ISO/TR 21186-3:2021 PDF

Overview

ISO/TR 21186-3:2021 - Cooperative Intelligent Transport Systems (C-ITS) - Guidelines on the usage of standards - Part 3: Security provides practical, implementer-focused guidance for securing Intelligent Transport Systems (ITS). The report explains how to apply security controls for communications, data access and device protection in C‑ITS environments and offers analyses and best practices for secure ITS connectivity using ISO/TS 21177.

Key deliverables in the document include:

• Guidance on security design processes for C‑ITS applications.
• Communications security and source authentication measures.
• Access control, device security and Public Key Infrastructure (PKI)/Certificate Authority (CA) considerations.
• A use-case driven threat model and example access-control implementation for ISO/TS 21177‑conformant devices.
• Inputs and gap analysis for developing Certificate Policies (CPs) and improving ITS PKI.

Key topics and requirements

• Security design for C‑ITS applications: lifecycle considerations for threat analysis, security objectives and Security Functional Requirements (SFRs).
• Communications security mechanisms: secure sessions, transport layer protection and message authenticity for ITS station interactions.
• Source authentication & access control: role-based access, resource discovery, policy structure and TLS integration examples.
• PKI and certificate management: CA roles, certification processes, CP inputs and identified gaps for ITS deployments.
• Device-level analysis: an IDX device use case with threat modelling, asset identification, SFR mapping and comparison to Common Criteria protection profiles.
• Implementation guidance: stepwise examples (define/load policy, configure TLS, establish secure sessions, access-controlled discovery) tailored to ISO/TS 21177.

Practical applications and who uses it

This technical report is targeted at practitioners who design, deploy or audit secure ITS systems:

• System architects & security engineers: for threat modelling, SFR selection and architecture decisions.
• Vehicle OEMs & roadside equipment manufacturers: to implement device security, access control and ISO/TS 21177 integration.
• PKI operators & certificate authorities: to align CPs and issuance processes with C‑ITS needs and mitigate identified PKI threats.
• Infrastructure operators & service providers: to apply access policies and secure communications between ITS stations.
• Standards bodies & test labs: for comparing protection profiles and addressing gaps with Common Criteria and other PPs.

Related standards

• ISO/TS 21177 - device-to-device secure sessions and resource access authorization (central reference for this TR)
• Common Criteria protection profiles (referenced for mapping SFRs and assessing gaps)
• European C‑ITS Certificate Policy (discussed in gap analysis and CP change needs)

Using ISO/TR 21186-3:2021 helps stakeholders implement consistent, standards-based security controls across C‑ITS deployments, reduce interoperability risks and inform certificate policy and PKI decisions for trusted ITS ecosystems.