# 5G V2X System-Level Architecture of 5 GCAR Project
## 3 Overall 5 GCAR Architecture Design
### End-To-End Security
For security purposes, such Z keys have a short validity period. The validity of Z keys may be inversely proportional to the number of vehicles in the group that shares the same key Z (Further discussion and service adaptation will be needed to define Z keys validity duration, and how far in the future a vehicle can request and download Z keys batches. In addition, other aspects such as integrity need to be further evaluated). Trust is based on the knowledge of such shared secret keys during its validity period. To compute the shared keys, an elliptic curve is used defined by a base point G and a prime p, z is a random value, Z keys are curve points computed from a random number z: Z = Gz mod p. The three elements (G, p, and z) are specific to the V2X service and the backend entity. The vehicles need to regularly connect to the Key Manager to download batches of signed tuples containing the curve specifiers G and p, a key Z and its associated validity period. The interaction between the vehicle and the Key Manager (i.e., request and download of batches) is performed over a secured connection, typically TLS based: the vehicle and Key Manager authenticate each other using their respective ETSI V2X certificates (pseudonym certificate for the vehicle). The Key Manager may also verify whether the UE pseudonym certificate holds permissions to request a batch for a given V2X service. Figure 4b depicts how the shared secret key Z is used during its validity period. The considered example is when one vehicle sends a message to all other vehicles participating to the V2X service for which key Z has been obtained. Key Z is used to derive another key Kaz that may be used to (i) encrypt the message payload and compute a hash for integrity purposes and to (ii) encrypt only the hash for  
integrity purposes. The vehicle generates a random number \"a\" which is used to derive the encryption key Kaz. For non-repudiation purposes, UE may calculate A = (g)a [mod p] and upload the result to any entity responsible for traceability. The benefits introduced by this approach are in terms of increased efficiency from a bandwidth and latency point of view. Furthermore, the proposal also aims to reduce the cost associated with security by not requiring as many pseudonym certificates per UE as currently envisioned. Indeed, based on current E.U. policies, up to 100 pseudonym certificates may be required for every vehicle, every week (each pseudonym certificate has a validity period of at most one week). The cost of generating, and especially downloading to the vehicle this large number of certificates represent a significant cost for an OEM when considering millions of vehicles being deployed. Another topic investigated by the 5 GCAR project has been privacy in the context of V2X. The European Commission draft Delegated Act emphasizes that C-ITS services must comply with the E.U. law on the protection of personal data, in particular the General Data Protection Regulation (GDPR). When applied to V2X, personal data should be, not only intended as information allowing to identify a person (e.g., driver, passenger, or a vehicle's owner), but also information such as geographical location data, mileage, driving style, or other vehicle's technical data. In this context, aspects of which data are requested, whether they are stored (and if they are, for how long) need careful consideration. Data shall not be stored unless required to provide a service (data minimization). Figure 4: (**a**) Vehicle gets shared keys from the back-office Key Manager and (**b**) anonymous messages exchange between vehicles. V2X protocols and messages that have been standardized so far support the adoption of pseudonyms. The utilisation of pseudonyms and anonymization are not quite the same: for misbehaviour reporting purposes, there must exist some entity that can link a pseudonym to its enrolment certificate (i.e., true identity).