1	"September 20-22" September 20-22, 2011 San Jose, CA Day 2 Systems Engineering Team connected vehicle Core System Architecture/Requirements Workshop #2
2	"Welcome to Day 2" Welcome to Day 2
3	Agenda – Wednesday 9/21
4	Core System provides services that… Enable data transfers between system users Mobile Field Center Are in a secure, trusted environment Enabling trust between parties that have no direct relationship Enabling secure data exchange between parties that have no direct relationship Enabling the exchange of data between parties that have data and parties that want data
5	Core System in the context of the connected vehicle environment
6	Core System’s 8 Subsystems
7	"Views that will describe the..." Views that will describe the logical interactions
8	Functional Focuses on the behavior, structure, and interaction of the functions performed by the system Shows functions for each subsystem Traceable to functional requirements Color coding: Subsystems each represented by a different color Information Objects are the same color as the source Function object
9	Functional For each view: Description Consideration/Concerns Entities and their relationships (diagram) Alternatives explored Other related views
10	Functional
11	Functional Views Defined Top Level Data Distribution System Configuration User Configuration System Monitor and Control Credentials Distribution Misbehavior Management Core Decryption Networking Core Backup
12	Functional View 4.2.1 – Top Level Description: Objects map to the subsystems in the Concept of Operations, Provide the basis for all subsequent functional views Satisfy functional requirements Illustrate interface requirements Specifies which subsystems provide external interfaces
13	Functional View 4.2.1 – Top Level Considerations/Concerns Addressed:
14	Functional View 4.2.1 – Top Level
15	Functional View 4.2.1 – Top Level
16	Functional View 4.2.1 – Top Level
17	Functional View 4.2.1 – Top Level
18	Functional View 4.2.1 – Top Level
19	Functional View 4.2.2 – Data Distribution Description: System Users provide data, other System Users subscribe to data; The Core matches those providers and consumers without requiring them to enter into a relationship with the other Includes several optional functions: data aggregation, data parsing and data sampling
20	Functional View 4.2.2 – Data Distribution Considerations/Concerns Addressed:
21	Functional View 4.2.2 – Data Distribution
22	Functional View 4.2.2 – Data Distribution Alternatives Considered: An alternative that omitted the parsing and repackaging function was reviewed at the June workshop Deployers of a Core System might weigh the communications requirements to send large blocks of raw data against the computing requirements to process the queries for data. Result was to make the parsing, aggregating, and sampling functions optional
23	Functional View 4.2.2 – Data Distribution
24	Functional View 4.2.3 – System Configuration Description: Addresses the configuration of all Core subsystems, both for installation and changes to configuration Maintain an understanding of the configuration of other Cores Enables a variety of Core System configurations
25	Functional View 4.2.3 – System Configuration Considerations/Concerns Addressed:
26	Functional View 4.2.3 – System Configuration
27	Functional View 4.2.3 – System Configuration
28	Functional View 4.2.4 – User Configuration Description: Addresses the configuration of Core System user accounts and their data subscriptions Manages Operator, System User, and Core requests for periodic service status updates Creation and modification of System User data provision requests and subscriptions Including actions by Operators, System Users and other Cores
29	Functional View 4.2.4 – User Configuration Considerations/Concerns Addressed:
30	Functional View 4.2.4 – User Configuration
31	Functional View 4.2.4 – User Configuration
32	Functional View 4.2.4 – User Configuration
33	Functional View 4.2.4 – User Configuration
34	Functional View 4.2.5 – System Monitor & Control Description: Day-to-day housekeeping functions that enable the Operator to manage the Core System’s operations Monitoring of subsystem anomalies and state changes Operator interfaces Monitor the environmental conditions the Core operates in Provide status to operators, some system users Supports maintenance actions
35	Functional View 4.2.5 – System Monitor & Control Considerations/Concerns Addressed:
36	Functional View 4.2.5 – System Monitor & Control
37	Functional View 4.2.5 – System Monitor & Control
38	Functional View 4.2.6 – Credentials Distribution Description: Ensure Trust with Field and Center System Users and with Other Cores Mobile User credentials handled outside Core Management of credentials, including X.509 digital certificates, CRLs, and assignment and recognition of credential-related roles (i.e., registration versus certificate distribution)
39	Functional View 4.2.6 – Credentials Distribution Considerations/Concerns Addressed:
40	Functional View 4.2.6 – Credentials Distribution
41	Functional View 4.2.6 – Credentials Distribution Alternatives Considered: Discussed previously in Enterprise Views for Credential Distribution Functional alternatives not selected included features: Core as a CA, Core as a CA, with pre-loaded Certs Separate RA and CA Cores External CA for anonymous DSRC Certs only Multiple root CAs
42	Functional View 4.2.6 – Credentials Distribution
43	Functional View 4.2.7 – Misbehavior Management Description: Identify System Users that are not acting properly Prevent the actions of misbehaving System Users from negatively affecting other System Users Core requests actions of the External CA to deal with the misbehaving user (cert holder) Monitor Operators, and identify and act when they operate in such a way as to jeopardize the Core or the information it passes and stores
44	Functional View 4.2.7 – Misbehavior Management Considerations/Concerns Addressed:
45	Functional View 4.2.7 – Misbehavior Management
46	Functional View 4.2.7 – Misbehavior Management
47	Functional View 4.2.8 – Core Decryption Description: Encrypted messages meant for the Core must be decrypted in order for the Core to act on their contents Encrypted messages that come to the Core but are addressed to System Users are not decrypted by the Core. Requires the storage of a private key at the receiving nodes Balance security risk of having key in multiple locations
48	Functional View 4.2.8 – Core Decryption Considerations/Concerns Addressed:
49	Functional View 4.2.8 – Core Decryption
50	Functional View 4.2.8 – Core Decryption Alternatives Considered: Store the private encryption key at each node that requires the ability to read encrypted messages directed to the Core Supports scalability Exposes security risks
51	Functional View 4.2.8 – Core Decryption
52	Functional View 4.2.9 - Networking Description: Functionality required to maintain security and provide communications for the Core Addresses the Core’s connectivity to private networks and the Internet Defense against attack through those networks All network traffic must be passed through the Intrusion Prevention System (IPS).
53	Functional View 4.2.9 - Networking Considerations/Concerns Addressed:
54	Functional View 4.2.9 - Networking
55	Functional View 4.2.9 - Networking Alternatives Considered: Network traffic could be allowed in without being passed through a single Intrusion Prevention System (IPS) Opens up a potential bottleneck Relies on separate security systems Considered but rejected to preserve security/integrity of the system
56	Functional View 4.2.9 - Networking Connectivity Views High Level Core System Functional Allocation Communications Views Core Routing Information Views Top Level External Objects Top Level Internal Objects
57	Functional View 4.2.10 – Core Backup Description: Core Systems may provide backup functionality to one another. Backup of services, where one Core may provide services in behalf of another Core Backup of data, since data backup is required to implement service backup
58	Functional View 4.2.10 – Core Backup Considerations/Concerns Addressed:
59	Functional View 4.2.10 – Core Backup
60	Functional View 4.2.10 – Core Backup
61	"Nodes" Nodes, communications Links, and Applications
62	Connectivity Composition of the physical elements (nodes) and their connections and interactions Links are traceable to interface requirements
63	Connectivity View 4.3.1 – High Level Description: Allow deployment of the Core System across multiple hardware nodes Provides the interface between the Internet and the Core System’s Service Component Node Also supports connectivity through private networks
64	Connectivity View 4.3.1 – High Level Considerations/Concerns Addressed:
65	Connectivity View 4.3.1 – High Level
66	Connectivity View 4.3.1 – High Level Alternatives Considered: Whether to allow private networks to connect to Core Systems was reviewed in June vs. requiring all System Users to come through the Internet Decided to allow private network connections Greater flexibility, promote deployment
67	Connectivity View 4.3.1 – High Level
68	Connectivity View 4.3.2 – Core System Functional Allocation Description: Allocates functional objects to engineering objects Identifies devices (hardware engineering objects, nodes) and Software Engineering Objects (SEOs) Possible to vary how SEOs are distributed among nodes Supports redundancy
69	Connectivity View 4.3.2 – Core System Functional Allocation Considerations/Concerns Addressed: Performance Interfaces Security Feasibility Risks Evolvability Deployability Maintainability
70	Connectivity View 4.3.2 – Core System Functional Allocation
71	Connectivity View 4.3.2 – Core System Functional Allocation, variation
72	Connectivity View 4.3.2 – Core System Functional Allocation Other variations to the above shown in SAD Alternatives Considered: Allow SCNs, Core Decryptor and Service Router to be implemented on Nodes that are not connected to the same LAN Allowed as an option Put Core Decryptor on same LAN as other components – simplifies network configuration but could compromise security Rejected Related to all functional and comm views
73	Connectivity View 4.3.3 – State and Mode Transitions Description: Covers the states and modes and transitions for the hardware and software objects Standby or Operational State Normal, Degraded, Restricted, Maintenance, Degraded/Restricted Training or Installation State Normal, Degraded, Maintenance
74	Connectivity View 4.3.3 – State and Mode Transitions Considerations/Concerns Addressed: Related View: Functional – Top Level
75	Connectivity View 4.3.3 – State and Mode Transitions
76	"Return tomorrow for discussion on..." Return tomorrow for discussion on Communications and Information Views and Other Topics