System and method for using global voters using regional certificate trust lists

Abstract

A system, method, and components for managing trust across multiple root certificate authorities (CAs) using both a constituency and a regional certificate trust list (CTL). Accordingly, systems and methods are provided for managing trust across multiple root CAs and for doing so in a more efficient manner than is conventionally known or available. More specifically, systems and methods are provided for enabling V2I and / or V2X PKI technology implementations.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Application No. 62 / 776,309, filed on December 6, 2018, and is incorporated herein by reference.

[0003] The present disclosure relates to systems, components, and methods for managing trust across multiple root Certificate Authorities (CAs). Background Art

[0004] Vehicle-to-vehicle communication (also known as Car2Car, C2C or Vehicle2Vehicle, V2V) and vehicle-to-infrastructure communication (also known as V2I, Car2Infrastructure, C2I or Vehicle2Roadside, V2R) are the focus of automotive research and development in the 21st century. In general, these communications are included in what is more generally called Vehicle-to-Everything (V2X) communications.

[0005] Communication between transport vehicles or between transport vehicles and / or traffic infrastructure enables a number of new options, such as coordination between transport vehicles or communication between transport vehicles and traffic infrastructure, to provide congestion warnings or to promote cooperation between transport vehicles, such as merging.

[0006] The US Department of Transportation (USDOT) issued a proposed rule on January 12, 2017, requiring the inclusion of V2V technology in light vehicles in the United States to enable communication between nearby transport vehicles in the form of continuous broadcast of Basic Safety Messages (BSM) to support V2V safety applications. Related to this is V2I technology, which is designed to enable transport vehicles to communicate with other entities in their surroundings, such as street lights, buildings, other vehicles, and even cyclists or pedestrians.

[0007] The diversity of stakeholders in V2X communications (infrastructure operators, vehicle OEMs, specialized vehicles such as emergency vehicles or police cars, etc.) requires that the communicating entities be authenticated as valid / legitimate identities.

[0008] Transport vehicles designed for V2V or V2I will have a transceiver that includes a transmitting unit and a receiving unit under the control of at least one processor to be able to communicate with other transport vehicles, for example via a direct radio link or a mobile radio network. The communication between transport vehicles via V2V or V2I can be carried out in an encrypted form and the security of the communication can be ensured by certificates.

[0009] Accordingly, this heterogeneous environment requires an effective and efficient way to manage trust between these identities. This is particularly challenging when dealing with multiple regional authorities that decide whether an identity is valid / legal, for example in cross-border or international situations, especially when the jurisdictions associated with the regional authorities share a common border.

[0010] BSMs can include a variety of information, including the sender's time, location, speed, heading, final path history, and other relevant information, and are digitally signed. Therefore, the correctness and reliability of BSMs directly affect the effectiveness of security applications that use the data in these BSMs. For example, the sending vehicle digitally signs each BSM to prevent attackers from inserting false messages. The digital signature enables the receiving vehicle to verify the signature before taking action on the information contained in the BSM. Accordingly, in order to trust the message, the receiving vehicle verifies the digital signature, evaluates each message, verifies the certificate of the sending device, and then decides whether a warning needs to be output to the driver.

[0011] Digital signatures are traditionally known and rely on cryptography, where a root certificate is a public key certificate that identifies a root certificate authority (CA). In cryptography, a certificate authority or certification authority (CA) is an entity that issues digital certificates. A digital certificate certifies ownership of a private key by the named subject of the certificate. This allows others (relying parties) to rely on a signature or a statement made about a private key corresponding to a certified public key. Thus, the CA acts as a trusted third party, trusted by both the subject (owner) of the certificate and the party relying on the certificate.

[0012] The root certificate is self-signed and forms the basis of the Public Key Infrastructure (PKI) that defines the format of public key certificates. Accordingly, Internet Engineering Task Force (IETF) X.509 certificates are traditionally used in many Internet protocols, including Transport Layer Security (TLS) / Secure Sockets Layer (SSL), which is the basis of Hypertext Transfer Protocol Secure (HTTPS), a secure protocol for browsing web pages. Although the traditionally known V2X PKI is not based on the IETF X.509 standard of the traditional IETF X.509 Web PKI, all PKI technologies for secure electronic signature schemes rely on a collection of root certificates. Therefore, PKI technology promotes and manages digital certificates used to establish and manage trust between participants. Summary of the invention

[0013] According to the present disclosure, systems and methods are provided for managing trust across multiple root CAs and doing so in a more efficient manner than is conventionally known or available.

[0014] According to the present disclosure, a system and method for implementing V2I and / or V2X PKI technology implementation is provided, and the V2I and / or V2X PKI technology implementation provides further optimization for the Institute of Electrical and Electronics Engineers (IEEE) 1609.2 standard instead of the IETF X.509 standard.

[0015] According to the disclosed embodiments, the systems and methods are configured to use a different set of protocols than the traditional IETF, TLS, SSL and / or HTTPS protocols.

[0016] As a result, according to the disclosed embodiments, a technical solution is provided that uses both voters and regional Certificate Trust Lists (CTLs) to manage trust across multiple root CAs in a novel and creative way.

[0017] Additional features of the disclosure will become apparent to those skilled in the art upon consideration of the illustrative embodiments, which illustrate the best mode presently known for carrying out the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The detailed description makes particular reference to the accompanying drawings, in which:

[0019] Figure 1 is an illustrative diagram of a system provided in accordance with at least one disclosed embodiment. DETAILED DESCRIPTION

[0020] The accompanying drawings and descriptions provided herein may have been simplified to illustrate various aspects related to a clear understanding of the equipment, system and method described herein, while for the sake of clarity, other aspects that can be found in general equipment, system and method have been eliminated. It will be appreciated by those of ordinary skill in the art that other elements and / or operations may be desirable and / or necessary for realizing the equipment, system and method described herein. Because these elements and operations are well known in the art, and because they do not promote a better understanding of the present disclosure, a discussion of these elements and operations may not be provided here. However, the present disclosure is considered to inherently include all these elements, deformations and described modifications of various aspects known to those of ordinary skill in the art.

[0021] As explained above, PKI technology supports electronic signature schemes that rely on a collection of root certificates. Accordingly, PKI technology facilitates and manages digital certificates and is essential for establishing trust between participants and for the correct operation of the V2X system (which enables both V2V and V2I functions).

[0022] It is known that a certificate authority (CA) can issue multiple certificates in a tree structure, where the root certificate is the top-level certificate of the tree. In this configuration, the private key of the root certificate is used to "sign" other certificates. Therefore, in this implementation, all certificates signed by the root certificate private key inherit the trustworthiness of the root certificate. In this way, signing by the root certificate is equivalent to "notarizing" the identity of an individual in the physical world, because the notary is a trusted entity.

[0023] It is also known that the certificate signed by the private key of the root certificate, which in turn signs other certificates, is called an intermediate certificate or a subordinate CA certificate. It is known that the certificates further "below" in the tree also rely on the credibility of these intermediate certificates.

[0024] The disclosed embodiments provide a mechanism and method for managing trust across multiple root CAs in a more efficient manner than is conventionally known or available.

[0025] According to the disclosed embodiments, this technical solution uses voters to enable the same voters and root CA certificates to be used across multiple jurisdictions and / or multiple markets. See https: / / ieeexplore.ieee.org / stamp / stamp.jsp?tp=&arnumber=8309336 (the entire contents of which are incorporated herein by reference) and https: / / priorart.ip.com / IPCOM / 000245336 (the entire contents of which are incorporated herein by reference). Voters collectively have the power to change and manage trust relationships.

[0026] According to at least some disclosed embodiments, these voters may be used in combination with certificate trust lists (which are described in ETSI Technical Standard 102 941: https: / / www.etsi.org / deliver / etsi_ts / 102900_102999 / 102941 / 01.02.01_60 / ts_102941v010201p.pdf; the entire contents of which are incorporated herein by reference). See also https: / / ec.europa.eu / transport / sites / transport / files / c-its_certificate_policy-v1.1.pdf (the entire contents of which are incorporated herein by reference), which gives an example of an EU PKI governance policy and provides additional information on the implementation of such a system.

[0027] In order to most effectively understand the technical problem solved by the technical solution of the present invention, it should be understood that, traditionally, the technical problem of trust management across multiple root CAs has been solved regionally using slightly different methods. For example, the EU department proposed using a method of using a single central trust list manager as described in https: / / ec.europa.eu / transport / sites / transport / files / c-its_certificate_policy-v1.1.pdf (the entire content of which is included herein by reference).

[0028] Instead, the U.S. Department has proposed using a voter as described in https: / / ieeexplore.ieee.org / stamp / stamp.jsp?tp=&arnumber=8309336 (the entire contents of which are incorporated herein by reference). While it has been assumed that Canada and possibly Mexico will adopt this approach, it is unclear how V2V, V2I, and V2X can and will be implemented for cross-border traffic.

[0029] Voters are independent of PKI because they do not sign certificates but instead sign dedicated trust management messages. Therefore, voters can operate independently of any zone.

[0030] Accordingly, a regional authority (e.g., a security credential management system (“SCMS”) administrator or a C-ITS credential management system (“CCMS”) Certificate Policy Authority (CPA)) can determine which subset of the global electorate is legitimate within its regional jurisdiction by identifying the electorate's certificates.

[0031] These certificates can then be securely installed in all equipment, such as transport vehicle units and / or infrastructure components operating under the jurisdiction of the regional authority.

[0032] Thus, for example, in one possible implementation, the disclosed embodiments may enable a regional authority to modify legitimate certificates within its jurisdiction using voter-based root management utilizing ballots with endorsements. In such an implementation, whenever a regional authority wants to add a certificate or remove a certificate from legitimate certificates within its jurisdiction, the regional authority may require a majority of identified voters to sign a ballot to endorse or revoke the certificate. Based on the ballot, the regional authority may add the ballot to its corresponding trust list. It should be understood that there are alternative methods of such an implementation that do not use ballots, but instead use the CTL method in an alternative manner.

[0033] Regardless of how modification of the CTL is achieved, in accordance with the disclosed embodiments, all devices within the jurisdiction of the regional authority may download the trust list and, based on the initial trust in the identified constituents, add or delete corresponding certificates from their trust store.

[0034] According to at least some disclosed embodiments, the regions or jurisdictions for which an added or revoked certificate is valid / legal can be indicated in the certificate itself. For example, as defined in the IEEE 1609.2 standard (the entire contents of which are incorporated herein by reference), a certificate can simultaneously identify jurisdictions such as the United States, Mexico, and Canada as valid regions.

[0035] Furthermore, it should be understood that according to the disclosed embodiments, the voter and root CA certificates may even be reused globally. More specifically, the regional restrictions for the voter or root CA certificates may include multiple countries / regions in different continents, but the validity / legitimacy of the root CA will still be determined by the corresponding regional authority represented by the corresponding CTL of the regional authority.

[0036] As a result, the technical solution using voters in accordance with the disclosed embodiments provides a way to manage the definition of trust anchors in a standardized manner that works even in the presence of trust compromises at the highest level.

[0037] Furthermore, the disclosed embodiments may also provide additional utility because the resulting system for root certificate management may be provided as part of a disaster recovery plan that may be tested periodically (whenever there is a periodic rollover). Furthermore, additional utility is provided because the root certificate management system may work automatically at the device (e.g., apparatus / component) level without requiring physical access to the device or having the device in a secure environment. Such automation may also help avoid errors and reduce the recovery time of the system to resolve such errors. Figure 1 An example of the proposed scheme is depicted in .

[0038] Figure 1 A system of at least one embodiment of the present disclosure is shown. In this embodiment, global voters A, B, C, and D can be selected as legal voters for multiple jurisdictions. For example, voters A, B, and C can be assigned to one or more jurisdictions 110 (which can be, for example, but not limited to CCMS). Voters B, C, D can additionally be assigned to one or more jurisdictions 120 (which can be, for example, but not limited to SCMS). Therefore, some voters, such as voters B and C, are used across jurisdictions 110 and 120. As a result, in this illustrative example, both the CCMS CPA 115 and the SCMS manager 125 include voters B and C on their Certificate Points Of Contact (CPOC) CTLs 117, 127.

[0039] In this way, the disclosed embodiments may use voter certificates in more than one jurisdiction and optionally in many jurisdictions. By reusing voter certificates globally, the cost of establishing and operating voters may be spread over multiple jurisdictions to better improve the overall business case for operating a V2X PKI.

[0040] Accordingly, the disclosed embodiments can use root CA certificates globally, i.e., in more than one jurisdiction, and optionally in many jurisdictions. By reusing root CA certificates globally, the number of root CA certificates required by international organizations with business in different operating regions can be reduced, and the business case for establishing and operating root CAs can be made better.

[0041] Accordingly, the disclosed embodiments enable IEEE 1609.2 Peer-to-Peer Certificate Distribution (P2PCD) to be used at the top level of the trust chain at an international level on a global scale. As a result, the disclosed embodiments enable this benefit to be replicated from the U.S. sector to the global level.

[0042] It should be understood that the disclosed embodiments can be implemented in conjunction with equipment, components, and devices used in one or more components of a transportation vehicle, including, but not limited to, an automated driving system and a driver assistance system included in a motor vehicle. It should be easily understood that the practicality of the functions provided by the disclosed embodiments in the context of these technologies. However, the scope of the innovative concepts disclosed herein is not limited to these technical backgrounds. Therefore, it should be understood that the disclosed embodiments provide practicality in all aspects of equipment, components, and device management.

[0043] The terms used herein are only used for the description of specific disclosed embodiments and are not intended to limit the disclosed embodiments. As used herein, the singular forms "a", "an", and "the" also imply the plural forms unless the context clearly indicates otherwise. In addition, it should be clear that the expressions used herein, such as "comprise", "contain", "display", "include", "have" and / or "show" indicate the presence of the stated features, integers, operations, processes, elements and / or parts, but do not exclude the presence or addition of one or more features, integers, operations, processes, elements, parts and / or their components.

[0044] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as given by ordinary technicians in the field in which the disclosed embodiments are located. In addition, it should be clear that expressions defined in commonly used dictionaries, for example, should be interpreted as having a meaning consistent with their meaning in the relevant technical context, and should not be interpreted in an idealized or overly formal sense unless this is clearly defined herein.

[0045] It should be understood that, although not discussed in detail, the disclosed embodiments may be implemented in a heterogeneous environment including both V2I infrastructure and multiple transport vehicles that can be implemented for V2V communications, where multiple regional authorities determine whether an identity is valid / legal, such as in cross-border or international situations. Therefore, it should be understood that such transport vehicles may be configured to enable V2V and V2I communications by including means for monitoring and / or communicating with transport vehicle components that enable the generation, transmission and / or reception of BSMs originating from other V2V-enabled vehicles and V2I infrastructure components through V2V and / or V2I interfaces. Accordingly, it should be understood, for example, that such onboard means for providing such an interface (e.g., various sensors and monitoring information coupled to a transmitting unit and a receiving unit of a transceiver under the control of at least one processor) may be configured to determine or sense that a flashing light of a transport vehicle has been activated, and enable the transmission of one or more BSMs indicating such activation to other V2V-enabled transport vehicles and / or V2I infrastructure components. Thus, one or more BSMs may be in encrypted form and communications may be protected by a root certificate to increase security and the ability to authenticate such BSMs.

[0046] Accordingly, it should be understood that the device provided on the transport vehicle for providing such functionality may include any controller or processor or programmable hardware component. Likewise, the V2I infrastructure components may be implemented similarly. Thus, for example, the devices and components may be implemented as software programmed for the corresponding hardware components. In this regard, the V2V device and the V2I component may be implemented as programmable hardware, such as any processor, such as a digital signal processor (DSP), with correspondingly adapted software, and may start operating based on the novel and inventive functionality disclosed herein. However, the embodiments disclosed in this case are not limited to a specific type of processor. Thus, any processor or even several processors may be configured to implement the devices and components.

[0047] In particular, the transport vehicle device may include a vehicle-to-vehicle interface corresponding to a direct vehicle-to-vehicle radio interface and may be designed for direct data communication with one or more further transport vehicles. Accordingly, the vehicle device enables the exchange of data messages with nearby transport vehicles via the vehicle-to-vehicle interface. Data messages (e.g. BSM) may be transmitted, for example, periodically, that is, data, for example about the status of the transport vehicle, possibly its speed, position, etc., may be transmitted at a defined repetition frequency.

[0048] Alternatively or additionally, data messages can be transmitted in an event-based manner, that is, based on an event, such as the detection of the end of a traffic jam or the detection of a slippery road. Event-based data messages can also be repeated, for example, with a defined repetition duration and repetition frequency, so as to reach more recipients or increase the possibility of receiving the data message. In addition, cooperative awareness messages (Cooperative Awareness Message, CAM: a periodic data message sent by a transport vehicle to make other transport vehicles aware of its existence), decentralized environmental notification messages (Decentralized Environmental Notification Message, DENM: it is an example of an event-based data message, for example, including current information about the transport vehicle, such as position and motion vector, but also including, for example, sensor data such as acceleration, speed, or information such as calculation of information about the end of a traffic jam.

[0049] For the purpose of this disclosure, the expression "autonomous and / or assisted functions" refers to functions that enable vehicle control to be partially, completely or fully automated, and the scope of vehicle control includes and covers the five currently known levels of autonomous driving. Therefore, it should be understood that autonomous and / or assisted functions refer to operations performed by the vehicle in an automated manner through an on-board device or outputs alerts, prompts, recommendations or directions to the user, wherein the on-board device generates these outputs in an automated manner. In addition, autonomous and / or assisted functions may include driver assistance functions (first level), wherein the on-board device assists but does not control steering, braking and / or acceleration, but the driver ultimately controls acceleration, braking and monitoring of the vehicle's surroundings.

[0050] It will therefore be appreciated that such autonomous and / or assisted functionality may also include a lane departure warning system which provides a mechanism for alerting the driver when a transport vehicle begins to depart from its lane on highways and arterial roads (unless the turn signal in that direction is on). Such a system may include a system whereby if the vehicle leaves its lane the system alerts the driver (via visual, audible and / or vibration warnings) (lane departure warning) and if no action is taken the driver is alerted and the system automatically takes action to ensure the vehicle stays in its lane (lane keeping system).

[0051] Likewise, autonomous and / or assisted functions may include semi-automatic driving (second level), in which the transport vehicle assists with steering or acceleration functions and correspondingly monitors the vehicle surroundings to enable the driver to be relieved of some of the tasks of driving the transport vehicle. As understood in the automotive industry, semi-automatic driving still requires the driver to be ready to assume all tasks of transport vehicle operation and also to continuously monitor the vehicle surroundings at all times.

[0052] Autonomous and / or assisted functions may include conditional automated driving (Level 3), in which the transport vehicle device is responsible for monitoring the vehicle's surroundings and controlling the vehicle's steering, braking and acceleration without the need for driver intervention. It should be understood that at this level and above, the on-board device used to perform autonomous and / or assisted functions will interact with or include navigation functions so that the component has data for determining the vehicle's destination. At Level 3 and above, the driver is theoretically allowed to disengage from monitoring the vehicle's surroundings, but the driver may be prompted to take control of the transport vehicle's operation in specific circumstances that may hinder safe operation in conditional automated driving mode.

[0053] Thus, it should be understood that autonomous and / or assisted functionality may include systems that take over steering and keep the transport vehicle centered in its lane.

[0054] Similarly, autonomous and / or assisted functions may include highly automated driving (Level 4) and full driving (Level 5), wherein onboard devices enable automatic steering, braking, and acceleration to be performed in an automated manner in response to monitoring of the vehicle's surroundings without the need for driver intervention.

[0055] It should be understood, therefore, that autonomous and / or assisted functions may require monitoring the vehicle's surroundings, including the vehicle's road, and identifying objects in the surroundings to enable safe operation of the vehicle in response to traffic events and navigation directions, wherein safe operation requires determining when to change lanes, when to change direction, when to change roads (exit / enter roads), when and in what order to merge into or cross road intersections, and when to use turn signals and other navigation indicators to ensure that other vehicles / vehicle drivers are aware of upcoming vehicle operations.

[0056] Furthermore, it should be understood that highly automated driving and fully automated driving may include analysis and consideration of data provided from non-vehicle sources in order to determine whether such level of automated driving is safe. For example, such level of autonomous and / or assistance functions may involve determining the likelihood of pedestrians around a transportation vehicle, which may involve referencing data indicating whether the current road is a highway or a boulevard. Furthermore, such level of autonomous and / or assistance functions may involve accessing data indicating whether there is traffic congestion on the current road.

[0057] Given this understanding of possible implementations of onboard sensors for autonomous and / or auxiliary functions, currently disclosed systems, components, and methods may be provided for securely transmitting and authenticating data collected from onboard sensors for assisting autonomous and / or auxiliary functions, particularly autonomous control and / or assisted control that requires or enables coordinated or cooperative operation of multiple transport vehicles. In such cases, the correctness and authenticity of the transmitted data is critical to the safety of transport vehicles participating in cooperative operations (e.g., lane merging, passing, vehicle platooning, etc.).

[0058] Therefore, it should be understood that according to at least some embodiments, before the transport vehicle safety application accesses the data of the BSM, one or more transport vehicle safety applications running on a transport vehicle among the multiple transport vehicles that received the BSM through V2V communication can analyze the digital signature of the BSM. Similarly, before the transport vehicle safety application accesses the data of the BSM, one or more transport vehicle safety applications running on a transport vehicle among the multiple transport vehicles that received the BSM through V2V communication can analyze the digital signature of the BSM.

[0059] Further disclosed embodiments may provide a computer program for implementing the functions disclosed herein when the computer program is run on a computer, on a processor, or on a programmable hardware component. Further disclosed embodiments may also provide a digital storage medium that is machine-readable or computer-readable and presents electronically readable control signals that can interact with programmable hardware components in a manner that provides the disclosed functions.

[0060] The disclosed embodiments may be implemented in hardware or software, depending on the implementation requirements. The implementation may be performed using a digital storage medium, such as a floppy disk, DVD, Blu-ray disc, CD, ROM, PROM, EPROM, EEPROM or flash memory, hard disk, or other magnetic or optical storage, on which electronically readable control signals are stored, which interact or can interact with programmable hardware components in a manner that executes the corresponding method.

[0061] Programmable hardware components can be composed of a processor, a computer processor (CPU: central processing unit), a graphics processor (GPU: Graphics Processing Unit), a computer, a computer system, an application-specific integrated circuit (ASIC), an integrated circuit (IC), a one-chip system (SOC = System On Chip), a programmable logic element, or a field-programmable gate array (FPGA) with a microprocessor.

[0062] Thus, the digital storage medium may be machine-readable or computer-readable. Accordingly, some disclosed embodiments include a data carrier that exhibits electronically readable control signals that can interact with a programmable computer system or a programmable hardware component in a manner that performs one of the methods described herein. Thus, the disclosed embodiments are a data carrier (or a digital storage medium or a computer-readable medium) on which is recorded a program for implementing one of the methods described herein.

[0063] In general, the disclosed embodiments can be implemented as a program, firmware, computer program or computer program product with program code, or as data, program code, or data that can effectively implement one of the methods when the program is run on a processor or on a computer-programmable hardware component. The program code or data can also be stored on a machine-readable carrier or data carrier, for example. The program code or data can exist in particular as source code, machine code or byte code and also as other intermediate codes.

[0064] The program according to at least one disclosed embodiment can, for example, perform one of the methods during the implementation of one of the methods by the program reading a memory location or writing a data item or several data items to a memory location, as a result of which, where appropriate, a switching operation or other operation is caused in a transistor structure, in an amplifier structure or in other electrical, optical or magnetic components or in components operating according to different functional principles. Accordingly, by reading the memory locations, data, values, sensor values ​​or other information can be acquired, determined or measured. Thus, the program can acquire, measure or determine quantities, values, measured variables and other information by reading one or more memory locations, and can also cause, lead to or perform actions by writing one or more memory locations, and also drive other devices, machines and components.

[0065] The embodiments described above represent only illustrations of the principles of the present disclosure. It should be understood that modifications and variations of the arrangements and details described herein will be clear to other persons skilled in the art. Therefore, it is intended that the present disclosure be limited only by the scope of protection of the appended claims, and not by the specific details presented herein based on the specification and the description of the disclosed embodiments. The features disclosed in the preceding description, the appended claims, and the accompanying drawings may be important and may be implemented individually and in any combination for implementing the embodiments in their different configurations.

Claims

1. A system for managing trust across multiple root certificate authorities for use in vehicle-to-vehicle (V2V) communications between at least two of a plurality of transportation vehicles in the form of a continuous broadcast of a basic safety message (BSM), the system comprising: a transport vehicle device located on a transport vehicle of the plurality of transport vehicles, the transport vehicle device comprising a transceiver and at least one processor controlling the transceiver, wherein the at least one processor is configured to control the transceiver so as to provide V2V communication between the transport vehicle device of the transport vehicle and transport vehicle devices of other transport vehicles of the plurality of transport vehicles via at least one communication link, wherein the communication link is provided via a direct radio link or via communication via a mobile radio network, wherein transmission of the BSM over the communication link is protected by a root certificate in such a way that each BSM is digitally signed using a root certificate associated with the transport vehicle sending the BSM; and at least one regional root certificate authority of a plurality of regional root certificate authorities, the regional root certificate authority determining whether an identity associating a root certificate with a corresponding transport vehicle of the plurality of transport vehicles is legitimate for a jurisdiction of the at least one regional certificate authority, wherein the jurisdiction includes at least one country associated with the at least one regional root certificate authority, wherein at least two of the plurality of regional authorities use a certificate trust list that includes at least one common root certificate that is identified as a legitimate root certificate in each of at least two of the plurality of respective jurisdictions, wherein each regional authority is configured to modify the certificate trust list listing legitimate certificates within its jurisdiction using voter-based root management, wherein, when the regional restriction on the root certificate includes multiple countries, the legitimacy of the root certificate is determined by the corresponding regional root certificate authority represented by the corresponding certificate trust list of the regional root certificate authority, and wherein the voter-based root management uses the identified voters to manage the trust anchor of the corresponding certificate trust list, wherein a root certificate is used across multiple countries, the root certificate identifying the jurisdictions for which the root certificate is valid under IEEE 1609.2 peer certificate distribution so that the voter-based root management works even if there is a trust compromise at the highest level of the chain of trust, and The identified voters include at least one common voter that is recognized as legitimate within the respective jurisdictions of at least two regional root certificate authorities.

2. The system according to claim 1, wherein: Voter-based root management is performed using endorsed ballots, where a regional authority seeking to add or remove a root certificate from its certificate trust list asks a majority of voters identified by the regional authority to sign a ballot to endorse or revoke the root certificate.

3. The system according to claim 1, wherein: Multiple regional authorities are associated with respective jurisdictions that share common boundaries.

4. The system according to claim 1, wherein: The root certificate issuing authorities each issue a digital certificate including a root certificate, wherein the digital certificate certifies ownership of a public key by a named subject of the digital certificate.

5. The system according to claim 1, wherein: The BSMs each include data specific to the transport vehicle, including the time, location, speed, and heading of the transport vehicle sending the BSM.

6. The system according to claim 1, wherein: The digital signature of the BSM serves as authentication of the correctness and authenticity of the data contained in the BSM.

7. The system according to claim 1, wherein: Before one or more transport vehicle safety applications running on a transport vehicle among the plurality of transport vehicles receiving the BSM through V2V communication access data of the BSM, the digital signature of the BSM is analyzed by the transport vehicle safety application.

8. The system according to claim 7, wherein: The one or more transportation vehicle safety applications are autonomous or assisted driving applications.

9. A method for managing trust across multiple root certificate authorities for use in vehicle-to-vehicle (V2V) communications between at least two of a plurality of transportation vehicles in the form of a continuous broadcast of a basic safety message (BSM), the method comprising: controlling transmission of V2V communications from a transport vehicle device located on a transport vehicle of the plurality of transport vehicles, the transport vehicle device comprising a transceiver and at least one processor controlling the transceiver, wherein the at least one processor controls the transceiver to provide V2V communications between the transport vehicle device of the transport vehicle and transport vehicle devices of other transport vehicles of the plurality of transport vehicles over at least one communication link, wherein the communication link is provided by a direct radio link or by communication via a mobile radio network, wherein transmission of the BSMs over the communication link is protected by a root certificate in a manner such that each BSM is digitally signed using a root certificate associated with the transport vehicle transmitting the BSM; wherein at least one of the plurality of regional root certificate authorities determines whether the identity associating the root certificate with the corresponding one of the plurality of transportation vehicles is legal for a jurisdiction of the at least one regional authority, wherein the jurisdiction includes at least one country associated with the at least one regional root certificate authority, wherein at least two of the plurality of regional authorities use a certificate trust list that includes at least one common root certificate that is identified as a legitimate root certificate in each of at least two of the plurality of respective jurisdictions, wherein each regional authority uses voter-based root management to modify the certificate trust list that lists legitimate certificates within its jurisdiction, wherein, when the regional restriction on the root certificate includes multiple countries, the legitimacy of the root certificate is determined by the corresponding regional root certificate authority represented by the corresponding certificate trust list of the regional root certificate authority, and wherein the voter-based root management uses the identified voters to manage the trust anchor of the corresponding certificate trust list, wherein a root certificate is used across multiple countries, the root certificate identifying the jurisdictions for which the root certificate is valid under IEEE 1609.2 peer certificate distribution so that the voter-based root management works even if there is a trust compromise at the highest level of the chain of trust, and The identified voters include at least one common voter that is recognized as legitimate within the respective jurisdictions of at least two regional root certificate authorities.

10. The method according to claim 9, wherein: Voter-based root management is performed using endorsed ballots, where a regional authority seeking to add or remove a root certificate from its certificate trust list asks a majority of voters identified by the regional authority to sign a ballot to endorse or revoke the root certificate.

11. The method according to claim 9, wherein: Multiple regional authorities are associated with respective jurisdictions that share common boundaries.

12. The method according to claim 9, wherein: The root certificate issuing authorities each issue a digital certificate including a root certificate, wherein the digital certificate certifies ownership of a public key by a named subject of the digital certificate.

13. The method according to claim 9, wherein: The BSMs each include data specific to the transport vehicle, including the time, location, speed, and heading of the transport vehicle sending the BSM.

14. The method according to claim 9, wherein: The digital signature of the BSM serves as authentication of the correctness and authenticity of the data contained in the BSM.

15. The method according to claim 9, wherein: Before one or more transport vehicle safety applications running on a transport vehicle among the plurality of transport vehicles receiving the BSM through V2V communication access data of the BSM, the digital signature of the BSM is analyzed by the transport vehicle safety application.

16. The method according to claim 9, wherein: The one or more transportation vehicle safety applications are autonomous or assisted driving applications.

17. A non-transitory computer-readable medium comprising a computer program having computer software code instructions which, when implemented on at least one computer processor, perform a method for managing trust across a plurality of root certificate authorities for use in vehicle-to-vehicle (V2V) communications between at least two of a plurality of transportation vehicles in the form of a continuous broadcast of a basic safety message (BSM), the method comprising: controlling transmission of V2V communications from a transport vehicle device located on a transport vehicle of the plurality of transport vehicles, the transport vehicle device comprising a transceiver and at least one processor controlling the transceiver, wherein the at least one processor controls the transceiver to provide V2V communications between the transport vehicle device of the transport vehicle and transport vehicle devices of other transport vehicles of the plurality of transport vehicles over at least one communication link, wherein the communication link is provided by a direct radio link or by communication via a mobile radio network, wherein transmission of the BSMs over the communication link is protected by a root certificate in a manner such that each BSM is digitally signed using a root certificate associated with the transport vehicle transmitting the BSM; wherein at least one of the plurality of regional root certificate authorities determines whether the identity associating the root certificate with the corresponding one of the plurality of transportation vehicles is legal for a jurisdiction of the at least one regional authority, wherein the jurisdiction includes at least one country associated with the at least one regional root certificate authority, wherein at least two of the plurality of regional authorities use a certificate trust list that includes at least one common root certificate that is identified as a legitimate root certificate in each of at least two of the plurality of respective jurisdictions, wherein each regional authority uses voter-based root management to modify the certificate trust list that lists legitimate certificates within its jurisdiction, wherein, when the regional restriction on the root certificate includes multiple countries, the legitimacy of the root certificate is determined by the corresponding regional root certificate authority represented by the corresponding certificate trust list of the regional root certificate authority, and wherein the voter-based root management uses the identified voters to manage the trust anchor of the corresponding certificate trust list, wherein a root certificate is used across multiple countries, the root certificate identifying the jurisdictions for which the root certificate is valid under IEEE 1609.2 peer certificate distribution so that the voter-based root management works even if there is a trust compromise at the highest level of the chain of trust, and The identified voters include at least one common voter that is recognized as legitimate within the respective jurisdictions of at least two regional root certificate authorities.

18. The non-transitory computer-readable medium of claim 17, wherein: Voter-based root management is performed using endorsed ballots, where a regional authority seeking to add or remove a root certificate from its certificate trust list asks a majority of voters identified by the regional authority to sign a ballot to endorse or revoke the root certificate.

19. The non-transitory computer-readable medium of claim 17, wherein: Multiple regional authorities are associated with respective jurisdictions that share common boundaries.

20. The non-transitory computer-readable medium of claim 17, wherein: The root certificate issuing authorities each issue a digital certificate including a root certificate, wherein the digital certificate certifies ownership of a public key by a named subject of the digital certificate.

21. The non-transitory computer-readable medium of claim 17, wherein: The BSMs each include data specific to the transport vehicle, including the time, location, speed, and heading of the transport vehicle sending the BSM.

22. The non-transitory computer-readable medium of claim 17, wherein: The digital signature of the BSM serves as authentication of the correctness and authenticity of the data contained in the BSM.

23. The non-transitory computer-readable medium of claim 17, wherein: Before one or more transport vehicle safety applications running on a transport vehicle among the plurality of transport vehicles receiving the BSM through V2V communication access data of the BSM, the digital signature of the BSM is analyzed by the transport vehicle safety application.

24. The non-transitory computer-readable medium of claim 17, wherein: The one or more transportation vehicle safety applications are autonomous or assisted driving applications.

Images