標準編號:	YD/T 3594-2019
中文名稱:	基于LTE的車聯網通信安全技術要求
英文名稱:	General technical requirements of Security for Vehicular Communication based on LTE
行業分類:	YD    通信行業標準
發布機構:	中華人民共和國工業和信息化部
發布日期:	2019-11-11
實施日期:	2020-1-1
標準狀態:	valid
翻譯語言:	英文
文件格式:	PDF
中文字符數:	50000 字
翻譯價格(元):	3200.0
交付時間:	付款后 1 個工作日

Codeofchina.com is in charge of this English translation. In case of any doubt about the English translation, the Chinese original shall be considered authoritative. This standard is developed in accordance with the rules given in GB/T 1.1-2009. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. The issuing body of this document shall not be held responsible for identifying any or all such patent rights. This standard was proposed by and is under the jurisdiction of China Communications Standards Association. General technical requirements of security for vehicular communication based on LTE 1 Scope This standard specifies the general technical requirements, interface security requirements and security procedure of security for vehicular communication based on LTE. It is applicable to vehicular communication system based on LTE. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced documents (including any amendments) applies. GB/T 37376-2019 Transportation - Digital certificate format GB/T 37374-2019 Intelligent transport - Digital certificate application interface 3GPP TS 33.210 3G security; Network domain security (NDS); IP network layer security 3GPP TS 33.223 Generic authentication architecture (GAA); Generic bootstrapping architecture (GBA) push function 3GPP TS 33.246 3G security; Security of multimedia broadcast / multicast service (MBMS) IEEE Std 1363 IEEE standard specifications for public-key cryptography IEEE Std 1363a IEEE standard specifications for public-key cryptography - Amendment 1: Additional techniques IEEE Std 1609.2-2016 IEEE standard for wireless access in vehicular environments (WAVE) - Security services for applications and management messages IETF RFC 5639 Elliptic curve cryptography (ECC) brainpool standard curves and curve generation FIPS-197 Advanced encryption standard FIPS PUB 180 Secure hash standard FIPS PUB 186-4 Digital signature standard GM/T 0002 SM4 block cipher algorithm GM/T 0003 Public key cryptographic algorithm SM2 based on elliptic curves GM/T 0004 SM3 cryptographic hash algorithm GM/T 0015 Digital certificate format based on SM2 algorithm NIST SP 800-38C Recommendation for block cipher modes of operation: the CCM mode for authentication and confidentiality NIST SP 800-56A Recommendation for pair-wise key establishment 3 Abbreviations For the purposes of this document, the following abbreviations apply. BM-SC Broadcast-Multicast Service Centre BSF Bootstrapping Server Function CA Certificate Authority E-UTRAN Evolved UTRAN GCSAS Group Communication System Application Server LTE Long Term Evolution MBMS Multimedia Broadcast/Multicast Service NAF Network Application Function PLMN Public Land Mobile Network USS User Security Setting V2I Vehicle to Infrastructure V2N Vehicle to Network V2P Vehicle to Pedestrian V2V Vehicle to Vehicle 4 Vehicular communication architecture based on LTE 4.1 General The vehicular communication architecture based on LTE system supports V2V application, V2I application, V2N application and V2P application, which can be used to provide users with various services such as road safety, traffic efficiency improvement and infotainment. V2X communication is provided with two operation modes: PC5-based V2X communication and LTE-Uu-based V2X communication. Wherein, the latter may be unicast or broadcast. The V2X equipment may receive and send messages using the two operation modes respectively. Example: a V2X equipment may receive V2X messages using downlink broadcast of LTE-Uu, but send V2X messages without using LTE-Uu. A V2X equipment may also receive V2X messages via LTE-Uu downlink unicast. The V2X communication is based on PC5 reuses one-to-many ProSe for direct communication transmission procedure. The PC5-U protocol stack as defined in proximity communication is used for the V2X communication transmission based on PC5 interface. The general technical requirements of security for V2X communication based on PC5 and LTE-Uu are prepared in this standard. 4.2 V2X communication architecture based on PC5 and LTE-Uu 4.2.1 V2X communication architecture based on PC5 and LTE-Uu in non-roaming scenarios Figure 1 shows the V2X communication architecture based on PC5 and LTE-Uu in non-roaming scenarios. Figure 1 V2X communication architecture based on PC5 and LTE-Uu in non-roaming scenarios 4.2.2 V2X communication architecture based on PC5 and LTE-Uu in roaming scenarios Figure 2 shows the V2X architecture based on PC5 and LTE-Uu in roaming scenarios, V2X equipment A home PLMNA, V2X equipment B home PLMNB, V2X equipment A roaming to PLMNB, and V2X equipment B non-roaming. The V2X application server may be connected to multiple PLMNs. Example: a V2X application server may be connected to V2X control function entities in PLMN A or those in PLMN B. Figure 1 V2X communication architecture based on PC5 and LTE-Uu in roaming scenarios 4.2.3 V2X communication architecture based on PC5 and LTE-Uu in cross-PLMN scenarios Figure 3 shows the V2X architecture based on PC5 and LTE-Uu in cross-PLMN roaming scenarios, V2X equipment A home PLMN A, V2X equipment B home PLMN B, V2X equipment A roaming to PLMN C, and V2X equipment B non-roaming. Figure 3 V2X architecture based on PC5 and LTE-Uu in cross-PLMN scenarios 4.2.4 Reference point Reference points of V2X communication architecture based on PC5 and LTE-Uu contain: ——V1: the reference point between the V2X application (in the V2X equipment) and the V2X application server. ——V2: the reference point between the V2X application server and V2X control function. The V2X application server may be connected to multiple V2X control functions belonging to PLMN. ——V3: the reference point between the V2X equipment and the V2X control function in home PLMN. It is applicable to V2X communication based on PC5 and LTE-Uu; the V2X communication based on LTE-Uu may support MBMS optionally. ——V4: the reference point between the HSS and the V2X control function in the operator's network. ——V5: the reference point between the V2X applications of different V2X equipment. ——V6: the reference point between the V2X control functions in different PLMNs. ——PC5: the reference point for ProSe direct communication in user plane between the V2X equipment using V2X service. ——S6a: in the V2X scenario, MME can download subscription information related to V2X communication during E-UTRAN attach procedure or to inform the subscription information in the HSS to MME when the information is changed. ——S1-MME: in the V2X scenario, the reference point is used to send the V2X service authorization from MME to eNodeB. ——LTE-Uu: the reference point between the UE and the E-UTRAN. 4.3 V2X communication architecture based on MBMS and LTE-Uu Figure 4 shows the V2X communication architecture based on MBMS and LTE-Uu. Figure 4 V2X architecture based on MBMS and LTE-Uu The reference points of this architecture are as follows: ——MB2: the reference point between V2X application server and BM-SC. ——SGmb/SGi-mb/M1/M3: the SGmb/SGi-mb/M1/M3 reference points in the MBMS system. 4.4 Vehicular communication security architecture based on LTE 4.4.1 Vehicular communication security protocol architecture based on LTE The vehicular communication security based on LTE contains bearing security (PC5 security or LTE-UU security) and V2X application security. Figure 5 shows the V2X security architecture based on PC5, and Figure 6 shows the V2X security architecture based on LTE-UU.

Foreword i 1 Scope 2 Normative references 3 Abbreviations 4 Vehicular communication architecture based on LTE 4.1 General 4.2 V2X communication architecture based on PC5 and LTE-Uu 4.3 V2X communication architecture based on MBMS and LTE-Uu 4.4 Vehicular communication security architecture based on LTE 5 Requirements of security for vehicular communication based on LTE 5.1 General security requirements 5.2 Security requirements of network elements 6 Security procedure of V5 interface 6.1 General 6.2 Description of basic security elements 6.3 General requirements for security data structure 6.4 Public key certificate format 6.5 Message signature process 6.6 Message encryption process 6.7 Key agreement 7 Other interface security procedures 7.1 V2X communication security procedure between network elements 7.2 Security procedure of V3 interface 7.3 Security procedure of MB2 interface Annex A (Normative) Algorithm description Annex C (Informative) Public key certificate management Annex D (Informative) V5 interface data message Annex E (Informative) Key agreement calculation process Annex F (Informative) Certificate request and response Annex G (Informative) Allocation suggestions on security-related AID value

基于LTE的車聯網通信安全技術要求 1 范圍 本標準規定了基于LTE的車聯網通信安全的總體技術要求、接口安全要求和安全過程。 本標準適用于基于LTE的車聯網通信系統。 2 規范性引用文件 下列文件對于本文件的應用是必不可少的。凡是注日期的引用文件，僅注日期的版本適用于本文件。凡是不注日期的引用文件，其最新版本(包括所有的修改單)適用于本文件。 GB/T 37376-2019 交通運輸 數字證書格式 GB/T 37374-2019 智能交通 數字證書應用接口規范 3GPP TS 33.210 3G安全；網絡域安全；IP網絡層安全(3G security；Network Domain Security(NDS)；IP network layer security) 3GPP TS 33.223 通用認證架構；通用引導架構推送功能(Generic Authentication Architecture(GAA)；Generic Bootstrapping Architecture(GBA)Push function) 3GPP TS 33.246 3G 安全；多媒體廣播/多播業務(3G Security；Security of Multimedia Broadcast/Multicast Service(MBMS)) IEEE Std 1363 IEEE公鑰加密標準規范(IEEE Standard Specifications for Public-Key Cryptography) IEEE Std 1363a IEEE公鑰加密標準規范-修正1：附加技術(IEEE Standard Specifications for Public-Key Cryptography—Amendment 1:Additional Techniques) IEEE Std 1609.2-2016 IEEE車載環境無線接入標準 應用和管理消息的安全服務(IEEE Standard for Wireless Access in Vehicular Environments(WAVE)—Security Services for Applications and Management Messages) IETF RFC 5639 橢圓曲線密碼(ECC)Brainpool標準曲線和曲線生成(Elliptic Curve Cryptography(ECC)Brainpool Standard Curves and Curve Generation) FIPS-197 先進的加密標準(ADVANCED ENCRYPTION STANDARD) FIPS PUB 180 安全散列標準(SECURE HASH STANDARD) FIPS PUB 186-4 數字簽名標準(Digital Signature Standard) GM/T 0002 SM4分組密碼算法 GM/T 0003 SM2橢圓曲線公鑰密碼算法 GM/T 0004 SM3密碼雜湊算法 GM/T 0015 基于SM2密碼學算法的數字證書格式規范 NIST SP 800-38C 分組密碼操作模式的建議：用于認證和機密性的CCM模式(Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality) NIST SP 800-56A 建立成對密鑰的建議(RECOMMENDATION FOR PAIR-WISE KEY ESTABLISHMENT) 3 縮略語 下列縮略語適用于本文件。 BM-SC Broadcast-Multicast Service Centre 廣播多播服務中心 BSF Bootstrapping Server Function 引導服務器功能 CA Certificate Authority 證書管理機構 E-UTRAN Evolved UTRAN 演進UTRAN GCSAS Group Communication System Application Server 組通信系統應用服務器 LTE Long Term Evolution 長期演進 MBMS Multimedia Broadcast/Multicast Service 多媒體廣播多播業務 NAF Network Application Function 網絡應用功能 PLMN Public Land Mobile Network 公眾陸地移動網 USS User Security Setting 用戶安全設置 V2I Vehicle to Infrastructure 車-路 V2N Vehicle to Network 車-網 V2P Vehicle to Pedestrian 車-人 V2V Vehicle to Vehicle 車-車 4 基于LTE的車聯網通信架構 4.1 概述 基于LTE的車聯網通信系統支持車-車(V2V)應用、車-路(V2I)應用、車-網(V2N)應用和車-人(V2P)應用，利用這些應用可向用戶提供諸如道路安全、交通效率提升和信息娛樂等各類業務。 V2X通信有兩種操作模式，基于PC5的V2X通信和基于LTE-Uu的V2X通信。 基于LTE-Uu的操作模式可以是單播或廣播方式。V2X設備可以分別使用這兩種操作模式進行接收和發送。例如：一個V2X設備可以使用LTE-Uu的下行廣播接收V2X消息，但發送V2X消息不使用LTE-Uu。一個V2X設備也可以通過LTE-Uu下行單播來接收V2X消息。 基于PC5的V2X通信重用一對多的ProSe直接通信傳輸過程，鄰近通信中定義的PC5-U協議棧用于基于PC5接口的V2X通信傳輸。 本標準針對基于PC5的V2X通信和基于LTE-Uu的V2X通信制定安全總體技術要求。 4.2 基于PC5和LTE-Uu的V2X通信架構 4.2.1 非漫游場景下基于PC5和LTE-Uu的V2X通信架構 圖1給出了非漫游場景下基于PC5和LTE-Uu的V2X通信架構。 V2AX應用服務器 V2X控制功能 V2X設備C(pedestrian) V2X應用 V2X設備D(stationary) V2X設備B(Vehicle) V2X設備A(Vehicle) 圖1 非漫游場景下基于PC5和LTE-Uu的V2X通信架構 4.2.2 漫游場景下基于PC5和LTE-Uu的V2X通信架構 圖2給出漫游場景下基于PC5和LTE-Uu的V2X架構，V2X設備A歸屬PLMNA，V2X設備B歸屬PLMNB，V2X設備A漫游至PLMNB，V2X設備B非漫游。 V2X應用服務器也可以連接多個PLMN，例如一個V2X應用服務器可以連接PLMNA中的V2X控制功能實體，也可以連接PLMNB中V2X控制功能實體。 V2X應用服務器 V2X控制功能(PLMN A) V2X控制功能(PLMN B) V2X應用 V2X設備B V2X設備A 圖1 漫游場景下基于PC5和LTE-Uu的V2X通信架構 4.2.3 跨PLMN場景下基于PC5和LTE-Uu的V2X通信架構 圖3給出跨PLMN漫游場景下基于PC5和LTE-Uu的V2X架構，V2X設備A歸屬PLMNA，V2X設備B歸屬PLMN B，V2X設備A漫游至PLMNC，V2X設備B非漫游。