ETSI TS 133 185-2017 3rd Generation Partnership Project Technical Specification Group Services and System Aspects Security aspect for LTE support of Vehicle-to-Everything (V2X) ser.pdf

1、 ETSI TS 133 185 V14.0.0 (2017-07) LTE; 5G; Security aspect for LTE support of Vehicle-to-Everything (V2X) services (3GPP TS 33.185 version 14.0.0 Release 14) TECHNICAL SPECIFICATION ETSI ETSI TS 133 185 V14.0.0 (2017-07)13GPP TS 33.185 version 14.0.0 Release 14Reference DTS/TSGS-0333185ve00 Keyword

2、s 5G,LTE,SECURITY ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be d

3、ownloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any exi

4、sting or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be su

5、bject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org

6、/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without

7、the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. ETSI 2017. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are trademarks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are trademarks of ETSI reg

8、istered for the benefit of its Members and of the 3GPP Organizational Partners. oneM2M logo is protected for the benefit of its Members. GSM and the GSM logo are trademarks registered and owned by the GSM Association. ETSI ETSI TS 133 185 V14.0.0 (2017-07)23GPP TS 33.185 version 14.0.0 Release 14Int

9、ellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Ri

10、ghts (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches,

11、has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by

12、ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. The cross reference between GS

13、M, UMTS, 3GPP and ETSI identities can be found under http:/webapp.etsi.org/key/queryform.asp. Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of th

14、e ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. ETSI ETSI TS 133 185 V14.0.0 (2017-07)33GPP TS 33.185 version 14.0.0 Release 14Contents Intellectual Property Rights 2g3Foreword . 2g

15、3Modal verbs terminology 2g3Foreword . 4g31 Scope 5g32 References 5g33 Definitions and abbreviations . 6g33.1 Definitions 6g33.2 Abbreviations . 6g34 V2X security architecture . 6g35 V2X security requirements . 6g35.1 General . 6g35.2 Interfaces between network elements . 7g35.3 Interface between UE

16、 and V2X control function (V3) . 7g35.4 Interface between external provider and 3GPP network (MB2) 7g35.5 Security requirements of V2X application data 7g35.6 Privacy related requirements 7g35.7 Security requirement for V2X Entities Secure Environment . 8g36 V2X security solutions . 8g36.1 General .

17、 8g36.2 V2X communication between network elements . 8g36.2.1 General 8g36.2.2 Security procedures. 8g36.3 V2X communication between UE and V2X Control Function (V3) 8g36.3.1 General 8g36.3.2 Security procedures for configuration transfer to the UICC . 8g36.3.3 Security procedures for data transfer

18、to the UE 9g36.4 Interface between V2X application server and 3GPP network (MB2) . 9g36.5 Security of V2X application data . 9g36.5.1 General 9g36.5.2 Security procedures. 10g36.6 Privacy in V2X services . 10g36.6.1 General 10g36.6.2 Privacy procedures related to PC5 transmissions . 10g3Annex A (inf

19、ormative): Change history . 11g3History 12g3ETSI ETSI TS 133 185 V14.0.0 (2017-07)43GPP TS 33.185 version 14.0.0 Release 14Foreword This Technical Specification has been produced by the 3rd Generation Partnership Project (3GPP). The contents of the present document are subject to continuing work wit

20、hin the TSG and may change following formal TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an identifying change of release date and an increase in version number as follows: Version x.y.z where: x the first digit: 1 presented to TSG

21、for information; 2 presented to TSG for approval; 3 or greater indicates TSG approved document under change control. y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. z the third digit is incremented when editorial only changes ha

22、ve been incorporated in the document. ETSI ETSI TS 133 185 V14.0.0 (2017-07)53GPP TS 33.185 version 14.0.0 Release 141 Scope The present document specifies the security aspects of V2X features in LTE, including security architecture, security requirements on the network entities that are used to sup

23、port V2X services, as well as the procedures and solutions which are provided to meet those requirements. 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. - References are either specific (identified by date

24、 of publication, edition number, version number, etc.) or non-specific. - For a specific reference, subsequent revisions do not apply. - For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implic

25、itly refers to the latest version of that document in the same Release as the present document. 1 3GPP TR 21.905: “Vocabulary for 3GPP Specifications“. 2 3GPP TS 22.185: “Service requirements for V2X services“. 3 3GPP TS 23 285: “Architecture enhancements for V2X services (Release 14)“. 4 3GPP TS 33

26、.210: “3G security; Network Domain Security (NDS); IP network layer security“. 5 3GPP TS 33.310: “Network Domain Security (NDS); Authentication Framework (AF)“. 6 ETSI TS 102 225: “Smart Cards; Secured packet structure for UICC based applications“. 7 ETSI TS 102 226: “Smart cards; Remote APDU struct

27、ure for UICC based applications“. 8 3GPP TS 31.115: “Secured packet structure for (Universal) Subscriber Identity Module (U)SIM Toolkit applications“. 9 3GPP TS 31.116: “Remote APDU Structure for (U)SIM Toolkit applications “. 10 3GPP TS 33.303: “Proximity-based Services (ProSe); Security aspects“.

28、11 3GPP TS 29.368: “Tsp interface protocol between the MTC Interworking Function (MTC-IWF) and Service Capability Server (SCS)“. 12 3GPP TS 33.401: “3GPP System Architecture Evolution (SAE): Security Architecture“. 13 3GPP TS 33.223: “Generic Authentication Architecture (GAA); Generic Bootstrapping

29、Architecture (GBA) Push function“. 14 3GPP TS 23.468: “Group Communication System Enablers for LTE (GCSE_LTE); Stage 2“. 15 3GPP TS 33.246: “3G Security; Security of Multimedia Broadcast/Multicast Service (MBMS)“. 16 IEEE Std 1609.2-2016: “IEEE Standard for Wireless Access in Vehicular Environments

30、(WAVE)Security Services for Applications and Management Messages“. 17 ETSI TS 102 940: “Intelligent Transport Systems (ITS); Security; ITS communications security architecture and security management“ (V1.2.1; 2016-11). 18 3GPP TS 33.402: “3GPP System Architecture Evolution; Security aspects of non-

31、3GPP accesses“. ETSI ETSI TS 133 185 V14.0.0 (2017-07)63GPP TS 33.185 version 14.0.0 Release 143 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in 3GPP TR 21.905 1 and the following apply. A term defined in the present document

32、 takes precedence over the definition of the same term, if any, in 3GPP TR 21.905 1. 3.2 Abbreviations For the purposes of the present document, the abbreviations given in 3GPP TR 21.905 1 and the following apply. An abbreviation defined in the present document takes precedence over the definition o

33、f the same abbreviation, if any, in 3GPP TR 21.905 1. AS Application Server BSF Bootstrapping Server Function GBA Generic Bootstrapping Architecture GCS Group Communication System ITS Intelligent Transportation System LTE-V LTE V2X NAF Network Application Function ProSe Proximity-based Services V2I

34、Vehicle-to-InfrastructureV2N Vehicle-to-Network V2P Vehicle-to-Pedestrian V2V Vehicle-to-Vehicle V2X Vehicle-to-EverythingVCF V2X Control Function 4 V2X security architecture V2X service contains three types of vehicular communication services V2V (vehicle to vehicle), V2I (vehicle to infrastructure

35、), V2N (vehicle to network), and V2P (vehicle to pedestrian) for both safety and non-safety aspects. The overall architecture describing LTE enhancements for V2X services is given in TS 23.285 3. Both LTE-Uu based architecture (e.g. eMBMS) and PC5 based architecture are used for supporting V2X servi

36、ces, but they may be used by a UE independently for transmission and reception, e.g. a UE can use eMBMS for reception without using LTE-Uu for transmission. The security for interfaces given in the overall architecture (TS 23.285 3) is provided in clause 6, in detail these are the interfaces between

37、 network entities (clause 6.2), between UE and V2X Control Function (clause 6.3), and between V2X AS and 3GPP system (clause 6.4). Clause 6.5 discusses security of V2X application data. Clause 6.6 is providing details to privacy in V2X services. Note: The V2 interface is not specified in 3GPP TS 23.

38、285 3, thus out of scope also in the present document. 5 V2X security requirements 5.1 General The service requirements for V2X services are specified in 3GPP TS 22.185 2. This clause contains the security requirements for V2X. ETSI ETSI TS 133 185 V14.0.0 (2017-07)73GPP TS 33.185 version 14.0.0 Rel

39、ease 145.2 Interfaces between network elements The V2X network entities shall be able to authenticate the source of the received data communications. The transmission of data between V2X network entities shall be integrity protected. The transmission of data between V2X network entities shall be con

40、fidentiality protected. The transmission of data between V2X network entities shall be protected from replays. 5.3 Interface between UE and V2X control function (V3) The V2X enabled UE and its HPLMN V2X Control Function shall mutually authenticate each other. The transmission of configuration data b

41、etween the V2X Control Function and the UE shall be integrity protected. The transmission of configuration data between the V2X Control Function and the UE shall be confidentiality protected. The transmission of configuration data between the V2X Control Function and the UE shall be protected from r

42、eplays. The transmission of UE identity should be confidentiality protected on the V3 interface. 5.4 Interface between external provider and 3GPP network (MB2) V2X services use the MB2 interface for GCSE. The requirements to MB2 as listed in Annex N.1.2 of 3GPP TS 33.246 shall apply. 5.5 Security re

43、quirements of V2X application data The V2X system entities should be able to authenticate and verify that the sender of the received data communications was authorized to send the data. The transmission of data between different V2X entities in the V2X system should be integrity protected. The trans

44、mission of data between different V2X entities in the V2X system should be protected from replays. The transmission of data between two different V2X entities in the V2X system should be confidentiality protected if needed for the V2X application. NOTE: Transmission of data includes but is not limit

45、ed to multicast, broadcast, unicast, or geocast. 5.6 Privacy related requirements As specified in 3GPP TS 22.185 2 the following PC5 privacy related requirements apply: Subject to regional regulatory requirements and/or operator policy for a V2X application, the data sent in the PC5 transmission sho

46、uld not allow UE identity to be tracked or identified by any other UE or non-V2X entity beyond a certain short time-period required by the V2X application. Subject to regional regulatory requirements and/or operator policy for a V2V/V2I application, the data sent in the PC5 transmission should not a

47、llow a single party (operator or third party) to track a UE identity in that region. In addition, the following PC5 related requirements are given in the present specification: The identifiers in the V2X messages should minimize the risk of leaking the UE or user permanent identities. UE pseudonymit

48、y should be provided to conceal personal data from attackers. The application layer UE identity in the V2X messages should be protected from eavesdropping. ETSI ETSI TS 133 185 V14.0.0 (2017-07)83GPP TS 33.185 version 14.0.0 Release 145.7 Security requirement for V2X Entities Secure Environment For

49、V2X services relying on access networks within the scope of TS 33.401 12, the 3GPP authentication, key agreement, associated subscriber credentials and associated subscriber identities used to access the network should reside on USIM within the V2X enabled UE. For V2X services relying on access networks within the scope of TS 33.402 18, the 3GPP authentication, key agreement, associated subscriber credentials and associated subscriber identities used to access the network should reside on UICC within the V2