## 3 ITS Architecture and Security Challenges  
The ITS can be seen as a sub-type of IoT and so it can be developed using similar approaches and architectures. The Figure 1 depicts the architecture contours of most IoT developments. It could also be applied in ITS [8]. The presented architecture consists of four layers responsible for different functions of IoT. Applying this outlines in ITS gives each layer a more specific functions. **Perception layer** of ITS encompasses users' smartphones, in-vehicles' sensors and infrastructure devices. Many of security issues at perception layer are concerned to configuration and initialization of the devices during manufacturing and internal vehicular network design, as in most cases it is not intended for connected cars [8; 14]. **Network layer** is a complex alloy of wired and wireless technologies. One of the big cybersecurity questions at this layer is providing authentication of the nodes in VANET. Due to the need to protect personal data, authentication needs to be anonymous. The limited range of nodes and the strict time requirements introduce additional difficulties [2; 3; 6]. Among the developments for VANET architecture standards, two network technologies are outlined--the family of standards IEEE 1609 (Wireless Access in Vehicular Environment--WAVE),  
Figure 1: Internet of things (IoT) architecture outlines [8]. based on 802.11 and the 3 GPP standard (applicable for 4G and 5G LTE-Long Term Evaluation networks called Cellular Vehicle to Everything--C-V2X) [4; 7; 15]. WAVE describes authentication mechanism based on a list of hierarchical certificates. It specifies precise requirements for specific cryptographic primitives and does not provide an alternative. The issue here is that in dynamic situation and load network the procedure described in standard is not satisfying the time constraints. It require: the elliptic curve digital signature algorithm (ECDSA) and concrete elliptic curves P-256 and P256r1; the maximum size of the private key--32 bytes; AES-CCM (Advanced Standard Encryption in Counter Mode)--a symmetric encryption algorithm and the hash function SHA-256 [4; 7; 16]. C-V2X technology defines two modes of operation--mode 4 (Unmanaged Mode) and mode 3 (Managed Mode). The standard security mechanisms of LTE standards are applicable in Managed Mode. In Unmanaged Mode, security issues remain unresolved. The standard sets requirements for duplication protection, integrity, confidentiality and envisage the use of pseudonyms. It outlines the requirements but does not make recommendations for specific mechanisms [7; 16]. The 5G philosophy is service oriented. Slicing Security as-a-Service or SSaaS, enables operators to provide differentiated and customized security package, including encryption algorithms, encryption parameters, capabilities for blacklist and whitelist configuration, authentication methods and isolation strength and so forth. [15]. At **support layer** the data is being processed in the Fog or Cloud depending on their temporal and spatial specifics and security considerations. As an emerging technology, Fog-based structures present new security challenges because the operation environments of distributed Fog systems are more difficult to protect than a centralized Cloud. The existing security and privacy measurements for cloud computing cannot be directly applied to the fog computing due to its features, such as mobility, heterogeneity and large-scale geo-distribution [5; 8]. The **application layer** reflects the final interaction with the user, which can be expressed in information, warning and even activation of a certain system in the vehicle (in the case of unmanned vehicles). Before reaching the user the data acquired in the sensor layer can be processed in multiple locations. Depending on data semantics, security requirements and time constraints calculations can be done locally, in the vehicle itself, in road side units (RSU), at Fog or Cloud.