A Security Credential Management System for V2X Communications - Proof-of-Concept and PKI Design Overview

Aug 30, 2026

Upload by Đào

The US Department of Transportation proposed mandating vehicle-to-vehicle safety communications in 2017, creating major cybersecurity and privacy requirements. This paper presents a Security Credential Management System (SCMS) for vehicle-to-everything (V2X) developed with CAMP under a USDOT cooperative agreement. The system issues certificates for trusted messaging, supports bootstrapping, certificate provisioning, misbehavior reporting, and revocation, and targets both security and practical privacy via pseudonym certificates distributed across multiple organizations.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages25

Reading Time1 h 3 min

AccessFree to download

Abstract

Introduction

arXiv : 1802 .05323v1 [ cs .CR] 14 Feb 2018 A Security Credential Management System for V2X Communications Benedikt Brecht¶ , Dean Therriaultk , Andr´e Weimerskirch†, William Whyte∗ , Virendra Kumar∗ , Thorsten Hehn‡, Roy Goudy§ ¶[Benedikt.Brecht@vw.com](Benedikt.Brecht@vw.com) [k](k dean.therriault@gm.com)[ dean.therriault@gm.com](k dean.therriault@gm.com) †[aweimerskirch@lear.com](aweimerskirch@lear.com) ∗ {wwhyte, [vkumar](vkumar}@onboardsecurity.com)[}](vkumar}@onboardsecurity.com)[@onboardsecurity.com](vkumar}@onboardsecurity.com) ‡[thehn@gmx.de](thehn@gmx.de) § [goudyr1@nrd.nissan-usa.com](goudyr1@nrd.nissan-usa.com) Abstract—The US Department of Transportation (USDOT) issued a proposed rule on January 12th, 2017 to mandate vehicle-to-vehicle (V2V) safety communications in light vehicles in the US. Cybersecurity and privacy are major challenges for such a deployment. The authors present a Security Credential Management System (SCMS) for vehicle-to-everything (V2X) communications in this paper, which has been developed by the Crash Avoidance Metrics Partners LLC (CAMP) under a Cooperative Agreement with the USDOT. This system design is currently transitioning from research to Proof-of-Concept, and is a leading candidate to support the establishment of a nationwide Public Key Infrastructure (PKI) for V2X security. It issues digital certi􀀂cates to participating vehicles and infrastructure nodes for trustworthy communications among them, which is necessary for safety and mobility applications that are based on V2X communications. The SCMS supports four main use cases, namely bootstrapping, certi􀀂cate provisioning, misbehavior reporting andrevocation. The main design goal is to provide both security and privacy to the largest extent reasonable and possible. To achieve a reasonable level of privacy in this context, vehicles are issued pseudonym certi􀀂cates, and the generation and provisioning of those certi􀀂cates are divided among multiple organizations. Given the large number of pseudonym certi􀀂cates per vehicle, one of the main challenges is to facilitate ef􀀂cient revocation of misbehaving or malfunctioning vehicles, while preserving privacy against attacks from insiders. The proposed SCMS supports all identi􀀂ed V2X use-cases and certi􀀂cate types necessary for V2X communication security. This paper is based upon work supported by the U.S. Department of Transportation. Any opinions, 􀀂ndings, and conclusions or recommendations expressed in this publication are those of the Authors (”we”) and do not necessarily re􀀃ect the view of the U.S. Department of Transportation. I. INTRODUCTION Vehicle-to-Vehicle (V2V) communications between nearby vehicles in the form of continuous broadcast of Basic Safety Messages (BSMs) has the potential to reduce unimpaired vehicle crashes by 80% through active safety applications [1] . Following a series of 􀀂eld operational tests, the US Department of Transportation (USDOT) issued a proposed rule on January 12th, 2017 to mandate the inclusion of V2V technology in light vehicles in the US [2] . Vehicles will broadcast BSMs up toten times per second to support V2V safety applications. BSMs include the senders’ time, position, speed, path history and other relevant information, and are digitally signed. The receiver evaluates each message, veri􀀂es the signature, and then decides whether a warning needs tobe displayed to the driver. The correctness and reliability of BSMs are of prime importance as they directly affect the effectiveness of safety applications based on them. To prevent an attacker from inserting false messages, the sending vehicles digitally sign each BSM, and the receiving vehicles verify the signature before acting on it. This approach has been recommended by many different studies of the system in both Europe and America. [3],[4], [5], [6], [7], [8], [9] . A Public-Key Infrastructure (PKI) that facilitates and manages digital certi􀀂cates is necessary for

FAQs

What problem does the SCMS address in V2X communications?

It provides certificate-based trust while meeting cybersecurity and privacy requirements for V2X safety messaging.

What are the SCMS’s main use cases?

Bootstrapping, certificate provisioning, misbehavior reporting, and revocation.

How does the SCMS balance privacy with security?

It issues pseudonym certificates and distributes certificate generation/provisioning across multiple organizations to limit privacy exposure while still enabling verification.

Aug 30, 2026

Upload by Đào