Goals
The goal is to provide a freshly bootstrapped OBE with the very first batch of pseudonym certificates that it can use in applications like Basic Safety Message (BSM).
Background and Strategic Fit
The initial provisioning of pseudonym certificates is the process by which an OBE receives its very first batch of pseudonym certificates. This use case also acts as a trigger for subsequent provisioning of pseudonym certificates. The OBE does not need to make any more requests, the RA automatically does everything necessary (such as doing the butterfly key expansion, getting pre-linkage values from the LA, making individual certificate requests to the PCA, etc.) for the next batches of certificates.
Due to the time constraints imposed by the OEMs, shuffling requirements for the initial provisioning may be relaxed.
This use case involves the following SCMS components:
- Linkage Authorities (LAs)
- Location Obscurer Proxy (LOP)
- Pseudonym Certificate Authority (PCA)
- Registration Authority (RA)
At the start of this use case, the OBE has no pseudonym certificates. At the end of this use case, the OBE has three years worth of pseudonym certificates, and the RA has everything it needs from the OBE for generating and providing subsequent pseudonym certificate batches for the OBE.
Assumptions
In order to facilitate the certificate request process, an OBE must meet the following prerequisites:
- OBE has a valid enrollment certificate
- OBE has Root CA, RA and PCA certificates installed
- OBE knows the FQDN of the RA
Design
The following flow chart documents the general flow of steps an OBE needs to carry out in the given order to obtain Pseudonym certificates. It is not a 100% accurate description of the process. Please refer to the use case's steps and their requirements in the following subsections for a complete description of the process.
At a high level, three steps are relevant towards an OBE:
- Request for Pseudonym Certificates
- Initial Download of Pseudonym Certificates
- Top-off Pseudonym Certificates
Having determined which RA to submit the request to, the OBE creates a request, signs it with the enrollment certificate, encrypts the signed request for the RA and sends it to the LOP/RA. The LOP strips any IP information that could be used to determine the OBE's location and forwards it to the RA. The RA checks to make sure that the certificate request is correct and authorized and sends back a download location (requestHash) and time (certDLTime). The RA performs butterfly key expansion on the request to create a batch of public keys to be certified. The RA then merges the certificate request information with linkage information from the LAs to create a series of individual certificate requests. RA then sends those requests to the PCA, mixing the certificate requests with certificate requests generated for other OBEs to provide privacy against insiders at the PCA. The PCA signs the pseudonym certificates, encrypts them for the OBE, signs the encrypted version of the certificate, and returns the encrypted and signed pseudonym certificates to the RA. The RA does not remove any of the named signatures or encryptions, adds them to a zip file and stores them for download by the OBE. The OBE starts downloading the zip files at certDLTime.
Attachments:
PseudonymDownloadProcess (application/drawio)
PseudonymDownloadProcess.png (image/png)
PseudonymDownloadProcess.png (image/png)
PseudonymDownloadProcess (application/drawio)
PseudonymDownloadProcess.png (image/png)
PseudonymDownloadProcess (application/drawio)