What is the Security Credential Management System?

We all know that vehicle-to-everything (V2X) communication constitutes the core of autonomous driving. By enabling vehicles and infrastructure to share live information, a safe and seamless autonomous mobility experience can be accomplished. But how exactly does the information sharing process work?

Just like how we communicate with each other via text messages, vehicles communicate with nearby entities by transmitting basic safety messages (BSM) between one another. However, different from us sending text messages, vehicles can send, receive, and process thousands of messages per minute. Every BSM a vehicle sends out contains the current time, along with the vehicle’s speed, location, direction, path, and other safety-related information. The vehicle that receives the BSM will use such information to determine whether it should change its speed and direction, or simply just send an alert to the driver. Despite seeming like a lot of work, this process is totally seamless, where hundreds of BSMs are sent, received, processed, and acted upon within each second.

Sounds easy? While the concept of V2X communication may seem very straightforward, we must figure out how to keep these communications perfectly accurate and effective. A failed, inaccurate, or miscommunicated text message is not usually a great deal. But a failed BSM is a matter of life and death. In fact, it would be fair to say that only 10% of the V2X communication technology is about communication itself, while the rest 90% is about ensuring that these communications are flawless and secure.

The Role of the Security Credential Management System (SCMS)

The Security Credential Management System (SCMS) is a proof-of-concept (POC) security solution for V2X communication. Despite the fancy name, it is essentially a public key infrastructure (PKI) designed to secure V2X messages – in this case – the BSMs. The POC has been officially adopted as a protocol by the United States Department of Transportation (USDOT) and became an industry standard for all providers of PKI-based V2X security solutions, including AUTOCRYPT.

Just like typical PKIs, the main purpose of the SCMS is to ensure trusted communication by securing the message. This involves a three-step process: certificate issuance, encryption, and certificate-based authentication. In simple terms, the SCMS needs to first ensure that the message sender is a legally registered entity, then encrypt the drafted message, after which from the receiver’s side, it needs to ensure that the message is truly the original message and that it has not been altered during transmission. Nevertheless, there are still two major differences between the SCMS and traditional PKIs. 

The first difference is capacity. A single SCMS can issue up to 300 billion certificates per year, enough to support up to 300 million vehicles. On the other hand, the largest PKI to date is the Europay-Mastercard-Visa Consortium (EMVCo), which is only capable of issuing less than 10 billion certificates per year.

The second difference is that the SCMS faces a much more demanding situation. PKIs used for financial transactions have one sole purpose of ensuring security. Yet, the SCMS must excel in both security and efficiency, two attributes that are usually viewed as tradeoffs.

How Does the SCMS Work?

When a connected vehicle wants to join the V2X network, it must first send its registration request to the SCMS. After approving the request, the SCMS issues an enrolment certificate to the vehicle. The enrolment certificate acts as the ID for the vehicle, proving itself as an authorized participant.

Now that the vehicle is enrolled to send and receive messages. The SCMS still faces the task of securing the message. In this process, it needs to issue and manage several authorization certificates. Before sending out a message, the on-board unit (OBU) must receive an identification certificate. This certificate acts as a digital signature that gets attached to the message. To protect the privacy of the driver, the identification certificate is encrypted and turned into a pseudonym certificate that does not reveal the identity of the vehicle owner.

Before the receiver opens the message, the SCMS compares the sender’s digital signature with a list of previously revoked signatures to ensure that the signature is currently valid. After passing all verifications, the message is given to the receiver to process.

Other entities like roadside infrastructure also undergo the same process before sending a message. Roadside units (RSU) receive application certificates that are equivalent to the identification certificates of OBUs. However, in this case, there is no need to transform them into pseudonym certificates.

security credential management system chart

Why is the SCMS Useful for V2X Security?

Ensuring data integrity. In the V2X communication process, it is crucial to ensure that the message transmitted is not altered by any third party. Since the SCMS seals the messages with digital signatures, then verifies the signature upon receival. There is no endpoint for malicious actors to manipulate the message.

Ensuring data authenticity. Since an identity certificate is issued every time before a sender sends a message, there is no potential loophole for a threat actor to send fake messages in the identity of someone else.

Ensuring privacy. As mentioned above, the identity certificate issued to an OBU is encrypted into a pseudonym certificate. On top of that, the message itself only contains information on the vehicle’s condition and behaviour but not the vehicle’s identity. This makes it nearly impossible to trace the message back to the sender vehicle’s owner.

Ensuring interoperability. Instead of having V2X security providers developing their own set of mechanisms, the SCMS acts as a protocol that ensures all the developed solutions are interoperable with one another. This is a key benefit because interoperability is crucial to V2X communication.

Revocation. Different from traditional PKIs, the SCMS keeps a record of all revoked devices that had been reported with misbehaving, malfunctioning, or even malicious actions. The record helps prevent the same threats from reoccurring, significantly lowering the risks associated with the system.

AutoCrypt V2X, Securing Autonomous Driving with Decades of Experience in PKI

The SCMS protocol is complemented by a few other industry standards to ensure the deployment of secure and efficient PKIs for the V2X network. As such, AutoCrypt PKI is not only designed based on the SCMS, but also is in line with the Crash Avoidance Metrics Partners (CAMP) and the Cooperative ITS Credential Management System (CCMS). Combining AutoCrypt PKI with the software development kit installed locally into the OBUs, along with AutoCrypt LCM, the local certificate manager in charge of message encryption, AutoCrypt V2X is the most complete solution for autonomous driving.

To keep informed with the latest news on mobility tech and automotive cybersecurity, subscribe to AUTOCRYPT’s monthly newsletter.

Top 7 Smart Cities and Their ITS Achievements

The Challenge of Megacities

As the fourth industrial revolution continues to transform the global economy, people around the world are flocking to cities in the seemingly never-ending urbanization trend. Apart from global cities like New York and London, nearly every regional population center around the world is experiencing population growth, forcing these cities to expand into nearby suburbs by building new roads and infrastructure.

Consequently, the problem with expanding outwards is that these cities become so large, forcing their residents to travel long distances on a daily basis – not just for work, but also for social gatherings, shopping, and recreational activities. This puts significant strain on roads and highways, leading to constant traffic jams and frequent accidents.

Many suggest public transportation as a solution. Indeed, well-operated subway and buses may be convenient for inner-city travel, but for a megacity with a dozen satellite cities surrounding the core, building public transportation becomes expensive, and usually takes decades of construction. Moreover, let us be honest, a 20-station subway ride might not necessarily be a better alternative to being stuck in traffic.

Hence, we should not blindly blame the municipal governments for not building more subway lines, expecting public transportation to solve all problems. Even though public transportation is great for short to medium distance travel, but for long-distance trips, we must address the problem at its roots: to improve roads and infrastructure.

Smart City and the Intelligent Transportation System (ITS)

Improving roads does not simply mean adding additional lanes, because wide roads and highways can lead to excessive lane hopping and cause even more delays. Thus, instead of making wider roads, a better alternative would be to make smarter roads. 

Building smarter roads has become a crucial project for smart cities. That is, to build roads and transportation infrastructure that collect data generated from daily traffic, then analyze and learn these data to improve the usability, effectiveness, and accessibility of the roads and infrastructure. These smart roads and infrastructure are collectively called the intelligent transportation system (ITS).

In this article, we will look at a list of smart cities in the world and their special contributions and achievements in advancing the ITS.

Hong Kong

Hong Kong has long been a global financial center and transportation hub that sits at the center of the Asia-Pacific region. Despite having more than 7 million residents, the city had very limited land for suburban expansion due to its administrative and physical geography. This forced the city to build a sophisticated network of roads and highways, with roughly 800,000 registered vehicles sharing over 2,000 km of road – nearly 400 vehicles for every kilometer. Due to such pressure, Hong Kong became one of the first cities in the world to adopt an Area Traffic Control (ATC) system. The system uses CCTVs installed at signalized intersections to provide real-time information on traffic flow. The traffic controllers then analyze such information to gain insights on where accidents frequently occur and adjust traffic signal lengths optimized for both motorists and pedestrians.

Sydney

Like Hong Kong’s ATC system, the capital of the Australian state of New South Wales has gone a step further by developing an Adaptive Traffic Signal Control (ATSC) system that is capable of adapting to the real-time situation. Patented and owned by New South Wales, the system is hence named the Sydney Coordinate Adaptive Traffic System (SCATS). SCATS adjusts the timings of green and red signals based on the real-time traffic flow of each direction. Hence instead of having fixed time durations for each signal, an optimized duration is calculated in real-time using the data collected by CCTVs as well as sensors built into the ground. Apart from New South Wales, SCATS is currently installed in almost all signalized traffic intersections in Australia, as well as over 55,000 intersections across 187 cities and 28 countries worldwide.

Singapore

As a city-state, Singapore’s issue is very similar to that of Hong Kong. With over 5.7 million residents living in a land area of only two-thirds of that of Hong Kong, the city’s government had no choice but to discourage personal vehicle ownership by enforcing a 100% import tariff and additional registration fees that bring the cost up to three to four times the market value. Nevertheless, Singapore has also adopted a sophisticated ITS in more recent years. To manage the ITS, the city introduced i-Transport, an integrated platform that stores and manages raw data collected from the traffic sensors. Its major role is to analyze these data into useful information to help road development and planning. The i-Transport platform has enabled a variety of useful services, including the Parking Guidance System (PGS). The PGS collects real-time information on leftover parking spots in nearby parking lots and displays this information on large digital information panels on the roadside so that drivers can easily find the nearest parking lot without having to circle around downtown streets looking for available parking space. As Singapore’s ITS continues to make its roads smarter, hopefully, the government will be able to slowly relieve the astronomical costs of purchasing cars.

Las Vegas

Cities in North America face a very different problem than that of Hong Kong and Singapore. Since most cities have plenty of space surrounding them for urban expansion, a North American “city” is usually a large metropolitan area that interconnects dozens of cities and towns. To put it in perspective, despite San Francisco proper being home to only 900,000 residents, nearly 5 million people live in its metropolitan area. Since these cities are bigger, their local streets tend to be less crowded. However, the highways that go through them face constant congestion, especially when a highway acts as both the inner-city highway and the interstate highway, like the Ontario 401 – the busiest highway on the continent. The biggest problem for American highways is that they have too many lanes. Las Vegas has an interesting solution to organize traffic on these highways. Its Active Traffic Management (ATM) system consists of large, high-resolution digital panels on top of the highways. The system uses cameras and sensors to collect big data and analyze them so that they can accurately estimate traffic conditions and travel times for each individual lane. It then displays the average speed ahead for each individual lane, as well as putting an “X” above lanes that are closed ahead due to traffic accidents or constructions. The ATM system helps drivers make informed decisions on which lanes to use and when to switch lanes without having to blindly change lanes back and forth.

New York

With over 20 million residents in its metropolitan area, New York City is by far the most populous urban center of the United States. This has pushed the Big Apple to develop an ITS that focuses on smoothing traffic. Recently, New York City signed a contract with Transition Networks, an IoT manufacturer, to add internet connections to the cameras and sensors of over 10,000 signalized traffic intersections across the city. These connected devices allow for centralized management and remote maintenance, reducing the need for any physical workers to be present on site.

Barcelona

Barcelona has been a leader of smart city transformation in Europe. Over the past decade, all the streetlights in Barcelona have been replaced by an LED-based lighting system. The system can automatically adjust its brightness and angle based on environmental information like temperature, humidity, pollution, and visibility. It is also capable of detecting noise so that the lamps can switch on and off depending on the existence of pedestrians. Not only does this new lighting system save energy, but it also reduces the heat generated by conventional lamps.

Jeju

This island city of South Korea is one of the world’s pioneers in developing a Cooperative Intelligent Transport System (C-ITS). Different from ITS, which uses collected data to provide useful information, a C-ITS involves real-time exchange of information between roads, infrastructure, and the vehicles themselves, making it a crucial part of the autonomous driving experience. The city has also introduced a number of C-ITS devices that can be installed into cars, providing drivers with real-time information on the roads ahead, warning drivers on emergency vehicles passing by, road closure, and even slippery road conditions (based on data collected from other vehicles). To learn more about C-ITS, read: 7 Major Functions of Cooperative Intelligent Transport Systems.

AutoCrypt V2X, Securing Data for C-ITS

As advancements in automotive technology bring us connected cars and autonomous driving.  smart cities are taking a step further to develop C-ITS with the goal of establishing a safe and seamless experience of connectivity on the road. Yet, autonomous driving has also brought us a new challenge; since data involved in C-ITS directly impact vehicle behaviour, they must be safely guarded against manipulation and theft.

This is one of the main reasons AUTOCRYPT was founded. As a built-in software development kit, AutoCrypt V2X uses sophisticated encryption and authentication technologies to ensure that all V2X-enabled units are verified and all data in transmission are safely protected. 

To keep informed with the latest news on mobility tech and automotive cybersecurity, subscribe to AUTOCRYPT’s monthly newsletter.

DSRC vs. C-V2X: A Detailed Comparison of the 2 Types of V2X Technologies

A Beginner’s Guide to V2X

V2X (vehicle-to-everything) is an umbrella term that is used to refer to a vehicle’s communication with all other entities, including other moving and parked vehicles, pedestrians, traffic signals, road signs, construction sites, and many more. A vehicle communicates with the outside world in two ways: 1) by receiving physical feedback from the lidar sensors equipped around the vehicle, and 2) by wireless communication that sends and receives messages to and from other entities. These two methods complement each other to complete the autonomous driving experience. For example, lidar sensors provide feedback from the surrounding environment to detect any immediate threats, while messages regarding every vehicle’s location, speed, and direction from as far as 300 meters can be obtained through wireless communication so that the car can adjust its behaviors far ahead of time.

Lidar sensors provide one-way communication, in which the car receives information from its surroundings by physically illuminating them with laser light. By contrast, wireless communication technology enables two-way communication, so that the vehicle not only receives information, but also sends messages regarding its behavior to all other certified entities. Today, the term “V2X” is mostly used to refer to the latter – wireless vehicular communications.

V2X technology significantly increases a vehicle’s autonomy. For instance, by communicating with traffic signals, the car receives real-time information about when to stop at intersections. By communicating with the pedestrians’ mobile devices, the car can stay ahead of itself to prepare to stop for jaywalkers. By communicating with construction and accident sites, the car can look for the nearest detour to avoid getting trapped in traffic jams.

Note that V2X must be complemented by lidar sensors because even though it provides perfectly accurate information, it is not capable of detecting entities that are not equipped with communication technology, such as an old conventional car or a rock on the road. Thus, the importance of cameras and sensors must not be neglected.

In this post, we will take a deeper look at the two different V2X wireless communication technologies currently used by automakers and infrastructure developers across the globe.

DSRC (defined by IEEE 802.11p: WAVE)

DSRC was first introduced as a V2X technology in the Institute of Electrical and Electronics Engineers (IEEE)’s 802.11p standard, a vehicular communication protocol intended for adding wireless access in vehicular environments (WAVE). As the first communication standard for V2X, WAVE uses WLAN technology to establish dedicated short-range communication (DSRC) channels so that the vehicles can communicate directly to other entities within short to medium ranges (typically 300 meters). Despite WAVE being the official name of the protocol, many still refer to the technology as DSRC to describe the underlying mechanism. In fact, many industry experts would use the terms DSRC, 802.11p, WAVE, or WLAN-based V2X interchangeably to refer to the same thing.

DSRC is essentially a modification of Wi-Fi. The technology was considered a huge breakthrough in the automotive industry because it allows for data to be transmitted between two devices without going through any intermediaries, making it highly useful for rural and remote areas without any telecommunication infrastructure. This is like sending a text message to another phone 300 meters away without the need for cellular network coverage. Moreover, DSRC is known for having very low latency due to the elimination of the intermediary.

After its initial approval in 2010, DSRC went through years of testing before it was first deployed in selected Toyota vehicles manufactured in Japan in 2015, and later adopted by some Cadillac models in the US in 2017. In 2019, the Volkswagen Golf 8, one of the most popular cars in Europe, became the most sold V2X-enabled car in the market.

C-V2X (defined by 3GPP Releases 14, 15, 16)

Introduced soon after DSRC, C-V2X is another vehicular communication protocol developed for V2X. Defined by the 3rd Generation Partnership Projects (3GPP), C-V2X utilizes cellular radio instead of WLAN, meaning that it utilizes the same set of cellular radio technology as cellphones do. The major difference that sets C-V2X apart from DSRC is that it allows both direct and indirect communication. In direct C-V2X, vehicles communicate directly with other vehicles (V2V) and roadside units (V2I) the same way as how DSRC works. Under indirect C-V2X, vehicles communicate with other entities indirectly via the cellular network (V2N), which is something DSRC cannot do.

Indirect C-V2X is useful because the cellular network can collect data from many cars, and thus can be more effective at managing traffic on a larger scale. Originally designed in Release 14 to use the LTE standard, 3GPP later added compatibility for 5G and 5G NR in Releases 15 and 16.

Even though DSRC had been gaining ground in Japan and Europe, C-V2X is becoming increasingly popular in the US, China, and other regions of the world. Furthermore, C-V2X has won support from many professional organizations such as the 5G Automotive Association (5GAA) based on its advantages to DSRC. Then, what are some of the pros and cons of C-V2X when compared to DSRC?

On the pros, supporters of C-V2X generally suggest that cellular radio technology has better growth potential for faster speeds and higher reliability. This means that looking at the long-run, C-V2X is more sustainable as it offers a long-term path for constant improvements. Moreover, the ability to connect to the cellular network could create a much smarter transportation system. Lastly, the price of cellular chipsets is cheaper than that of WLAN chipsets.

On a side note, some uncontrolled experiments show that direct C-V2X offers greater range than DSRC. But this is not scientifically proven, and that the 300-meter range of DSRC is more than enough for autonomous driving purposes.

As for the cons, supporters of DSRC believe that switching to C-V2X would delay the rollout of autonomous driving because DSRC is a more mature standard, proven to work in large commercial settings. C-V2X is still undergoing its final testing stage when it comes to large-scale deployment, and indirect C-V2X does not look like it will be ready for commercialization until at least 2024, though direct C-V2X is on schedule for commercial deployment in 2021.

DSRC and C-V2X Compatibility

At the end of the day, both DSRC and C-V2X have the same use cases, meaning that the real-life application is the same across both standards. Despite all the rhetoric from both sides, there had been no side-by-side testing proving that one performs better than the other in application.

Due to a lack of statistical evidence on the performance side, the industry has slowly shifted to prefer C-V2X as it exhibits better long-term prospects. The problem is that because DSRC and C-V2X run on different communication technologies, the access layer is not interoperable. Automakers and infrastructure developers face the difficult choice of adopting one or the other in their infrastructures.

The good news for automakers is that many chipmakers have started manufacturing dual-mode chipsets that are compatible with both standards, helping those undergoing the transition.

In terms of infrastructure developers, many of those with existing DSRC infrastructures are now working to add cellular network connectivity to them by combining them with indirect C-V2X.

The Role of Cybersecurity in V2X

Regardless of the communication technologies used, cybersecurity is an integral component of V2X. AutoCrypt V2X is a security solution that embeds itself in V2X chipsets, protecting the V2X system with both authentication and data encryption technologies. It ensures data integrity by verifying every entity to ensure they are who they claim to be, and protects sensitive information by encrypting the messages in transmission. Working with chipmakers around the world, AutoCrypt V2X is currently active in a number of C-ITS projects and is major supplier for some of the world’s largest automakers.

To keep informed with the latest news on mobility tech and automotive cybersecurity, subscribe to AUTOCRYPT’s monthly newsletter.

AUTOCRYPT Launches C-V2X Solution Demonstrating Interoperability with China C-SCMS Standards

SEOUL, KOREA — AUTOCRYPT Co., Ltd., a leading V2X security solutions provider, announced the launch of its new C-V2X solution, supporting Chinese Secure Credential Management System (C-SCMS) standards. AUTOCRYPT received verification tests for compatibility by the C-V2X working group at China Academy of Information and Communications Technology (CAICT), under the new International Mobile Telecommunications-2020 (IMT-2020(5G)) Standard for 5G networks, devices, and services.

China currently leads the world in usage of LTE communications and currently has the third best-selling automotive brand in the market. The nation has set itself on a progressive path in the automotive industry by standardizing the LTE-V2X communications system throughout the entire country, making it mandatory to implement LTE-based C-V2X technology rather than Dedicated Short-Range Communications, or DSRC, into C-ITS projects. China has promoted active deployment of the technology and has already begun C-V2X technology demonstrations in 30 regions. Wuxi, Tianjin and Changsha cities have been designated as the first main cities in the country to become C-V2X commercialization areas, undergoing major developments.

Last month, AUTOCRYPT’s solution was verified for interoperability by the China Industry Innovation Alliance for Intelligent and Connected Vehicles (CAICV), undergoing testing for “four-layers” interoperability between OEM, OBU terminal, V2X communication module, and PKI to comply with C-SCMS standards.

Overseas solutions providers often face challenges in entering market as China’s regulations for C-SCMS differ from existing standards. Unlike the existing SCMS structure, China’s SCMS (C-SCMS) standards utilize a Certificate Trust List (CTL) which configures trust relationships between several PKI (Multiple Root CA) systems. Additionally, C-SCMS allows the download of a security certificate without a registration certificate, further requiring stability measures to be implemented into the protocol.

AUTOCRYPT’s C-V2X security solution has met the challenge to demonstrate compliance, verifying the new solution’s C-SCMS technical standards, making AUTOCRYPT’s security solutions ready for implementation into the country’s Cooperative Intelligent Transport Systems (C-ITS) projects.

CEO and co-Founder Daniel ES Kim remarked, “When it comes to autonomous vehicles and their secure operation, it is essential to ensure compliance with the standards set by the governing parties.” He continued, “AUTOCRYPT currently leads the field in terms of C-ITS security projects, and with this interoperability verification, we are confident that our C-V2X based autonomous driving security solutions will continue to contribute to C-ITS deployment and development in China.”