GM/T 0141-2024 in English

Introduction

Key management security requirements

Section 6.3 of the standard puts forward comprehensive requirements for key management:

Key lifecycle management includes generation, storage, distribution, use, update, backup, recovery, archiving, and destruction, each with corresponding security requirements.

Communication Security Assurance Mechanism

Section 6.4 of the standard specifies specific requirements for communication security:

Registration certificate management communications must utilize application-layer encryption or TLCP secure channels to ensure the confidentiality, integrity, and authenticity of communication data. Detection methods include packet capture verification, code review, and simulation testing. Authorization certificate management communications place particular emphasis on protecting user identity privacy information. During the pseudonym certificate application process, secure measures must be implemented for communications between V2X devices and PRAs, and between PRAs and PCAs. All cryptographic algorithms, technologies, and products used in all communication processes must comply with relevant national and industry standards.

Technical requirements for certificates and revocation lists

V2X certificate structure requirements

Section 6.6 and Appendix A of the standard specify the technical requirements for V2X certificates in detail:

• The certificate must be encoded using COER (Regular Octet Encoding Rules)
• The certificate issuer digitally signs the certificate information using a private key
• The identifier of the pseudonym certificate must include the certificate period and link value
• The certificate version number is 2 or 3, and the type value is 0 or 1
• The validity period information must include the correct start time and validity period

V2X certificate revocation list requirements

Section 6.7 and Appendix B of the standard specify the technical requirements for certificate revocation lists:

• V2 XCRLs must use COER encoding. The issuer digitally signs the V2XCRL using its private key. Upon revocation of a non-pseudonymous certificate, the last 10 bytes of the certificate entity after the SM3 hash operation are used as the revoked certificate identifier. Upon revocation of a pseudonymous certificate, the period and period link seed value of the pseudonymous certificate are stored in the V2XCRL. The V2XCRL version number must be 1 or 2 and must include the correct issuance time and next issuance time. Section 6.8 of the standard specifies system functionality and performance requirements: Certificate Issuance Performance requires that the total issuance time for application/identity certificates and pseudonymous certificates must not exceed 30 seconds, with each segmented issuance time not exceeding 20 seconds. This performance indicator ensures that V2X devices can quickly obtain the required certificates to meet real-time communication requirements.

  System functional integrity includes full life cycle management functions such as certificate issuance, renewal, and revocation, as well as security management functions such as security auditing and access control. The system must have the ability to process requests in parallel to ensure stable operation in high-concurrency scenarios.

  ---

  Interoperability and trust system

  The standard emphasizes that the V2X certificate authentication system must support access to the national electronic authentication trust source uniformly planned and constructed by the national cryptography management department. This requirement ensures that the V2X certificate authentication systems of different manufacturers and different regions can be interconnected and form a unified trust system.

  The detection method includes verifying whether the system supports the configuration of the national root certificate, whether it supports the configuration of the secondary CA certificate issued by the national root, and whether it supports joining the list of trusted root certificates issued by the national root.

  ---

  Implementation Recommendations and Compliance Guidance

  Product Development Recommendations

  When developing a V2X certificate authentication system, it is recommended to focus on the following aspects:

  1. Cryptographic Algorithm Implementation: Strictly implement the SM2, SM3, and SM4 algorithms in accordance with national standards to ensure algorithm correctness and performance optimization
  2. Key Security Management: Employ certified cryptographic equipment to achieve comprehensive key lifecycle management
  3. Privacy Protection Mechanism: Rationally design pseudonymous certificates and link value management mechanisms to balance security requirements and privacy protection
  4. System Performance Optimization: Ensure system responsiveness in high-concurrency scenarios and meet real-time requirements

  Testing and Certification Preparation

  The submitting unit is required to prepare complete technical documentation, including a technical work summary report, a security design report, and a user manual. The technical documentation should describe in detail the system's design principles, logical structure, workflow, key management, and security design.

  Before formal testing, it is recommended to conduct sufficient internal testing to ensure that all system functions meet the standard requirements, especially key test items such as the correctness of cryptographic algorithms, key management security and system performance indicators.

  Operation and maintenance management suggestions

  After the system is put into use, a complete operation and maintenance management system should be established:

  • Periodically conduct security audits to monitor the system operation status
  • Establish emergency plans to deal with security incidents such as certificate leaks and system failures
  • Update the system regularly and fix known security vulnerabilities
  • Strengthen operator training to ensure standardized operations

  ---

  Standard evolution and technology trends

  The release of GM/T 0141-2024 marks the further improvement of my country's Internet of Vehicles security standard system. Compared with previous related standards, this standard has made significant progress in the following aspects:

  Technical Field	Features of this Standard	Technical Development Trends
  Cryptographic Algorithms	Fully Adopt National Secret Algorithms	Evolution to Post-Quantum Cryptographic Algorithms
  Privacy Protection	Pseudonymous Certificates and Link Value Mechanisms	Fine-Grained Privacy Protection Technologies
  Performance requirements	Clear timeliness indicators	Support for higher concurrency and lower latency
  Interoperability	Unified trust system requirements	Cross-domain trust and international integration

  With the continuous development of Internet of Vehicles (IoV) technology, future V2X certificate authentication systems will face new challenges and demands, including supporting more complex application scenarios, adapting to stricter privacy protection requirements, and achieving higher-performance certificate processing capabilities. Relevant organizations should closely monitor technological developments and promptly adjust product development and technology upgrade strategies.

  As the foundational specification for V2X certificate authentication system testing, this standard will provide important technical support for the healthy development of the IoV security industry and promote the rapid development and safe application of the intelligent connected vehicle industry.