SSOV: A Single Sign-on Protocol for Accessing Vehicular Application Services with the Support of Secret Credential Management System

Abstract

With the rapid development of 5G networks, vehicle-to-everything (V2X) applications will become an essential part of vehicular functions. However, existing login methods for mobile applications such as typing passwords or scanning QR codes are unsafe and inconvenient for moving vehicles. The identity privacy from being tracked is also desired for vehicular applications. In this work, we propose a single sign-on (SSO) protocol, SSOV, for accessing vehicular application services. This protocol is built upon the security credential management system (SCMS) defined in the IEEE 1609.2 standard, and requires minor changes to the original system. This protocol allows the vehicles to access the application services via the pseudonym certificates in the SCMS, and the vehicles can remain anonymous during the login process. This design shares some similarities with OAuth or OpenID Connect, but also bears two unique features. First, SSOV is specifically designed for vehicles and does not require any password for the login process. Second, unlike the other two SSO standards, SSOV does not require multiple identity providers, which will introduce extra difficulties in verification and also increase security risks. We analyze the security of SSOV in terms of the confidentiality of the key parameters, the impact of a specific compromised role on the system, and how we will prevent it in the threat model.