## 7 Conclusions  
Registering the identities of railway equipment, users, and functional roles enables identification, authentication, and authorization. The registered user identity, functional identity of a user, and functional identity of the equipment are presented in communication sessions. This paper presents a service-oriented approach for the management of equipment, users, and functional identities in FRMCS. Two services are proposed. Both services were designed according to the REST principles. The Railway Identity Management service enables the initial registration of railway equipment, its functional numbers, users, and user functional identities, as well as identity deregistration by the FRMCS system or deregistration when the equipment is switched off or when the user logs out. The registration status models, supported by equipment applications and by FRMCS system, are designed, formally described, and theoretically verified. The Identity Location Management service enables updates of the serving FRMCS system and transfer of registered identities and their serving profiles when the equipment or user roam between different FRMCS systems. The main advantages of the proposed service-oriented approach for identity management are as follows:  
* Virtualization of FRMCS functionality. The proposed services can run as virtual machines on the virtualized infrastructure deployed at the edge of the railway network. Network function virtualization enables robust software installation across railway network locations and eliminates the need for a specialized hardware infrastructure. * Flexibility. Security services need to be more adaptive and have the benefits of easy provisioning and installation. The proposed service-oriented approach enables the seamless deployment of new enhanced security services. * Reusability. Railway applications may be developed by accumulating self-contained, small, and functionally loosely coupled services. The services may be reused in multiple applications independently, as they provide basic capabilities. * Location independence. The depicted services can be located through a service registry and can be accessed through their unique identifiers and can thus be relocated over time without interrupting service continuity. * Reliability. The proposed small and independent services make the process of testing and debugging of applications easier. * Scalability. The ever-increasing user demands for security require more responsible approaches to service provisioning. The proposed solution provides flexibility and agility to scale the security services across FRMCS servers. * Cost saving. The proposed approach helps railway operators to achieve the greater efficiency of capital expenditures and reduces maintenance costs. The cost/benefit rationale of the proposed service-oriented approach is at least twofold. The application of software on standard platforms that meet the demands of throughput and latency requires considerable processing resources. Services send and receive messages, and the flow intensity often reaches high levels, so high-bandwidth servers might be required. Further, the service-oriented approach introduces an extra payload and increased latency. The virtualization of FRMCS functions comes at the cost of more energy consumption. The current level of privacy, i.e., maintaining the confidentiality and integrity of identities, is entirely reliant on the privacy provided by communication protocol stacks. Future work related to railway identity management may be oriented towards the provisioning of identity privacy. As identities are transferred via radio links in FRMCS system, they are susceptible to security threats. Independent from the applied security mechanisms in next-generation mobile networks, identity confidentiality might be protected at the application layer. One possible solution is to use one-time identities with limited validity. Instead of transferring the unique equipment and user identities over the radio link, these one-time identities can be used instead.