## 3 Vcc-Ssf
### Security Layer
The OBU is also encrypted using a symmetric key encryption algorithm. * **Encryption for information using infrastructure:** In the Application Layer, services are frequently provided through infrastructure, and the VC_Ext_Info (_i.e._, Personal Information, Payment Information, Location, User Information, and User State) is encrypted using a public key encryption algorithm. Encrypt Vs, V\({}_{\text{M}}\)\(\rightarrow\) RSU: C = E \({}_{\text{Ksp\_pub}}\) (Hash(VC_Ext_Info)) VC_Ext_Info is sent to an RSU by encrypting the hash value obtained by hashing the key of the Service Provider (SP) K\({}_{\text{Sp\_pub}}\). Key K\({}_{\text{Sp\_pub}}\) is managed in the CA. SP decrypts the encrypted data using K\({}_{\text{Sp\_priv}}\), and hashes it to finally obtain and use VC_Ext_Info. Decrypt RSU \(\rightarrow\) SP: P = D \({}_{\text{Ksp\_priv}}\) (Hash(VC_Ext_Info))  
**Access Control:** In the VCC environment, access to sensitive information should be restricted when there is no legitimately granted authority. The access control monitors attempts to access the vehicle information system from inside and outside the vehicle in VCC. * **Access control for the internal system:** The internal system displays the sensor information visually to the user through the OBU. There are various subjects that attempt to access this information. For example, car mechanics attempting to repair the vehicle, the vehicle owner, drivers other than the owner, and malicious attackers. When objects try to access this information, the role-based access controls access according to the situation information. In addition, we consider the time and place. No subjects except the vehicle owner can access the personal identification information. The example of role-based access control for time and location is shown in Table 2.  
Role-based access control that takes into account situation information permits access to information inside the vehicle from 6:00-24:00 h by all subjects except others. Access control information for each subject is listed in Table 3. The vehicle owner has permission P1 to access all information. A guest driver is provided with P2 permission, and is given only the information required for driving the vehicle. A car mechanic has the P3 rights, and is provided only the information required for maintenance. Others have P4 rights, the lowest level of permission, and cannot access any information. For example, the vehicle owner can register a guest driver on the system, and access is limited to the location or traffic information required for the driving. A car mechanic can access the information during R1 hours, since this type of work is done during the day, and the information is limited to start-up, steering, or braking system information as required for vehicle repair. Finally, \begin{table}
\begin{tabular}{c c c} \hline \hline
**Situation Information** & **Role** & **Permission** \\ \hline \multirow{2}{*}{Time} & R1: 06:00–24:00 & P1, P2, P3 \\  & R2: 00:00–06:00 & P1, P2 (Optional) \\ \hline \multirow{3}{*}{Location} & R3: Parking lot & P1, P2 (Optional) \\  & R4: Road & P1, P2 (Optional) \\ \cline{1-1}  & R5: Repair shop & P1, P3 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Example of role-based access control for time and location. persons who are not registered by the vehicle owner are considered to be \"others,\" and they have no authority. The owner and guest drivers have access to their allowed information at any hour. Role-based access control considers three locations: parking lot, road, and repair shop. For example, in a parking lot or on the road, only the vehicle owner and the guest driver can access information. In contrast, in the repair shop, only the car mechanic and owner have access to information. * **Access control for outside the vehicle:** From outside the vehicle, using V2V and V2I communication, traffic infrastructure and external vehicles also attempt to access the internal information. The traffic infrastructure attempts to access the location for traffic analysis or vehicle authentication.