Authorization CA --> Registration Authority:
auth certs

Definition
Included In
Communication Solutions
Characteristics
Security

Definitions

auth certs (Information Flow): One or more authorization certificates for end entity use, which may be locked, and may be identification or pseudonym certificates.

Authorization CA (Source Physical Object): An 'authorization certificate authority' (ACA) is a certificate authority (CA) that issues authorization certificates.

Registration Authority (Destination Physical Object): The 'Registration Authority' (RA) is a component of the CCMS that is the main point of contact for an end entity, and is responsible for provisioning the end entity with authorization and successor enrollment

Included In

This Triple is in the following Service Packages:

None

This triple is associated with the following Functional Objects:

None

This Triple is described by the following Functional View Data Flows:

None

This Triple has the following triple relationships:

None

Communication Solutions

US: Security Credentials - Secure Internet (ITS) (3)

Solutions are sorted in ascending Gap Severity order. The Gap Severity is the parenthetical number at the end of the solution.

Selected Solution

US: Security Credentials - Secure Internet (ITS)

Solution Description

This solution is used within Canada and the U.S.. It combines standards associated with US: Security Credentials with those for I-I: Secure Internet (ITS). The US: Security Credentials standards include upper-layer standards required to provide and revoke security credentials, define security policy, and handle enrollment coordination. The I-I: Secure Internet (ITS) standards include lower-layer standards that support secure communications between ITS equipment using X.509 or IEEE 1609.2 security certificates.

ITS Application Entity No Standard Needed			Click gap icons for more info.
Mgmt Bundle: SNMPv3 MIB	Facilities IEEE 1609.2.1	Security IEEE 1609.2.1 Secure Session Alternatives
	TransNet IP Alternatives Internet Transport Alternatives
	Access Internet Subnet Alternatives

Note that some layers might have alternatives, in which case all of the gap icons associated with every alternative may be shown on the diagram, but the solution severity calculations (and resulting ordering of solutions) includes only the issues associated with the default (i.e., best, least severe) alternative.

Characteristics

Characteristic	Value
Time Context	Recent
Spatial Context	Regional
Acknowledgement	True
Cardinality	Unicast
Initiator	Source
Authenticable	True
Encrypt	True

Interoperability	Description
Regional	Interoperability throughout the geopolitical region is highly desirable, but if implemented differently in different transportation management jurisdictions, significant benefits will still accrue in each jurisdiction. Regardless, this Information Flow Triple should be implemented consistently within a transportation jurisdiction (i.e., the scope of a regional architecture).

Security

Information Flow Security
	Confidentiality	Integrity	Availability
Rating	Moderate	High	Moderate
Basis	There is no personal information in this, but the content is intended for a specific device (in many cases the device ID will be further obfuscated with a pseudonym). There is little to be gained by observing this content, though understanding the auth cert update frequency might be relevant to an attacker.	As the key credential for participation in cooperative ITS applications, this material must be correct and trustworthy.	Cert delivery must happen, but can be requested well in advance.

Security Characteristics	Value
Authenticable	True
Encrypt	True

Authorization CA --> Registration Authority:auth certs