SCMS_SOW_DRAFT.docx

U.S. Department of Transportation’s Next Generation Wireless Communications Program

Services and Resources for Testing of Interoperability of Secure Credential Management Systems (SCMS)

I. Background Intelligent Transportation Systems (ITS) improves transportation by integrating advanced Information and Communications-based Technologies (ICT) into transportation infrastructure and vehicles. ITS refers to a system of technologies and operational advancements that, when combined and managed, improve the capabilities of the overall transportation system.

The U.S. Department of Transportation’s (USDOT) ITS Joint Program Office’s (ITS JPO) technology research program works to improve transportation safety, security, mobility, and efficiency and enhancing productivity through the integration of innovative technologies into the nation’s transportation system. The research is performed with other modal agencies to ensure a multi-modal applicability of the technologies.

Through the ITS Program’s Emerging and Enabling Technology Research Program, the ITS JPO conducts research and testing activities to advance critical ITS technologies. Vehicle-to-Everything (V2X) technologies are a key technology that the ITS JPO and USDOT are currently trying to accelerate the deployment of. As part of this effort, the USDOT released Saving Lives with Connectivity: A Plan to Accelerate V2X Deployment, which provides a high-level overview for V2X deployments, with specific goals in near-term, mid-term and long-term timelines. Two areas that are critical to a nationwide deployment of V2X technology are security and interoperability.

Secure and trustable V2X communications are critical to a robust national deployment, and that is provided by the Secure Credential Management System (SCMS). The USDOT previously funded a Proof-of-Concept (POC) SCMS for use by the Connected Vehicle (CV) Pilots, however those efforts started over seven years ago and many lessons learned and updates to V2X systems and SCMS concepts. One of the key changes has been the development of national SCMS systems in other parts of the world, which resulted in new capabilities that allow trust between multiple SCMS providers via a Certificate Trust List (CTL). These interoperable mechanisms are defined in IEEE 1609.2.1. Additionally, misbehavior detection (MBD) has continued to evolve since the USDOT’s POC MBD capability was demonstrated in 2018. To fully evaluate the robustness and maturity of these new capabilities, the USDOT wants to conduct interoperability testing to demonstrate interoperability between devices enrolled with multiple SCMS providers. Additionally, the USDOT wants to test the new MBD concepts and interoperability of MBD reporting and Certificate Revocation Lists (CRL) between multiple SCMS providers as well.

The goal of is to obtain a single entity that can assist the USDOT in conducting SCMS Interoperability activities. This entity will need to be able to work with multiple SCMS Providers to define SCMS Provider policies, create key interoperability components such as the certificate trust list (CTL) in accordance with published standards and assist in planning, executing, and reporting on SCMS Interoperability test activities.

II. Objective The objective of this is to seek proposals for a three-year contract to provide interoperability related SCMS services to verify and validate key SCMS capabilities work between different SCMS providers. Offerors will have to be able to demonstrate the following in their approach:

· Ability to engage and bring together multiple SCMS providers to participate in the activities described in this scope

· Ability to work with existing SCMS policies or create new SCMS policies that enable interoperability between SCMS providers

· Ability to generate and define interfaces for distributing key files that enable interoperability. At a minimum this would include certificate trust lists (CTL), certificate revocation lists (CRL) and misbehavior detection (MBD) reports.

· Ability to explore the interoperable use of SCMS services for use in Network V2X technologies.

· Network V2X in this case would include cellular services (also referred to as uU) and use of Wi-Fi in unlicensed bands

· Ability to create test plans that verify SCMS interoperability between multiple SCMS providers in both normal situations (e.g. – normal message exchanges) and in misbehavior scenarios

· Ability to work with multiple SCMS providers and V2X device vendors to execute interoperability test plans and collect data that either demonstrates successful interoperability between SCMS providers or identifies issues with interoperability to be fixed

· Ability to work analyze test results, develop test reports and work with the SCMS and V2X industry to resolve any issues found in interoperability testing

III. Scope of Work—Research, Analysis, and Testing Services The scope of the three-year contract will be focused on activities to demonstrate interoperability between multiple SCMS providers. In support of the ITS Program’s Next Generation Wireless Communications research, applicant’s proposals will need to identify how services and/or resources are being proposed, either by the offeror, through a subcontractor, or by another means. This scope seeks services in two major task areas, with multiple sub-tasks.

III.1. Task 1: Program Management

The offeror will need to detail how they will manage the overall services and/or resources over a three -year period as detailed in Task 2 below. The offeror will need to include information about which services and capabilities the offeror will conduct themselves with their own personnel, or whether they will subcontract to other organization(s) to provide specific services and/or resources. The offeror will need to also identify how they will procure any equipment or resources they do not currently own but believe will be necessary to conduct the services defined in Task 2. The offeror will also need to identify how they will engage other SCMS providers and get them to participate in the activities described in Task 2. Finally, the offeror will need to identify how they will manage these equipment and resources, including through monthly progress reports and other means of communicating progress to the government.

IV.2 Task 2: Technical Services

The following subsections define the high-level technical services that the US DOT seeks. These technical tasks will focus on demonstrating, verifying, and validating interoperability between multiple SCMS service providers. The services include:

IV.2.1 SCMS Industry Outreach and Collaboration:

The offeror shall outline how they plan to engage with key SCMS Stakeholders which includes SCMS providers, V2X devices vendors, state and local deployment agencies and mobile network operators (MNOs) to participate in SCMS interoperability policy discussions and interoperability testing activities. This plan should indicate if the offerors would be compensating any of these entities for participating in one or more of these activities.

IV.2.2 SCMS Interoperability Policy and Standardization:

The offer shall outline how they plan to address inter-SCMS provider interoperability policy and interfaces, which will be the basis for conducting the interoperability tests and demonstrations. The offeror may propose the use or modification of existing standards, interfaces and industry policies or may propose developing policies, standards, and interfaces as part of this effort. The offeror may also propose a hybrid approach that identifies existing documents that would be used and identifies new documents that this effort would develop.

If the offeror is planning on using and/or modifying existing standards, interfaces, and industry policies they shall reference those specific documents they plan to use and any standards development organizations (SDOs) or industry groups that are involved in the development and maintenance of those documents. The offeror shall also identify any known modifications they would make to these documents and provide an estimate for the time required to make those changes.

If the offeror is planning to develop new policies, standards and interfaces, they shall identify the types of documentation they would develop, how they would involve SCMS industry stakeholders in developing that documentation and an estimate for the time required to develop these documents.

If the offeror is planning the hybrid approach, then they shall identify the existing documents they will use and identify the new documents they would develop, how the SCMS industry would be involved in that development and an estimate for the time required to develop these documents.

IV.2.3 SCMS Interoperability Test Activities One of the most critical elements will be verifying and validating interoperability between multiple SCMS providers. The offeror shall provide their plan for planning, conducting, and reporting on SCMS interoperability test activities. The following are minimum capabilities that the USDOT will want to verify and validate through this contract:

· Basic SCMS Interoperability between providers using a CTL

· Ability of multiple SCMS provider enrolled devices to download and apply the CTL

· Pseudonym to Pseudonym Certificate Interoperability

· Identify to Pseudonym Certificate Interoperability

· Pseudonym to Application Certificate Interoperability

· Identify to Pseudonym Certificate Interoperability

· Basic SCMS CRL Interoperability

· Ability of multiple SCMS provider enrolled devices to download and apply the CRL

· Ability of SCMS Providers to remove trust from devices enrolled in other SCMS providers

· SCMS MBD Interoperability

· Ability to generate a MBD report and submit it for a device enrolled in another SCMS Provider

· Ability of SCMS Providers to add misbehaving devices to the CRL The following are the sub activities that must be accomplished in this task.

IV.2.3.1 SCMS Interoperability Test Planning The offeror shall address how they will coordinate with SCMS stakeholders to develop SCMS interoperability test plans. These plans should be based on policies and standards identified in IV2.2.2 SCMS Interoperability Policy and Standardization, and specific sections should trace to test cases that are verifying or validating those sections of the documents. The offeror shall also provide estimated timelines for developing tests for the three capabilities detailed above. Additionally, the offeror should note any potential risks or constraints they foresee impacting the planning and execution of these tests.

IV.2.3.2 SCMS Interoperability Test Execution The offeror shall address how they would coordinate with SCMS stakeholders to execute the test plans developed above. The offeror shall provide insight into the types of environments they may utilize to conduct this testing or if there are other industry events that they would try and include this testing as a part of. Additionally, the offeror shall detail what test tools may be necessary to conduct this testing as well as any other resources that would be required to test and collect data in accordance with the test plans.

IV.2.3.3. SCMS Interoperability Test Reporting The offeror shall address how they will analyze the results from the test and coordinate with SCMS stakeholders on publishing an SCMS Interoperability Test Report. They should note if any special tools or resources are necessary to conduct this analysis. Additionally, the offeror shall provide plans for how they will address any issues found during testing, how they would resolve those issues and how they may engage with the standards/policy owners to resolve issues if an issue is based on specific standards or policy guidance.

IV.2.4 Exploration of SCMS Capabilities in Network V2X The offeror shall address how they would engage with mobile network operators and other SCMS industry stakeholders and explore the feasibility of utilizing SCMS Public Key Infrastructure (PKI) systems to secure V2X communications utilizing Network V2X technologies. This plan should address looking at what SCMS Policies might need to be updated to support Network V2X as well as any other changes to the current SCMS architecture, policies, and processes.