Appendix TO ANNEX II SECURITY CERTIFICATION FOR STAGE 2 OBW

The MVU and the TU shall be security certified according to the Common Criteria Scheme. In this Appendix, the MVU and the TU are hereafter referred to as ‘OBW-VU’.

The minimum security requirements to be met by OBW-VU shall be defined in a Security Target (‘ST’) according to the Common Criteria Scheme.

The ST shall be drafted by the manufacturer of the equipment to be certified, and approved by a governmental IT security certification body organised within the Joint Interpretation Working Group (‘JIWG’) which is supporting the mutual recognition of certificates under the umbrella of the European SOGIS-MRA (Agreement on Mutual Recognition of Information Technology Security Evaluation Certificates).

The V2X gateway and the Hardware Security Module of the C-ITS stations shall be security certified against the V2X Gateway and Hardware Security Module protection profiles developed by the Car2Car Communication Consortium.

The assurance level for the security certification of the OBW-VU shall be EAL2. However, if the tachograph is used as MVU, the former shall be certified against an assurance level EAL4 augmented by the assurance components ATE_DPT.2 and AVA_VAN.5, as set out in Appendix 10 to Annex IC to Regulation (EU) 2016/799.

The following assets shall be protected:

1. a))

   OBW-VU message: any message which is sent or received by a relevant OBW-VU module bearing information that is necessary for the calculation of the weight.

   The relevant OBW modules are those hardware and software units of the OBW-VU which process information that, if attacked, may result in a miscalculation by the OBW of the total or axle weight.

   A OBW-VU may be a single relevant module or be composed of different relevant modules, in accordance with point 1.5 of Annex I, in which case the ST shall identify them.

2. b))

   Weight message: message containing the total or axle weight calculated by the OBW-VU.

3. c))

   Calibration data: information that is entered in the OBW-VU memory in order to calibrate the OBW.

4. d))

   Audit information: information on security breach attempts corresponding to the threats addressed in this Appendix.

5. e))

   OBW-VU software: software used within the OBW-VU to implement and support OBW functions which is relevant for the calculation of the weight and the detection of security breach attempts.

The ST shall address the following threats:

1. a))

   T.OBW-VU_message_spoof: an attacker could spoof OBW-VU messages so that the OBW-VU miscalculates the total or axle weight.

2. b))

   T.OBW-VU_message_tamper: an attacker could tamper OBW-VU messages so that the OBW-VU miscalculates the total or axle weight.

3. c))

   T.Weight_message_spoof: an attacker could spoof weight messages so that the weight calculated by the OBW-VU is modified.

4. d))

   T.Weight_message_tamper: an attacker could tamper weight messages so that the weight calculated by the OBW-VU is modified.

5. e))

   T.Audit_spoof: an attacker could spoof audit information messages.

6. f))

   T.Audit_tamper: an attacker could tamper audit information messages.

7. g))

   T.Calibration_tamper: an attacker could enter wrong values as calibration data in order to induce the OBW-VU to miscalculate the weight.

8. h))

   T.Software_tamper: an attacker could modify or replace the OBW-VU software in order to alter the normal calculation of the weight.

9. i))

   T.Stored_Data_tamper: an attacker could try to modify or delete the relevant information stored in the OBW-VU, including audit information.

The security objectives for the OBW-VU shall be the following:

1. a))

   O.Plausibility_validation: the OBW-VU shall verify that information from an incoming message to a relevant module, either from the sensors or from another module, can be trusted on the basis of its plausibility.

2. b))

   O.OBW-VU_stored_information_protection: the OBW-VU shall be able to protect stored software and data from tampering.

3. c))

   O.Notification: the OBW-VU shall be able to notify a security breach attempt.

1. a))

   T.OBW-VU_message_spoof is addressed by O.Plausibility_validation and by O.Notification.

2. b))

   T.OBW-VU_message_tamper is addressed by O.Plausibility_validation and by O.Notification.

3. c))

   T.Weight_message_spoof is addressed by O.Plausibility_validation and by O.Notification.

4. d))

   T.Weight_message_tamper is addressed by O.Plausibility_validation and by O.Notification.

5. e))

   T.Audit_spoof is addressed by O.Plausibility_validation and by O.Notification.

6. f))

   T.Calibration_tamper is addressed by O.Plausibility_validation and by O.Notification.

7. g))

   T.Software_tamper is addressed by O.OBW-VU_stored_information_protection and by O.Notification.

8. h))

   T.Stored_data_tamper is addressed by O.OBW-VU_stored_information_protection and by O.Notification.