OWS security alternatives

Transkript

1 O security alternatives Arne Lohage 5 April

2 Presentation layout First the conclusion Description and background explaining the conclusion Three options forward pros and cons Conclusion again open for comments 5 April

3 First the conclusion Three options of security could be considered End-to-end security (all the way from each individual weight sensor to enforcer s reading tool) No added security at all. Partly secured. Only the option No added security at all makes sense. 5 April

4 Description and background Data such as driving time, resting time etc shall be enough secure to hold in court. Tachograph is a tool for enforcers to enforce the legislation. What is secured in today s Tachograph solution? Data is sent encrypted from the Motion sensor to the tachograph and signed from the tachograph to enforcers tool. The limit of Target Of Evaluation goes at the Motion sensor. Where should the limit be for the Target Of Evaluation for weight data? Is it really necessary to have security requirements on it? Are there any security requirements? 5 April

5 Security level options Proposed text, chapter Annex II, says: 1.1. The information transmitted from the OBW equipment to either the ECU-OBW or the GEN2 tachograph shall be secured. What does shall be secured mean? Which security level is intended? Why? Same security level as for tachograph data? Makes no sense as the usage is to judge whether a vehicle should be stopped or not at roadside checks... Any security level at all? Article 10d of EU 2015/719 says Where automatic systems are used only for identification purposes, they need not be certified. Something in-between? Not a good idea. If known data is sent in to a VU, encrypted and then sent out, it is a matter of small effort to break the security. 5 April

6 Option 1: end-to-end security Security domain Tacho Design option DSRC-VU REDCR App 14 ECU-O 5 April

7 Option 2: no encryption Tacho Design option DSRC-VU REDCR App 14 ECU-O 5 April

8 Option 3: some encryption Security domain Tacho Design option DSRC-VU REDCR App 14 ECU-O 5 April

9 Option 1: end-to-end security Pros True end-to-end security, weight data downloaded by enforcers is trustable Cons Political: will it be used by Member states? 165/2014, Article 9: years after newly registered vehicles are required to have a tachograph as provided for in this Article and in Articles 8 and 10, Member States shall equip their control authorities to an appropriate extent with remote early detection equipment Political: will it be used when there are other more effective and cheaper solutions available (WIM)? Political: will it be used by member states? 2015/719, Article 10d: 1. Those measures may be taken with the aid of automatic systems set up on the road infrastructure, or by means of onboard weighing equipment installed in vehicles in accordance with paragraph 4. 5 April

10 Option 1: end-to-end security, cont Pros legal fulfilment 2016/799, Appendix 14, DSC_59: To support the Directive 2015/719/EC on the maximal weights and dimensions for heavy goods vehicles, the transaction protocol to download O data across the 5.8 GHz DSRC interface link will be the same as that used for the RTM data Cons legal fulfilment There is nothing in 96/53 or 2015/719 that demands security of the O data. There is no requirement for end-toend security. 2015/719, Article 10d: Where automatic systems are used only for identification purposes, they need not be certified. 2016/799, Appendix 14, DSC_1: It is important to comprehend that this functionality is intended to serve only as a pre-filter in order to select vehicles for closer inspection, and it does not replace the formal inspection process as determined in the provisions of Regulation (EU) No 165/ April

11 Option 1: end-to-end security, cont Pros Cons Technically: extreme challenge to type approve each sensor and its installation. Technically: it must be certified that all sensors are connected and nothing more than exactly those. Sealing and pairing required. Technically: in order to work properly, the complete vehicle, including trailer(s), must be fully certified down to each weight sensor. Technically: Member states and O-ECU manufacturers must handle the cryptographic keys correctly. 5 April

12 Option 1: end-to-end security, cont Pros Cons Economically: the cost will be extremely high. Handling security and keys, type approval of each sensor, certified mounting of each sensor, education and equipment of workshops and enforcers and so on... 5 April

13 Option 2: no encryption Pros Legally fulfilling legislation 96/53 and 2015/719. Technically easier and quicker to get implementation up and running. Technically enables other VUs in vehicle to receive weight data in clear text, i.e. not encrypted. Economically the cheapest solution. Cons Maybe not fulfilling the part of 2016/799 (Annex 1C) that put requirements on weight data via DSRC module. Data downloaded to enforcer on the road side is not fully trustable and not valid in court. Other (certified) weight system on road side will be required. 5 April

14 Option 3: some encryption Pros Politically it could be a good solution to choose the middle alternative. Legally fulfilling exactly what is required today. Economically cheaper than Option 1: end-toend security. Cons Legally the data will not be fully trusted as there is no end-to-end security. Weight sensors and their setup could be manipulated or simply handled in-correctly by mistake. Technically a risk to jeopardize the tachograph security. Known data in + encrypted data out => attack possibilities. This is a big NO due to the risk. Economically more expensive than Option 2: no encryption. 5 April

15 Conclusion and summary Conclusion, already mentioned at the start of this presentation: Three options exists for security solution, only No added security makes sense. Legal, economical and technical arguments all jointly agree to this. The best way forward is to use and improve existing weight technologies and don t add any encryption. 5 April

16 End of presentation Thank you for your attention! 5 April