù)器功能 CA Certificate Authority 證書(shū)管理機(jī)構(gòu) E-UTRAN Evolved UTRAN 演進(jìn)UTRAN GCSAS Group Communication System Application Server 組通信系統(tǒng)應(yīng)用服務(wù)器 LTE Long Term Evolution 長(zhǎng)期演進(jìn) MBMS Multimedia Broadcast/Multicast Service 多媒體廣播多播業(yè)務(wù) NAF Network Application Function 網(wǎng)絡(luò)應(yīng)用功能 PLMN Public Land Mobile Network 公眾陸地移動(dòng)網(wǎng) USS User Security Setting 用戶安全設(shè)置 V2I Vehicle to Infrastructure 車-路 V2N Vehicle to Network 車-網(wǎng) V2P Vehicle to Pedestrian 車-人 V2V Vehicle to Vehicle 車-車 4 基于LTE的車聯(lián)網(wǎng)通信架構(gòu) 4.1 概述 基于LTE的車聯(lián)網(wǎng)通信系統(tǒng)支持車-車(V2V)應(yīng)用、車-路(V2I)應(yīng)用、車-網(wǎng)(V2N)應(yīng)用和車-人(V2P)應(yīng)用，利用這些應(yīng)用可向用戶提供諸如道路安全、交通效率提升和信息娛樂(lè)等各類業(yè)務(wù)。 V2X通信有兩種操作模式，基于PC5的V2X通信和基于LTE-Uu的V2X通信。 基于LTE-Uu的操作模式可以是單播或廣播方式。V2X設(shè)備可以分別使用這兩種操作模式進(jìn)行接收和發(fā)送。例如：一個(gè)V2X設(shè)備可以使用LTE-Uu的下行廣播接收V2X消息，但發(fā)送V2X消息不使用LTE-Uu。一個(gè)V2X設(shè)備也可以通過(guò)LTE-Uu下行單播來(lái)接收V2X消息。 基于PC5的V2X通信重用一對(duì)多的ProSe直接通信傳輸過(guò)程，鄰近通信中定義的PC5-U協(xié)議棧用于基于PC5接口的V2X通信傳輸。 本標(biāo)準(zhǔn)針對(duì)基于PC5的V2X通信和基于LTE-Uu的V2X通信制定安全總體技術(shù)要求。 4.2 基于PC5和LTE-Uu的V2X通信架構(gòu) 4.2.1 非漫游場(chǎng)景下基于PC5和LTE-Uu的V2X通信架構(gòu) 圖1給出了非漫游場(chǎng)景下基于PC5和LTE-Uu的V2X通信架構(gòu)。 V2AX應(yīng)用服務(wù)器 V2X控制功能 V2X設(shè)備C(pedestrian) V2X應(yīng)用 V2X設(shè)備D(stationary) V2X設(shè)備B(Vehicle) V2X設(shè)備A(Vehicle) 圖1 非漫游場(chǎng)景下基于PC5和LTE-Uu的V2X通信架構(gòu) 4.2.2 漫游場(chǎng)景下基于PC5和LTE-Uu的V2X通信架構(gòu) 圖2給出漫游場(chǎng)景下基于PC5和LTE-Uu的V2X架構(gòu)，V2X設(shè)備A歸屬PLMNA，V2X設(shè)備B歸屬PLMNB，V2X設(shè)備A漫游至PLMNB，V2X設(shè)備B非漫游。 V2X應(yīng)用服務(wù)器也可以連接多個(gè)PLMN，例如一個(gè)V2X應(yīng)用服務(wù)器可以連接PLMNA中的V2X控制功能實(shí)體，也可以連接PLMNB中V2X控制功能實(shí)體。 V2X應(yīng)用服務(wù)器 V2X控制功能(PLMN A) V2X控制功能(PLMN B) V2X應(yīng)用 V2X設(shè)備B V2X設(shè)備A 圖1 漫游場(chǎng)景下基于PC5和LTE-Uu的V2X通信架構(gòu) 4.2.3 跨PLMN場(chǎng)景下基于PC5和LTE-Uu的V2X通信架構(gòu) 圖3給出跨PLMN漫游場(chǎng)景下基于PC5和LTE-Uu的V2X架構(gòu)，V2X設(shè)備A歸屬PLMNA，V2X設(shè)備B歸屬PLMN B，V2X設(shè)備A漫游至PLMNC，V2X設(shè)備B非漫游。