New Guide for Device to Device Certificate-based Communications Security Framework for UAS/UAM
1. Scope
Statement of scope of task/activity:
a. Identify a set of properties and capabilities needed in a security framework for aerial V2X (A2X) communication applications. Leveraging the identified capabilities: identify and evaluate candidate security frameworks. Select one initial framework for which the committee will develop a usage guide for standards bodies and other entities developing secure aircraft device-device communications (activity b).
b. Develop an ASTM Communications Security Framework Guide providing ASTM and other SDOs a process description of how to use the security framework identified in activity (a) for securing specific types of device-device information flows (aerial V2X, also stated as ‘A2X’ applications) based on their sensitivity to lapses in authenticity, integrity, replay attack, and other compromises. Address how the framework is used to support safety-related conspicuity and other device-device communications in aviation (e.g., without the available authentication and integrity controls, the communications are easily hacked and unable to be trusted for safety-of-life purposes)
(1) Elucidate security encapsulation method(s) for the identified security framework
(2) Detail the meaning and use of the framework elements to enable application specifiers to tailor the communications security needed for a given application
(3) Explore and propose approaches to address the security framework with regard to the cryptographic and certificate policy under development in the ICAO IATF.
(4) If the framework is certificate-based:
i. Identify certificate elements and content that: 1) allows CAAs and other entities to create local or CAA-specific profiles for certificates, as identified, and 2) provides static as well as session-based (pseudonymous) aircraft identifier linkability to the digital certificate
ii. Detail a concept of operations (CONOP) for integrating the Public Key Infrastructure for aviation use (e.g., enrollment processes, certificate provisioning, registration, certificate longevity, revocation)
c. Specify and standardize an Authenticated Broadcast Remote ID method that functions within ASTM F3411-22 Broadcast Remote ID. The standard will leverage a selected, internationally standardized security framework as one of potentially many different Secure Authentication Methods (SAM) that may be implemented within the ASTM F3411-22 (Remote ID) Authentication Frame. This profile will be designed to avoid breaking compatibility with non-secured F3411-22 Remote ID (e.g., as profiled in ASTM F3586-22). This activity may be done in conjunction with activity (b).
d. Finalize the draft standard and draft Guide using the ASTM balloting process.
e. Publish the Authenticated Broadcast Remote ID ASTM Standard and Communications Security Guide
f. Work with the FAA or appropriate civil aviation authority (CAA) to obtain a Notice of Availability (NOA) for these items
