OST-R | ITS JPO Home | Resources

Resources

Security Credential Management System (SCMS)

About the Security Credential Management System (SCMS)

The U.S. Department of Transportation (USDOT) is committed to ensuring that connected vehicle technologies operate in a safe, secure, and privacy-protective manner. As connected vehicle applications exchange information among vehicles, roadway infrastructure, traffic management centers, and wireless mobile devices, a security system is needed to ensure that users can trust in the validity of information received from other system users—indistinct users whom they have never met and do not know personally. For this reason, the Department has partnered with the automotive industry and industry security experts through the Crash Avoidance Metrics Partnership (CAMP) to design and develop a state-of-the-art security system that enables users to have confidence in one another and the system as a whole.

The Security Credential Management System (SCMS) is a proof-of-concept (POC) message security solution for vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communication. It uses a Public Key Infrastructure (PKI)-based approach that employs highly innovative methods of encryption and certificate management to facilitate trusted communication. Authorized system participants use digital certificates issued by the SCMS POC to authenticate and validate the safety and mobility messages that form the foundation for connected vehicle technologies. To protect the privacy of vehicle owners, these certificates contain no personal or equipment-identifying information, but serve as system credentials so that other users in the system can trust the source of each message. The SCMS POC also plays a key function in protecting the content of each message by identifying and removing misbehaving devices, while maintaining privacy.

The Benefits of the SCMS

The SCMS provides several benefits, including:

  • Ensures integrity—so users can trust that the message was not modified between sender and receiver
  • Ensures authenticity—so users can trust that the message originates from a trustworthy and legitimate source
  • Ensures privacy—so users can trust that the message appropriately protects their privacy
  • Helps achieve interoperability—so different vehicle makes and models will be able to talk to each other and exchange trusted data without pre-existing agreements or altering vehicle designs

Research Activities

Several projects are underway in support of the SCMS and funded by the USDOT:

  • Operations of the SCMS
  • Technical Management of the SCMS
  • Governmental Management of the SCMS
  • Misbehavior Detection Development and Implementation
  • National SCMS Development

Looking Ahead: What's Next for SCMS?

Connected Vehicle Pilot, Smart Cities, and other research deployments will interact with the SCMS POC to ensure the security and privacy of their messages. The SCMS Quality Assurance environment is available for devices to interact and test their local certificate management software. In September 2017, the SCMS Operational Environment (production-ready) became available to coincide with the full-scale deployment of devices at the Connected Vehicle Pilot sites.

The USDOT has initiated a National SCMS Development project that will work with a diverse population of V2X stakeholders to explore potential pathways (or strategies) for the establishment and governance of a National SCMS. The policies, procedures, and lessons learned from the SCMS POC will be leveraged as key inputs to this project. The goal of the National SCMS Development project is to develop a National SCMS Deployment Strategy to help USDOT and industry establish a viable National SCMS ecosystem in support of V2X communications.

FAQs

Why Do Connected Vehicles Need the SCMS?

Connected vehicle technology has the potential to transform the way Americans travel by using dedicated short-range communication (DSRC), GPS, and other wireless technologies to share safety, mobility, and environmental information. The SCMS is a critical component of this connected vehicle environment. In contrast to other types of safety technologies currently found in the vehicle fleet, connected vehicle applications are cooperative—meaning, vehicles must exchange and analyze data in real time to realize the benefits of the system. This cooperative exchange of messages generates data that applications use to issue alerts and warnings to drivers about the driving situation around them. It also enables applications to determine mobility and environmental conditions. However, a cooperative system can only work when drivers are able to trust the alerts and warnings issued by their connected vehicle devices, which are based, at least in part, on information received from other connected vehicle devices.

The SCMS POC provides the mechanism for devices to exchange information in a trustworthy and privacy-protective manner using digital certificates.

How Does the SCMS Work?

The SCMS provides the security infrastructure to issue and manage the security certificates that form the basis of trust for V2V and V2I communication. Connected vehicle devices enroll into the SCMS, obtain security certificates from certificate authorities, and attach those certificates to their messages as part of a digital signature. The certificates prove the device is a trusted actor in the system, while also maintaining privacy. Misbehavior detection and reporting allow the system to identify bad actors and revoke message privileges, when necessary.

Who Is Eligible to Enroll in the SCMS POC?

Research deployment sites that derive funding from the USDOT are eligible to request enrollment into the SCMS POC. Since these deployment sites are research-focused and support USDOT connected vehicle research activities, they provide a suitable test environment for the SCMS POC.

Participating deployments understand that the USDOT-funded SCMS is a proof-of-concept system designed to educate policymakers and industry experts on the challenges associated with ensuring safe, secure, and privacy-protective V2V and V2I communications. Lessons learned from the implementation of the system will be used to facilitate the establishment of an eventual national system by private industry.

The SCMS POC will only support a select number of connected vehicle applications (mapped by PSID). Deployers are encouraged to review the list of supported applications by following this link: https://wiki.campllc.org/display/SCP/SCMS+PoC+Supp orted+V2X+Applications.

The expected lifetime of this system is through December 2020.

How Do I Enroll into the System?

Devices enroll into the system by submitting an enrollment request to the USDOT. Criteria are being developed for authorizing devices to participate in the system. Once authorized, devices are considered trusted actors in the system. A certification process will ensure that devices meet program requirements and perform as intended.

RELATED FACT SHEETS

RELATED RESEARCH