CVS151

CVS151.pdf · Security Access / RBAC Standard · Security Access / RBAC

Last updated: 2026-06-29 11:50
RTRFQX Review TeamWorkspace

CVS151

CVS151.pdf · Security Access / RBAC Standard · Security Access / RBAC

Markdown-derived onlyOCR: falseLast generated 2026-06-29 11:50

What this document contains

Confirmed Requirements36customer ID + normative
Needs Clarification6no customer ID
Information45descriptive
Reference4definitions, scope
Critical43ranked impact
Open Points4linked
Tables / Diagrams3 / 12extracted
Derived SSRs8linked

Executive Takeaway

Systems-engineering read of what this document defines for the system - scope, boundaries, interfaces, obligations, and what is still open.

Document Purpose

Scope: this security access / rbac standard specifies cybersecurity concept and evidence, covering 3 Technical content; 3.2 Role Based Access Control Configuration; 3.3 ASN.1 definition; 3.6 role-configuration; 3.8 did-rules; 3.9 rid-rules.

System Boundary & Interfaces

System boundary and interfaces: the document constrains no explicitly mapped external interface yet.

Design / Security Impact

Design and security impact: no specific system feature mapped yet; security capabilities touched: Diagnostic security; Certificate handling; Authentication; 8 supplier system requirement(s) were derived from this document.

Open For Customer

Open for the customer: 4 document-linked open point(s) - mainly Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.; Confirm ownership and provisioning flow for keys/certificates (generation, injection, storage, renewal, revocation) between OEM and supplier.; Confirm the DIA / responsibility (RASIC/CIA) split for each cybersecurity work product before supplier scope is fixed. (sample: 3 of 4) - plus 6 unidentified requirement-like statement(s). Do not baseline these until the customer confirms.

Confidence and limits: High confidence. Categorisation is derived from the converted Markdown (customer IDs, normative wording, and section context); no OCR or downstream PDF analysis is used.

Main Requirement Themes

ThemeEngineering MeaningRequirement CountRepresentative Requirements
Cybersecurity concept and evidenceDrives cybersecurity concept, risk treatment, verification evidence, and traceability obligations.58RFQX-CVS151-0002; RFQX-CVS151-0004; RFQX-CVS151-0005
Responsibility and customer approval modelCreates supplier/OEM allocation decisions for work products, backend infrastructure, approvals, and residual risk.54RFQX-CVS151-0001; RFQX-CVS151-0002; RFQX-CVS151-0004
InformationGroups related document requirements into a single engineering theme.45RFQX-CVS151-0005; RFQX-CVS151-0006; RFQX-CVS151-0007
Diagnostics and service accessDefines UDS service behavior, authorization expectations, safe-state checks, and diagnostic evidence.37RFQX-CVS151-0001; RFQX-CVS151-0004; RFQX-CVS151-0005
RequirementGroups related document requirements into a single engineering theme.36RFQX-CVS151-0011; RFQX-CVS151-0014; RFQX-CVS151-0016
System architecture designGroups related document requirements into a single engineering theme.36RFQX-CVS151-0001; RFQX-CVS151-0003; RFQX-CVS151-0006
SystemGroups related document requirements into a single engineering theme.22RFQX-CVS151-0001; RFQX-CVS151-0003; RFQX-CVS151-0010
CybersecurityGroups related document requirements into a single engineering theme.17RFQX-CVS151-0004; RFQX-CVS151-0008; RFQX-CVS151-0012

Document Content Structure

SectionRequirementsInformationUnknown / Review NeededTotal ItemsCriticalOpen PointsSSR Links
2 Terms, definitions and abbrevations0001110
-- 2.1 Document quirks0001110
3 Technical content36450863938
-- 3.2 Role Based Access Control Configuration718025603
-- 3.3 ASN.1 definition1001101
-- 3.6 role-configuration76014822
-- 3.8 did-rules5309513
-- 3.9 rid-rules2104311
-- 3.10 Extending the Role Based Access Control Configuration using a certificate1204221
-- 3.12 Logic68015714
-- 3.14 Requests Specific Requirements77014715
-- -- 3.14.1 Diagnostic over USD77014715
4 Referenced documents0004420
-- 4.1 Normative references0004420

Tables and Diagrams

Tables are reconstructed column-correct from the document text layer (no OCR). Diagrams are linked from converted image assets.

Tables3column-correct
Diagrams12image-linked
Linked Artifacts13requirement-linked

Tables (3)

TableTable 1 – Pattern Rule Settings

3.7 pattern-rules · page 9 · Linked: RBAC_REQ 15; RBAC_INFO 22; RBAC_INFO 23; RBAC_REQ 16; RBAC_REQ 17; RBAC_REQ 18 (sample: 6 of 7)

BitNameDescription
index
0ReservedReserved 0 == This rule is not valid for a UDS-server
1UDS1 == This rule is valid for a UDS-server This bit shall always assume value 1
2ReservedReserved 0 == No confidentiality is required on the diagnostics request
3Confidentiality1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules.
4-7N/AReserved for future use

Diagnostic parameter or service behavior

TableTable 2 – DID Rule Settings

3.8 did-rules · page 10 · Linked: RBAC_REQ 20; RBAC_INFO 25; RBAC_REQ 21; RBAC_REQ 19; RBAC_INFO 24

BitNameDescription
index
0ReservedReserved 0 == This rule is not valid for a UDS-server
1UDS1 == This rule is valid for a UDS-server This bit shall always assume value 1
2ReservedReserved 0 == No confidentiality is required on the diagnostics request
3Confidentiality1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules. 0 == This rule is not applicable when the DID is being
4Readread 1 == This rule is applicable when the DID is being read 0 == This rule is not applicable when the DID is being
5Writewritten 1 == This rule is applicable when the DID is being written 0 == This rule is not applicable when the DID is being
6IO-controlused for IO-control 1 == This rule is applicable when the DID is being used for IO-control
View all 9 rows
BitNameDescription
index
0ReservedReserved 0 == This rule is not valid for a UDS-server
1UDS1 == This rule is valid for a UDS-server This bit shall always assume value 1
2ReservedReserved 0 == No confidentiality is required on the diagnostics request
3Confidentiality1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules. 0 == This rule is not applicable when the DID is being
4Readread 1 == This rule is applicable when the DID is being read 0 == This rule is not applicable when the DID is being
5Writewritten 1 == This rule is applicable when the DID is being written 0 == This rule is not applicable when the DID is being
6IO-controlused for IO-control 1 == This rule is applicable when the DID is being used for IO-control
7N/AReserved for future use

Diagnostic parameter or service behavior

TableTable 3 – RID Rule Setting

3.9 rid-rules · page 11 · Linked: RBAC_INFO 26; RBAC_REQ 22; RBAC_INFO 27; RBAC_INFO 25; RBAC_REQ 21

Bit indexNameDescription
0ReservedReserved 0 == This rule is not valid for a UDS-server
1UDS1 == This rule is valid for a UDS-server This bit shall always assume value 1
2ReservedReserved 0 == No confidentiality is required on the diagnostics request
3Confidentiality1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules.
4Start0 == This rule is not applicable when the RID is being started 1 == This rule is applicable when the RID is being started
5Stop0 == This rule is not applicable when the RID is being stopped 1 == This rule is applicable when the RID is being stopped
6Read-results0 == This rule is not applicable when the RID results are being read 1 == This rule is applicable when the RID results are being read
7N/AReserved for future use

Diagnostic parameter or service behavior

Diagrams (12)

DiagramFigure 1 – Overview

3.1 Overview · page 4 · Linked: RBAC_INFO 1; RBAC_INFO 3; RBAC_INFO 2; RBAC_INFO 4; RBAC_INFO 5

Page SnapshotLink confidence: High
Open full size

Diagnostic parameter or service behavior

DiagramFigure 1 shows a highlevel view of the RBAC concept.

3.1 Overview · page 4 · Linked: RBAC_INFO 1; RBAC_INFO 3; RBAC_INFO 2; RBAC_INFO 4; RBAC_INFO 5

Page SnapshotLink confidence: High
Open full size

Diagnostic parameter or service behavior

DiagramFigure 2 – Visual representation of the RBACC

3.2 Role Based Access Control Configuration · page 7 · Linked: RBAC_REQ 7

Page SnapshotLink confidence: High
Open full size

Diagram source context

DiagramFigure 3 shows the interaction between the diagnostics server and the RBAC enforcer logic.

3.12 Logic · page 12 · Linked: RBAC_INFO 30; RBAC_REQ 36; RBAC_INFO 28; RBAC_INFO 29; RBAC_REQ 35

Page SnapshotLink confidence: High
Open full size

Diagnostic parameter or service behavior

DiagramFigure 3 – Logic Overview

3.12 Logic · page 13 · Linked: RBAC_INFO 30; RBAC_REQ 35

Embedded ImageLink confidence: High
Open full size

Diagram source context

DiagramFigure 4 – RBAC internal logic

3.12 Logic · page 14 · Linked: RBAC_INFO 32; RBAC_INFO 33

Page SnapshotLink confidence: High
Open full size

State-machine or transition behavior

DiagramFigure 5 – Pattern-rules evaluation

3.12 Logic · page 15 · Linked: RBAC_INFO 34; RBAC_REQ 33

Page SnapshotLink confidence: Medium
Open full size

Diagram source context

DiagramFigure 6 – DID-rules evaluation

3.12 Logic · page 16 · Linked: RBAC_REQ 34

Page SnapshotLink confidence: High
Open full size

Diagram source context

DiagramFigure 7 – RID-rules evaluation

3.12 Logic · page 17 · Linked: RBAC_INFO 37

Page SnapshotLink confidence: High
Open full size

Diagram source context

DiagramFigure 8 – The full rule evaluation scheme (Figure 5 Figure 6, Figure 7 tied together)

3.12 Logic · page 18 · Linked: RBAC_INFO 38; RBAC_REQ 24; RBAC_REQ 25

Page SnapshotLink confidence: High
Open full size

Diagram source context

DiagramFigure 9 – Updating the RBACC using EMP

4.1 Normative references · page 22 · Linked: None

Page SnapshotLink confidence: High
Open full size

Diagram source context

DiagramFigure 10 – Example

4.1 Normative references · page 26 · Linked: None

Page SnapshotLink confidence: High
Open full size

Diagram source context

What This PDF Is About

FieldValue
Source PDFCVS151.pdf
Document TypeSecurity Access / RBAC Standard
DomainSecurity Access / RBAC
Scope Summary36 confirmed requirements, 6 needing clarification, 45 information, 4 reference items; 8 linked SSRs; 4 linked open points.
Main ThemesCybersecurity concept and evidence; Responsibility and customer approval model; Information; Diagnostics and service access; Requirement (sample: 5 of 8)
Does Not ConfirmCustomer-owned responsibility, final customer decisions, and unresolved open points remain unconfirmed.
ConfidenceHigh
Evidence BasisMarkdown-derived requirements and generated RFQX registers; no downstream PDF analysis.

Critical Requirements

This table is horizontally scrollable. Use the bottom scrollbar to view all columns.

IDScoreCategoryRequirement / ReasonSupplier Position
RFQX-CVS151-004995High risk due to unclear OEM/supplier responsibilityTable 1 – Pattern Rule Settings Bit index Name Description 0 Reserved Reserved 1 UDS 0 == This rule is not valid for a UDS-server 1 == This rule is valid for a UDS-server This bit shall always assume value 1 2 Reserved Reserved 3 Confidentiality 0 == No confidentiality is required on the diagnostics request 1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules.security relevant; architecture relevant; Needs Customer Clarification; linked open point; High estimation impact; blocks SSR derivationNeeds Customer Clarification
RFQX-CVS151-005495High risk due to unclear OEM/supplier responsibilityTable 2 – DID Rule Settings Bit index Name Description 0 Reserved Reserved 1 UDS 0 == This rule is not valid for a UDS-server 1 == This rule is valid for a UDS-server This bit shall always assume value 1 2 Reserved Reserved 3 Confidentiality 0 == No confidentiality is required on the diagnostics request 1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules.security relevant; architecture relevant; Needs Customer Clarification; linked open point; High estimation impact; blocks SSR derivationNeeds Customer Clarification
RFQX-CVS151-005895High risk due to unclear OEM/supplier responsibilityTable 3 – RID Rule Setting Bit index Name Description 0 Reserved Reserved 1 UDS 0 == This rule is not valid for a UDS-server 1 == This rule is valid for a UDS-server This bit shall always assume value 1 2 Reserved Reserved 3 Confidentiality 0 == No confidentiality is required on the diagnostics request 1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules.security relevant; architecture relevant; Needs Customer Clarification; linked open point; High estimation impact; blocks SSR derivationNeeds Customer Clarification
RFQX-CVS151-000495High risk due to unclear OEM/supplier responsibility1 Scope Concepts such as secure-update (CVS37) requires Role Based Access Control (RBAC) for diagnostics (UDS).security relevant; architecture relevant; Needs Customer Clarification; linked open point; High estimation impact; blocks SSR derivationReference / Document Information
RFQX-CVS151-009195High risk due to unclear OEM/supplier responsibilityAnnex D DynamicallyDefineDataIdentifier When this service is being used, each DID included in the request must be evaluated against the rules that are applicable for the client (the rules in the client’s certificate and in the RBACC). The client must have read access for all included DIDs and have access to the service themselves. Since reading of DIDs can be allowed by either a pattern-rule (starting with 22 [7]) and/or a DID-rule, both the pattern-rules and the DID-rules must be parsed when evaluating each DID. When the client is performing the actual read operation (ReadDataByIdentifier [7]), the conditions and rules for all DIDs, aliased by the dynamically defined identifier, must be met, otherwise the request shall be rejected with an appropriate NRC.security relevant; architecture relevant; Needs Customer Clarification; linked open point; High estimation impact; blocks SSR derivationReference / Document Information
RBAC_REQ 1177High risk due to unclear OEM/supplier responsibilityThe server shall report the currently stored RBACC’s version via diagnostics.security relevant; architecture relevant; Partially Accept; linked open point; High estimation impactPartially Accept
RBAC_REQ 1377High risk due to unclear OEM/supplier responsibilityThe server shall report the currently stored RBACC’s rbacc-id via diagnostics.security relevant; architecture relevant; Partially Accept; linked open point; High estimation impactPartially Accept
RBAC_REQ 1577High risk due to unclear OEM/supplier responsibilityThe server shall support for every entry in the pattern-rules one octet for the pattern rule settings followed by the diagnostic pattern of variable length.security relevant; architecture relevant; Partially Accept; linked open point; High estimation impactPartially Accept
RBAC_REQ 2277High risk due to unclear OEM/supplier responsibilityIf conflicting/overlapping rules are found between the client certificate D-RBACC extension and any rules in the RBAC-configuration in the RBACC, the server shall enforce the rules in the client certificate D-RBACC extension.security relevant; architecture relevant; Partially Accept; linked open point; High estimation impactPartially Accept
RBAC_REQ 3677High risk due to unclear OEM/supplier responsibilityThe server shall exert the RBACC roles based on the ECU-diagnostics-Role extension on the client’s certificate.security relevant; architecture relevant; Partially Accept; linked open point; High estimation impactPartially Accept
RBAC_REQ 2877High risk due to unclear OEM/supplier responsibilityThe server shall always allow reception of UDS authenticate 0x29 requests regardless of the RBACC settings.security relevant; architecture relevant; Partially Accept; linked open point; High estimation impactPartially Accept
RFQX-CVS151-000266High risk due to unclear OEM/supplier responsibilityAny review of this CVS151 shall only be done in agreement with the involved TRATON Group commercial vehicle Affiliates stated in the table below under section “Technical responsibility”.architecture relevant; Needs Customer Clarification; linked open point; blocks SSR derivationNeeds Customer Clarification

Customer Clarifications / Open Points

Total Open Points4document-linked
P10priority
P20priority
Blocking Conceptyesyes / no
Blocking Estimationyesyes / no
Blocking SSRyesyes / no

Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.

Impact if unresolved: Security-access design and verification scope cannot be frozen; risk of an unprotected diagnostic service.

OpenOpen

Confirm ownership and provisioning flow for keys/certificates (generation, injection, storage, renewal, revocation) between OEM and supplier.

Impact if unresolved: ECU secure-storage and provisioning design is blocked; production-line and PKI dependencies stay open.

OpenOpen

Confirm the DIA / responsibility (RASIC/CIA) split for each cybersecurity work product before supplier scope is fixed.

Impact if unresolved: Without an agreed DIA the supplier risks owning customer work products or leaving cybersecurity gaps in the case.

OpenOpen

Confirm whether each listed requirement is binding supplier scope, customer-owned scope, or evidence-only context for the ECA ECU baseline.

Impact if unresolved: Supplier position, estimation, and affected design allocation remain conditional for the listed requirements.

OpenOpen
Open full open-point table (all fields)

This table is horizontally scrollable. Use the bottom scrollbar to view all columns.

Open PointPriorityQuestion / ImpactRequired Customer DecisionRecommended Supplier PositionOwnerStatus
OP-002Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.Security-access design and verification scope cannot be frozen; risk of an unprotected diagnostic service.Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.Implement configurable session/security-access on the ECU and request the customer-confirmed service-to-role table.Shared (OEM policy / Supplier ECU)Open
OP-003Confirm ownership and provisioning flow for keys/certificates (generation, injection, storage, renewal, revocation) between OEM and supplier.ECU secure-storage and provisioning design is blocked; production-line and PKI dependencies stay open.Confirm ownership and provisioning flow for keys/certificates (generation, injection, storage, renewal, revocation) between OEM and supplier.Provide ECU-side secure storage and provisioning hooks; require OEM confirmation of PKI ownership and the provisioning interface.OEM / Customer (PKI) + Supplier (ECU)Open
OP-009Confirm the DIA / responsibility (RASIC/CIA) split for each cybersecurity work product before supplier scope is fixed.Without an agreed DIA the supplier risks owning customer work products or leaving cybersecurity gaps in the case.Confirm the DIA / responsibility (RASIC/CIA) split for each cybersecurity work product before supplier scope is fixed.Deliver supplier-owned work products per concept; require a signed DIA/RASIC before treating shared items as supplier scope.OEM / Customer + Supplier (DIA)Open
OP-011Confirm whether each listed requirement is binding supplier scope, customer-owned scope, or evidence-only context for the ECA ECU baseline.Supplier position, estimation, and affected design allocation remain conditional for the listed requirements.Decide whether each listed requirement is binding supplier scope, customer-owned scope, or evidence-only context.Carry the items as customer-confirmation dependencies and review them in the next clarification workshop.OEM / CustomerOpen

Confirmed requirements (36)

Items carrying a customer requirement ID and a normative (shall/must) statement.

RBAC_REQ 11RFQX-CVS151-0037Requirement3.6 role-configurationpage 8

The server shall report the currently stored RBACC’s version via diagnostics.

Partially AcceptOpen point OP-002SSR SSR-RBAC-003
Details & reviewer feedback
Section

3.6 role-configuration

Page

page 8

Supplier proposal

Accept. Provide the cybersecurity concept as a supplier work product covering scope, assumptions, risk-treatment traceability, cybersecurity goals/requirements, mitigation strategy, V&V approach, and open responsibility dependencies.

RBAC_REQ 13RFQX-CVS151-0041Requirement3.6 role-configurationpage 8

The server shall report the currently stored RBACC’s rbacc-id via diagnostics.

Partially AcceptOpen point OP-002SSR SSR-RBAC-003
Details & reviewer feedback
Section

3.6 role-configuration

Page

page 8

Supplier proposal

Accept. Provide the cybersecurity concept as a supplier work product covering scope, assumptions, risk-treatment traceability, cybersecurity goals/requirements, mitigation strategy, V&V approach, and open responsibility dependencies.

RBAC_REQ 15RFQX-CVS151-0045Requirement3.8 did-rulespage 9

The server shall support for every entry in the pattern-rules one octet for the pattern rule settings followed by the diagnostic pattern of variable length.

Partially AcceptOpen point OP-002SSR SSR-RBAC-0011 tables · 0 diagrams
Details & reviewer feedback
Section

3.7 pattern-rules

Page

page 9

Security capability

Diagnostic security

Supplier proposal

Accept. Provide the cybersecurity concept as a supplier work product covering scope, assumptions, risk-treatment traceability, cybersecurity goals/requirements, mitigation strategy, V&V approach, and open responsibility dependencies. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0001 Table: Table 1 – Pattern Rule Settings page 9
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_REQ 22RFQX-CVS151-0060Requirement3.10 Extending the Role Based Access Control Configuration using a certificatepage 11

If conflicting/overlapping rules are found between the client certificate D-RBACC extension and any rules in the RBAC-configuration in the RBACC, the server shall enforce the rules in the client certificate D-RBACC extension.

Partially AcceptOpen point OP-003SSR SSR-KEY-0011 tables · 0 diagrams
Details & reviewer feedback
Section

3.10 Extending the Role Based Access Control Configuration using a certificate

Page

page 11

Security capability

Certificate handling

Supplier proposal

Needs customer clarification. Supplier can implement ECU-side certificate/key handling, but ownership of PKI, certificate provisioning, lifecycle management, and backend responsibility must be confirmed through CIA/RASIC. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0003 Table: Table 3 – RID Rule Setting page 11
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_REQ 36RFQX-CVS151-0066Requirement3.12 Logicpage 12

The server shall exert the RBACC roles based on the ECU-diagnostics-Role extension on the client’s certificate.

Partially AcceptOpen point OP-002SSR SSR-KEY-0010 tables · 1 diagrams
Details & reviewer feedback
Section

3.11 ECU-Diagnostics-Role Extension

Page

page 12

Security capability

Certificate handling

Supplier proposal

Needs customer clarification. Supplier can implement ECU-side certificate/key handling, but ownership of PKI, certificate provisioning, lifecycle management, and backend responsibility must be confirmed through CIA/RASIC. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0004 Diagram: Figure 3 shows the interaction between the diagnostics server and the RBAC enforcer logic. page 12
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_REQ 28RFQX-CVS151-0083Requirement3.14.1 Diagnostic over USDpage 19

The server shall always allow reception of UDS authenticate 0x29 requests regardless of the RBACC settings.

Partially AcceptOpen point OP-002SSR SSR-RBAC-001
Details & reviewer feedback
Section

3.14 Requests Specific Requirements 3.14.1 Diagnostic over USD 3.14.1.1 Authenticate 0x29

Page

page 19

Security capability

Authentication

Supplier proposal

Accept. Provide the cybersecurity concept as a supplier work product covering scope, assumptions, risk-treatment traceability, cybersecurity goals/requirements, mitigation strategy, V&V approach, and open responsibility dependencies.

RBAC_REQ 29RFQX-CVS151-0085Requirement3.14.1 Diagnostic over USDpage 19

The server shall evaluate the reported internal service using the RBACC rules whenever it receives a UDS Service 0x84 requests.

Partially AcceptOpen point OP-002SSR SSR-RBAC-004
Details & reviewer feedback
Section

3.14.1.2 SecuredData Transmission 0x84

Page

page 19

Supplier proposal

Partially accept. Supplier can implement ECU-side UDS/session/security-access behavior; customer must confirm the service-to-role table, diagnostic authorization policy, and acceptance criteria.

RBAC_REQ 30RFQX-CVS151-0086Requirement3.14.1 Diagnostic over USDpage 19

The server shall always allow reception of UDS SecuredDataTransmission 0x84 requests regardless of the RBACC settings.

Partially AcceptOpen point OP-002SSR SSR-RBAC-003
Details & reviewer feedback
Section

3.14.1 Diagnostic over USD

Page

page 19

Supplier proposal

Partially accept. Supplier can implement ECU-side UDS/session/security-access behavior; customer must confirm the service-to-role table, diagnostic authorization policy, and acceptance criteria.

RBAC_REQ 31RFQX-CVS151-0088Requirement3.14.1 Diagnostic over USDpage 20

The server shall always allow reception of UDS TesterPresent 0x3E requests regardless of the RBACC settings.

Partially AcceptOpen point OP-002SSR SSR-RBAC-003
Details & reviewer feedback
Section

3.14.1.3 TesterPresent 0x3E

Page

page 20

Supplier proposal

Partially accept. Supplier can implement ECU-side UDS/session/security-access behavior; customer must confirm the service-to-role table, diagnostic authorization policy, and acceptance criteria.

RBAC_REQ 24RFQX-CVS151-0079Requirement3.14.1 Diagnostic over USDpage 19

The server shall allow requests that are contained in role 0 rules regardless of the client authentication state.

Partially AcceptSSR SSR-TOOL-0020 tables · 1 diagrams
Details & reviewer feedback
Section

3.14.1 Diagnostic over USD

Page

page 19

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0010 Diagram: Figure 8 – The full rule evaluation scheme (Figure 5 Figure 6, Figure 7 tied together) page 18
    Diagram source context Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_REQ 2RFQX-CVS151-0014Requirement3.2 Role Based Access Control Configurationpage 5

If conflicting/overlapping rules are found within a role-configuration, the server shall enforce that deny rule takes precedence over the allow rule.

Partially AcceptSSR SSR-TOOL-002
Details & reviewer feedback
Section

3.2 Role Based Access Control Configuration

Page

page 5

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 3RFQX-CVS151-0016Requirement3.2 Role Based Access Control Configurationpage 5

If a matching allow/deny rule is found and all the rule settings are fulfilled, the server shall accept/deny the request.

Partially AcceptSSR SSR-TOOL-002
Details & reviewer feedback
Section

3.2 Role Based Access Control Configuration

Page

page 5

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 4RFQX-CVS151-0018Requirement3.2 Role Based Access Control Configurationpage 5

If a matching rule is found and not all the rule settings are fulfilled, the server shall consider the request rejected for that rule.

Partially AcceptSSR SSR-TOOL-002
Details & reviewer feedback
Section

3.2 Role Based Access Control Configuration

Page

page 5

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 5RFQX-CVS151-0019Requirement3.2 Role Based Access Control Configurationpage 5

The server shall deny a request if no matching rule is found on RBACC.

Partially AcceptSSR SSR-RBAC-003
Details & reviewer feedback
Section

3.2 Role Based Access Control Configuration

Page

page 5

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 6RFQX-CVS151-0023Requirement3.2 Role Based Access Control Configurationpage 6

The server shall evaluate each role-configuration independently from each other.

Partially AcceptSSR SSR-TOOL-002
Details & reviewer feedback
Section

3.2 Role Based Access Control Configuration

Page

page 6

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 27RFQX-CVS151-0028Requirement3.2 Role Based Access Control Configurationpage 6

The server shall require that requests are authenticated for allow rules, using e.g., SecuredDataTransmission 0x84 (see CVS31, ISO-14229-1:2020).

Partially AcceptSSR SSR-TOOL-002
Details & reviewer feedback
Section

3.2 Role Based Access Control Configuration

Page

page 6

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 7RFQX-CVS151-0030Requirement3.3 ASN.1 definitionpage 7

The server and client shall define the RBACC as per the following ASN.1 definition: RBACC ::= SEQUENCE { version OCTET STRING (SIZE(2)), rbacc-id OCTET STRING (SIZE(16)), role-configurations SEQUENCE (SIZE(0..MAX)) OF Role-configuration } Role-configuration ::= SEQUENCE { role INTEGER(0..MAX), pattern-rules-deny SEQUENCE (SIZE(0...MAX)) OF OCTET STRING (SIZE(2..MAX)), pattern-rules-allow SEQUENCE (SIZE(0...MAX)) OF OCTET STRING (SIZE(2..MAX)), did-rules-deny SEQUENCE (SIZE(0...MAX)) OF OCTET STRING (SIZE(3)), did-rules-allow SEQUENCE (SIZE(0...MAX)) OF OCTET STRING (SIZE(3)), rid-rules-deny SEQUENCE (SIZE(0...MAX)) OF OCTET STRING (SIZE(3)), rid-rules-allow SEQUENCE (SIZE(0...MAX)) OF OCTET STRING (SIZE(3)) }

Partially AcceptSSR SSR-RBAC-0030 tables · 1 diagrams
Details & reviewer feedback
Section

3.3 ASN.1 definition

Page

page 7

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0003 Diagram: Figure 2 – Visual representation of the RBACC page 7
    Diagram source context Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_REQ 8RFQX-CVS151-0032Requirement3.6 role-configurationpage 8

The server shall support in the version field two octets.

Partially AcceptSSR SSR-TOOL-002
Details & reviewer feedback
Section

3.6 role-configuration

Page

page 8

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 9RFQX-CVS151-0033Requirement3.6 role-configurationpage 8

The server shall support major version value 3 and minor version value 0.

Partially AcceptSSR SSR-TOOL-002
Details & reviewer feedback
Section

3.6 role-configuration

Page

page 8

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 10RFQX-CVS151-0035Requirement3.6 role-configurationpage 8

Before RBACC is stored, the server shall verify that the server supports the structure indicated in the version number.

Partially AcceptSSR SSR-RBAC-003
Details & reviewer feedback
Section

3.6 role-configuration

Page

page 8

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 12RFQX-CVS151-0040Requirement3.6 role-configurationpage 8

The server shall support 16 octets in the rbacc-id field.

Partially AcceptSSR SSR-RBAC-003
Details & reviewer feedback
Section

3.6 role-configuration

Page

page 8

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 14RFQX-CVS151-0044Requirement3.6 role-configurationpage 8

The server shall support role-configurations using 32-bit unsigned integer.

Partially AcceptSSR SSR-TOOL-002
Details & reviewer feedback
Section

3.6 role-configuration

Page

page 8

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 16RFQX-CVS151-0048Requirement3.8 did-rulespage 9

The server shall support the pattern-rule setting according to Table 1.

Partially AcceptSSR SSR-TOOL-0021 tables · 0 diagrams
Details & reviewer feedback
Section

3.8 did-rules

Page

page 9

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0001 Table: Table 1 – Pattern Rule Settings page 9
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_REQ 17RFQX-CVS151-0050Requirement3.8 did-rulespage 9

The server shall support for every entry in the did-rules one octet which represents the did-rule settings followed by two octets that represent the DID.

Partially AcceptSSR SSR-TOOL-0021 tables · 0 diagrams
Details & reviewer feedback
Section

4-7 N/A Reserved for future use 3.8 did-rules

Page

page 9

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0001 Table: Table 1 – Pattern Rule Settings page 9
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_REQ 19RFQX-CVS151-0053Requirement3.8 did-rulespage 9

The server shall support the did-rule setting according to Table 2.

Partially AcceptSSR SSR-TOOL-0021 tables · 0 diagrams
Details & reviewer feedback
Section

3.8 did-rules

Page

page 9

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0002 Table: Table 2 – DID Rule Settings page 10
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_REQ 20RFQX-CVS151-0055Requirement3.9 rid-rulespage 10

4 Read 0 == This rule is not applicable when the DID is being read 1 == This rule is applicable when the DID is being read 5 Write 0 == This rule is not applicable when the DID is being written 1 == This rule is applicable when the DID is being written 6 IO-control 0 == This rule is not applicable when the DID is being used for IO-control 1 == This rule is applicable when the DID is being used for IO-control 7 N/A Reserved for future use 3.9 rid-rules The server shall support for every entry in the rid-rules one octet which represents the rid-rule settings followed by two octets that represent the RID.

Partially AcceptSSR SSR-TOOL-0021 tables · 0 diagrams
Details & reviewer feedback
Section

3.9 rid-rules

Page

page 10

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0002 Table: Table 2 – DID Rule Settings page 10
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_REQ 21RFQX-CVS151-0057Requirement3.9 rid-rulespage 10

The server shall support the rid-rule setting according to Table 3.

Partially AcceptSSR SSR-TOOL-0022 tables · 0 diagrams
Details & reviewer feedback
Section

3.9 rid-rules

Page

page 10

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 2 | Linked diagrams: 0

  • TABLE-CVS151-0002 Table: Table 2 – DID Rule Settings page 10
    Diagnostic parameter or service behavior Image available: no View artifact
  • TABLE-CVS151-0003 Table: Table 3 – RID Rule Setting page 11
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_REQ 23RFQX-CVS151-0062Requirement3.12 Logicpage 12

The server shall interpret the extnValue (see snipped above) as of one instance of a RBACC (see 3.3).

Partially AcceptSSR SSR-RBAC-003
Details & reviewer feedback
Section

3.12 Logic

Page

page 12

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 35RFQX-CVS151-0068Requirement3.12 Logicpage 13

The server shall implement RBAC internal logic as per Figure 4.

Partially AcceptSSR SSR-RBAC-0040 tables · 2 diagrams
Details & reviewer feedback
Section

Figure 3 – Logic Overview

Page

page 13

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 2

  • DIAGRAM-CVS151-0004 Diagram: Figure 3 shows the interaction between the diagnostics server and the RBAC enforcer logic. page 12
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
  • DIAGRAM-CVS151-0005 Diagram: Figure 3 – Logic Overview page 13
    Diagram source context Image available: yes View artifact
    Embedded ImageLink confidence: High
    Open full size
RBAC_REQ 32RFQX-CVS151-0071Requirement3.12 Logicpage 15

The server shall implement RBAC pattern rule evaluation logic as per Figure 5.

Partially AcceptSSR SSR-RBAC-004
Details & reviewer feedback
Section

3.12 Logic

Page

page 15

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 33RFQX-CVS151-0074Requirement3.12 Logicpage 16

The server shall implement RBAC did rule evaluate as per Figure 6.

Partially AcceptSSR SSR-RBAC-0030 tables · 1 diagrams
Details & reviewer feedback
Section

3.12 Logic

Page

page 16

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0007 Diagram: Figure 5 – Pattern-rules evaluation page 15
    Diagram source context Image available: yes View artifact
    Page SnapshotLink confidence: Medium
    Open full size
RBAC_REQ 34RFQX-CVS151-0075Requirement3.12 Logicpage 17

The server shall implement RBAC rid rule evaluate as per Figure 7.

Partially AcceptSSR SSR-RBAC-0030 tables · 1 diagrams
Details & reviewer feedback
Section

3.12 Logic

Page

page 17

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0008 Diagram: Figure 6 – DID-rules evaluation page 16
    Diagram source context Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_REQ 25RFQX-CVS151-0080Requirement3.14.1 Diagnostic over USDpage 19

The server shall allow request that are contained in role 0 rule regardless if the request is data authenticated e.g over e.g., SecuredDataTransmission 0x84 (See CVS31, ISO 14229-1:2020).

Partially AcceptSSR SSR-TOOL-0020 tables · 1 diagrams
Details & reviewer feedback
Section

3.14.1 Diagnostic over USD

Page

page 19

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0010 Diagram: Figure 8 – The full rule evaluation scheme (Figure 5 Figure 6, Figure 7 tied together) page 18
    Diagram source context Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_REQ 26RFQX-CVS151-0081Requirement3.14.1 Diagnostic over USDpage 19

The server shall allow request that are contained in role 0 rule regardless of the value of Confidentiality field setting.

Partially AcceptSSR SSR-TOOL-002
Details & reviewer feedback
Section

3.14.1 Diagnostic over USD

Page

page 19

Supplier proposal

Partially accept. Supplier can implement the ECU-side behaviour, but OEM-owned backend/PKI/fleet responsibilities require customer confirmation.

RBAC_REQ 1RFQX-CVS151-0011Requirement3.2 Role Based Access Control Configurationpage 4

Each RBACC shall only contain one role-configuration per each supported role.

Accept with AssumptionSSR SSR-RBAC-005
Details & reviewer feedback
Section

3.2 Role Based Access Control Configuration

Page

page 4

Supplier proposal

Accept. Implement as part of the cybersecurity concept and map to verification evidence, assuming the customer confirms responsibility allocation and method.

RBAC_REQ 18RFQX-CVS151-0051Requirement3.8 did-rulespage 9

The byte order for DID shall be big endian.

Accept with AssumptionSSR SSR-SYS-0011 tables · 0 diagrams
Details & reviewer feedback
Section

3.8 did-rules

Page

page 9

Supplier proposal

Accept. Provide the cybersecurity concept as a supplier work product covering scope, assumptions, risk-treatment traceability, cybersecurity goals/requirements, mitigation strategy, V&V approach, and open responsibility dependencies. Related source tables/diagrams are treated as interpretation context, not separate customer IDs.

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0001 Table: Table 1 – Pattern Rule Settings page 9
    Diagnostic parameter or service behavior Image available: no View artifact

Needs customer clarification (6)

Reads like a requirement but no customer requirement ID was identified in the source. Confirm with the customer before baselining — not counted as a confirmed requirement.

—RFQX-CVS151-0049Needs Clarification3.8 did-rulespage 9

Table 1 – Pattern Rule Settings Bit index Name Description 0 Reserved Reserved 1 UDS 0 == This rule is not valid for a UDS-server 1 == This rule is valid for a UDS-server This bit shall always assume value 1 2 Reserved Reserved 3 Confidentiality 0 == No confidentiality is required on the diagnostics request 1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules.

Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.

Open point OP-0021 tables · 0 diagrams
Details
Section

3.8 did-rules

Page

page 9

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0001 Table: Table 1 – Pattern Rule Settings page 9
    Diagnostic parameter or service behavior Image available: no View artifact
—RFQX-CVS151-0054Needs Clarification3.9 rid-rulespage 10

Table 2 – DID Rule Settings Bit index Name Description 0 Reserved Reserved 1 UDS 0 == This rule is not valid for a UDS-server 1 == This rule is valid for a UDS-server This bit shall always assume value 1 2 Reserved Reserved 3 Confidentiality 0 == No confidentiality is required on the diagnostics request 1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules.

Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.

Open point OP-0021 tables · 0 diagrams
Details
Section

3.9 rid-rules

Page

page 10

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0002 Table: Table 2 – DID Rule Settings page 10
    Diagnostic parameter or service behavior Image available: no View artifact
—RFQX-CVS151-0058Needs Clarification3.10 Extending the Role Based Access Control Configuration using a certificatepage 11

Table 3 – RID Rule Setting Bit index Name Description 0 Reserved Reserved 1 UDS 0 == This rule is not valid for a UDS-server 1 == This rule is valid for a UDS-server This bit shall always assume value 1 2 Reserved Reserved 3 Confidentiality 0 == No confidentiality is required on the diagnostics request 1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules.

Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.

Open point OP-0021 tables · 0 diagrams
Details
Section

3.10 Extending the Role Based Access Control Configuration using a certificate

Page

page 11

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0003 Table: Table 3 – RID Rule Setting page 11
    Diagnostic parameter or service behavior Image available: no View artifact
—RFQX-CVS151-0002Needs Clarificationpage-1 Page 1page 1

Any review of this CVS151 shall only be done in agreement with the involved TRATON Group commercial vehicle Affiliates stated in the table below under section “Technical responsibility”.

Confirm the DIA / responsibility (RASIC/CIA) split for each cybersecurity work product before supplier scope is fixed.

Open point OP-009
Details
Section

page-1 Page 1

Page

page 1

—RFQX-CVS151-0003Needs Clarificationpage-1 Page 1page 1

The User shall apply the latest version of this CVS151.

Confirm whether each listed requirement is binding supplier scope, customer-owned scope, or evidence-only context for the ECA ECU baseline.

Open point OP-011
Details
Section

page-1 Page 1

Page

page 1

—RFQX-CVS151-0036Needs Clarification3.6 role-configurationpage 8

If the version number does not comply with the server implementation, the server shall reject storing the data.

Confirm whether each listed requirement is binding supplier scope, customer-owned scope, or evidence-only context for the ECA ECU baseline.

Open point OP-011
Details
Section

3.6 role-configuration

Page

page 8

Information / descriptive (45)

Descriptive or contextual statements with a customer ID but no binding (shall/must) wording.

—RFQX-CVS151-0065Information3.12 Logicpage 12

It can also be useful if you want to add or remove access rights from a client/tester, that needs access to one or several roles, but should not have access to everything (or should have more access) specified for the assigned roles.

Open point OP-002SSR SSR-COM-004
Details
Section

3.12 Logic

Page

page 12

—RFQX-CVS151-0078Information3.14.1 Diagnostic over USDpage 19

Meaning, role 0 is particularly useful for defining services, DIDs and RIDs that should be available to all clients/users, regardless of their diagnostics role and/or authorization/authentication status.

SSR SSR-RBAC-005
Details
Section

3.14.1 Diagnostic over USD

Page

page 19

RBAC_INFO 2RFQX-CVS151-0006Information3.2 Role Based Access Control Configurationpage 4

Before a client can execute diagnostics services that are under RBAC, the client must perform some type of authorization procedure towards the server/ECU.

0 tables · 2 diagrams
Details
Section

3.2 Role Based Access Control Configuration

Page

page 4

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 2

  • DIAGRAM-CVS151-0001 Diagram: Figure 1 – Overview page 4
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
  • DIAGRAM-CVS151-0002 Diagram: Figure 1 shows a highlevel view of the RBAC concept. page 4
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_INFO 10RFQX-CVS151-0020Information3.2 Role Based Access Control Configurationpage 5

All RBACC ALLOW rules have a setting that dictates if a request, matching the rule, must be 14229-1:2020).

Details
Section

3.2 Role Based Access Control Configuration

Page

page 5

RBAC_INFO 19RFQX-CVS151-0034Information3.6 role-configurationpage 8

If other versions shall be supported is out of the scope of this document and shall be agreed upon between projects in Traton.

Details
Section

3.6 role-configuration

Page

page 8

RBAC_INFO 40RFQX-CVS151-0082Information3.14.1 Diagnostic over USDpage 19

This means that in role 0 encryption is never required.

Details
Section

3.14.1 Diagnostic over USD

Page

page 19

RBAC_INFO 42RFQX-CVS151-0084Information3.14.1 Diagnostic over USDpage 19

For 0x29 requests a corresponding matching rule in the RBACC is not required for the server to accept the request.

Details
Section

3.14.1 Diagnostic over USD

Page

page 19

RBAC_INFO 43RFQX-CVS151-0087Information3.14.1 Diagnostic over USDpage 19

For 0x84 requests a corresponding matching rule in the RBACC is not required for the server to accept the 0x84 request but the server must find a corresponding matching rule for the internal request contained in the 0x84 prior to execute it.

Details
Section

3.14.1 Diagnostic over USD

Page

page 19

RBAC_INFO 44RFQX-CVS151-0089Information3.14.1 Diagnostic over USDpage 20

For 0x3E requests a corresponding matching rule in the RBACC is not required for the server to accept the request.

Details
Section

3.14.1 Diagnostic over USD

Page

page 20

RBAC_INFO 1RFQX-CVS151-0005Information3.2 Role Based Access Control Configurationpage 4

3 Technical content 3.1 Overview Server/ECUClient/tester UDS Authorize OK/NOTOK UDS request Is the request allowed, based on the client's access rights i.e., compare the client's role/s against the RBACCOK/NOTOK Figure 1 – Overview Figure 1 shows a highlevel view of the RBAC concept.

0 tables · 2 diagrams
Details
Section

3.2 Role Based Access Control Configuration

Page

page 4

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 2

  • DIAGRAM-CVS151-0001 Diagram: Figure 1 – Overview page 4
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
  • DIAGRAM-CVS151-0002 Diagram: Figure 1 shows a highlevel view of the RBAC concept. page 4
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_INFO 3RFQX-CVS151-0007Information3.2 Role Based Access Control Configurationpage 4

The RBAC logic is typically part of the ECU application- and boot-software.

0 tables · 2 diagrams
Details
Section

3.2 Role Based Access Control Configuration

Page

page 4

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 2

  • DIAGRAM-CVS151-0001 Diagram: Figure 1 – Overview page 4
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
  • DIAGRAM-CVS151-0002 Diagram: Figure 1 shows a highlevel view of the RBAC concept. page 4
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_INFO 4RFQX-CVS151-0008Information3.2 Role Based Access Control Configurationpage 4

The RBACC is typically injected into the ECU during production, using a secure protocol.

0 tables · 2 diagrams
Details
Section

3.2 Role Based Access Control Configuration

Page

page 4

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 2

  • DIAGRAM-CVS151-0001 Diagram: Figure 1 – Overview page 4
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
  • DIAGRAM-CVS151-0002 Diagram: Figure 1 shows a highlevel view of the RBAC concept. page 4
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_INFO 5RFQX-CVS151-0009Information3.2 Role Based Access Control Configurationpage 4

As previously mentioned, each ECU (supporting RBAC) will be programmed with an RBACC, RBAC Configuration, containing the rules to drive the RBAC logic.

0 tables · 2 diagrams
Details
Section

3.2 Role Based Access Control Configuration

Page

page 4

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 2

  • DIAGRAM-CVS151-0001 Diagram: Figure 1 – Overview page 4
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
  • DIAGRAM-CVS151-0002 Diagram: Figure 1 shows a highlevel view of the RBAC concept. page 4
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_INFO 6RFQX-CVS151-0010Information3.2 Role Based Access Control Configurationpage 4

The RBACC contains one or several role-configurations (see Figure 2 for a visual representation).

Details
Section

3.2 Role Based Access Control Configuration

Page

page 4

RBAC_INFO 7RFQX-CVS151-0012Information3.2 Role Based Access Control Configurationpage 5

The Role field (in the RBACC) can be seen as a key in a dictionary, which means, two role- configurations cannot contain the same Role value.

Details
Section

3.2 Role Based Access Control Configuration

Page

page 5

RBAC_INFO 8RFQX-CVS151-0013Information3.2 Role Based Access Control Configurationpage 5

A role-configuration, in its turn, contains one or many rules (see Figure 2 for a visual representation).

Details
Section

3.2 Role Based Access Control Configuration

Page

page 5

RBAC_INFO 9RFQX-CVS151-0015Information3.2 Role Based Access Control Configurationpage 5

Each rule can be of either DENY or ALLOW type.

Details
Section

3.2 Role Based Access Control Configuration

Page

page 5

RBAC_INFO 46RFQX-CVS151-0017Information3.2 Role Based Access Control Configurationpage 5

Considering all the rule setting fulfilled, for matching rules of allow type the server will accept the request and for matching rules of deny type the server will deny the request.

Details
Section

3.2 Role Based Access Control Configuration

Page

page 5

RBAC_INFO 11RFQX-CVS151-0021Information3.2 Role Based Access Control Configurationpage 5

Examples of rules within a single role and their expected behaviour: Example 1: A rule in the RBACC states that a role can execute ReadDataByIdentifier 0x22 (see ISO-14229-1:2020) with Confidentiality off.

Details
Section

3.2 Role Based Access Control Configuration

Page

page 5

RBAC_INFO 12RFQX-CVS151-0022Information3.2 Role Based Access Control Configurationpage 6

The RBAC logic is based on an implicit deny principle; meaning, if the RBACC does not explicitly state that a diagnostic request is allowed or denied, then the request is implicitly denied.

Details
Section

3.2 Role Based Access Control Configuration

Page

page 6

RBAC_INFO 13RFQX-CVS151-0024Information3.2 Role Based Access Control Configurationpage 6

If conflicting/overlapping rules are found among multiple role-configuration, the server accepts the request as long within one role-configuration the request is allowed.

Details
Section

3.2 Role Based Access Control Configuration

Page

page 6

RBAC_INFO 14RFQX-CVS151-0025Information3.2 Role Based Access Control Configurationpage 6

Examples of two roles with overlapping rules and their expected behaviour: Example 5: The RBACC contains two roles with rules that states how the role can execute ReadDataByIdentifier 0x22 (see ISO-14229-1:2020).

Details
Section

3.2 Role Based Access Control Configuration

Page

page 6

RBAC_INFO 15RFQX-CVS151-0026Information3.2 Role Based Access Control Configurationpage 6

If a client/tester has been assigned several roles (i.e., several role-configurations in the RBACC are applicable for the client/tester), and at least one of the applicable role-configuration explicitly allows a particular request, then the request is allowed, regardless of if another applicable role-configuration explicitly denies it.

Details
Section

3.2 Role Based Access Control Configuration

Page

page 6

RBAC_INFO 16RFQX-CVS151-0027Information3.2 Role Based Access Control Configurationpage 6

See Annex B for a more detailed example of RBACC.

Details
Section

3.2 Role Based Access Control Configuration

Page

page 6

RBAC_INFO 41RFQX-CVS151-0029Information3.2 Role Based Access Control Configurationpage 6

Allow rules defined in role 0 are an exception to this requirement, see 3.13.

Details
Section

3.2 Role Based Access Control Configuration

Page

page 6

RBAC_INFO 18RFQX-CVS151-0031Information3.6 role-configurationpage 8

The version specifies the structure of RBACC.

Details
Section

3.4 version

Page

page 8

RBAC_INFO 35RFQX-CVS151-0038Information3.6 role-configurationpage 8

See RBACStructureVersion definition in CVS124.

Details
Section

3.6 role-configuration

Page

page 8

RBAC_INFO 20RFQX-CVS151-0039Information3.6 role-configurationpage 8

This field identifies the RBACC using 16 octets.

Details
Section

3.5 rbacc-id

Page

page 8

RBAC_INFO 36RFQX-CVS151-0042Information3.6 role-configurationpage 8

See RBACIdentifierNumber definition in CVS124.

Details
Section

3.6 role-configuration

Page

page 8

RBAC_INFO 21RFQX-CVS151-0043Information3.6 role-configurationpage 8

A 32-bit unsigned integer that represents one role.

Details
Section

3.6 role-configuration

Page

page 8

RBAC_INFO 22RFQX-CVS151-0046Information3.8 did-rulespage 9

The diagnostic pattern identifies the diagnostic request.

1 tables · 0 diagrams
Details
Section

3.8 did-rules

Page

page 9

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0001 Table: Table 1 – Pattern Rule Settings page 9
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_INFO 23RFQX-CVS151-0047Information3.8 did-rulespage 9

This type of rule can be used to create rules for all types of diagnostic requests.

1 tables · 0 diagrams
Details
Section

3.8 did-rules

Page

page 9

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0001 Table: Table 1 – Pattern Rule Settings page 9
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_INFO 24RFQX-CVS151-0052Information3.8 did-rulespage 9

This type of rule can be used to create rules for all types of diagnostic requests that makes use of DIDs e.g., ReadDataByIdentifier, WriteDataByIdentifier, DynamicallyDefineDataIdentifier (see ISO 14429-1:2020) etc.

2 tables · 0 diagrams
Details
Section

3.8 did-rules

Page

page 9

Related Tables / Diagrams

Linked tables: 2 | Linked diagrams: 0

  • TABLE-CVS151-0001 Table: Table 1 – Pattern Rule Settings page 9
    Diagnostic parameter or service behavior Image available: no View artifact
  • TABLE-CVS151-0002 Table: Table 2 – DID Rule Settings page 10
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_INFO 25RFQX-CVS151-0056Information3.9 rid-rulespage 10

This type of rule can be used to create rules for all types of diagnostic requests that makes use of RIDs.

2 tables · 0 diagrams
Details
Section

3.9 rid-rules

Page

page 10

Related Tables / Diagrams

Linked tables: 2 | Linked diagrams: 0

  • TABLE-CVS151-0002 Table: Table 2 – DID Rule Settings page 10
    Diagnostic parameter or service behavior Image available: no View artifact
  • TABLE-CVS151-0003 Table: Table 3 – RID Rule Setting page 11
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_INFO 26RFQX-CVS151-0059Information3.10 Extending the Role Based Access Control Configuration using a certificatepage 11

4 Start 0 == This rule is not applicable when the RID is being started 1 == This rule is applicable when the RID is being started 5 Stop 0 == This rule is not applicable when the RID is being stopped 1 == This rule is applicable when the RID is being stopped 6 Read-results 0 == This rule is not applicable when the RID results are being read 1 == This rule is applicable when the RID results are being read 7 N/A Reserved for future use 3.10 Extending the Role Based Access Control Configuration using a certificate It is possible to extend the rules (in the RBACC), by including an extension in the user’s/client’s certificate (when certificate-based authorization is being used).

1 tables · 0 diagrams
Details
Section

3.10 Extending the Role Based Access Control Configuration using a certificate

Page

page 11

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0003 Table: Table 3 – RID Rule Setting page 11
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_INFO 27RFQX-CVS151-0061Information3.10 Extending the Role Based Access Control Configuration using a certificatepage 11

A snippet from https://datatracker.ietf.org/doc/html/rfc5280#section-4.1 that specifies the layout of a certificate extension.

1 tables · 0 diagrams
Details
Section

3.10 Extending the Role Based Access Control Configuration using a certificate

Page

page 11

Related Tables / Diagrams

Linked tables: 1 | Linked diagrams: 0

  • TABLE-CVS151-0003 Table: Table 3 – RID Rule Setting page 11
    Diagnostic parameter or service behavior Image available: no View artifact
RBAC_INFO 28RFQX-CVS151-0063Information3.12 Logicpage 12

Inside the extnValue (see snipped above) is one instance of a RBACC (see 3.3).

0 tables · 1 diagrams
Details
Section

3.12 Logic

Page

page 12

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0004 Diagram: Figure 3 shows the interaction between the diagnostics server and the RBAC enforcer logic. page 12
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_INFO 29RFQX-CVS151-0064Information3.12 Logicpage 12

This feature can be particularly useful if you want to create a custom rule-set (which does not map to a role-configuration in the RBACC) for a client/tester without assigning him/her a specific role.

0 tables · 1 diagrams
Details
Section

3.12 Logic

Page

page 12

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0004 Diagram: Figure 3 shows the interaction between the diagnostics server and the RBAC enforcer logic. page 12
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_INFO 30RFQX-CVS151-0067Information3.12 Logicpage 12

Figure 3 shows the interaction between the diagnostics server and the RBAC enforcer logic.

0 tables · 2 diagrams
Details
Section

3.12 Logic

Page

page 12

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 2

  • DIAGRAM-CVS151-0004 Diagram: Figure 3 shows the interaction between the diagnostics server and the RBAC enforcer logic. page 12
    Diagnostic parameter or service behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
  • DIAGRAM-CVS151-0005 Diagram: Figure 3 – Logic Overview page 13
    Diagram source context Image available: yes View artifact
    Embedded ImageLink confidence: High
    Open full size
RBAC_INFO 32RFQX-CVS151-0069Information3.12 Logicpage 15

As previously stated and as show in Figure 4, deny rules takes precedence over allow rules.

0 tables · 1 diagrams
Details
Section

3.12 Logic

Page

page 15

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0006 Diagram: Figure 4 – RBAC internal logic page 14
    State-machine or transition behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_INFO 33RFQX-CVS151-0070Information3.12 Logicpage 15

The RBAC logic starts the process of finding out if the client has a certificate (that extends the RBAC, see 3.10) and/or any exerted roles.

0 tables · 1 diagrams
Details
Section

3.12 Logic

Page

page 15

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0006 Diagram: Figure 4 – RBAC internal logic page 14
    State-machine or transition behavior Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_INFO 34RFQX-CVS151-0072Information3.12 Logicpage 16

The “request.conditions COMPLIES_WITH rule.settings” refers to evaluate if the request conditions fulfils the expected rule settings.

0 tables · 1 diagrams
Details
Section

3.12 Logic

Page

page 16

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0007 Diagram: Figure 5 – Pattern-rules evaluation page 15
    Diagram source context Image available: yes View artifact
    Page SnapshotLink confidence: Medium
    Open full size
RBAC_INFO 37RFQX-CVS151-0076Information3.12 Logicpage 18

In Figure 8, the RBAC complete rule evaluation logic is described.

0 tables · 1 diagrams
Details
Section

3.12 Logic

Page

page 18

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0009 Diagram: Figure 7 – RID-rules evaluation page 17
    Diagram source context Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_INFO 38RFQX-CVS151-0077Information3.14.1 Diagnostic over USDpage 19

The role-configuration containing Role 0 is special, it specifies rules that apply to all clients (regardless of whether the client has been assigned a diagnostics role or not).

0 tables · 1 diagrams
Details
Section

3.13 Role 0 Specific Requirements

Page

page 19

Related Tables / Diagrams

Linked tables: 0 | Linked diagrams: 1

  • DIAGRAM-CVS151-0010 Diagram: Figure 8 – The full rule evaluation scheme (Figure 5 Figure 6, Figure 7 tied together) page 18
    Diagram source context Image available: yes View artifact
    Page SnapshotLink confidence: High
    Open full size
RBAC_INFO 45RFQX-CVS151-0090Information3.14.1 Diagnostic over USDpage 20

Refreshing the S3 timer (see CVS124), e.g., using TesterPresent (0x3E) (see CVS37), is always possible to do outside the secure channel and regardless of the settings in the RBACC role configuration.

Details
Section

3.14.1 Diagnostic over USD

Page

page 20

Reference / document information (4)

Definitions, abbreviations, document history, scope and other boilerplate. Not customer requirements.

—RFQX-CVS151-0004Reference2.1 Document quirkspage 3

Document quirks

1 Scope Concepts such as secure-update (CVS37) requires Role Based Access Control (RBAC) for diagnostics (UDS).

Open point OP-002
Details
Section

2.1 Document quirks

Page

page 3

Security capability

Diagnostic security

—RFQX-CVS151-0091Reference4.1 Normative referencespage 26

Normative references

Annex D DynamicallyDefineDataIdentifier When this service is being used, each DID included in the request must be evaluated against the rules that are applicable for the client (the rules in the client’s certificate and in the RBACC). The client must have read access for all included DIDs and have access to the service themselves. Since reading of DIDs can be allowed by either a pattern-rule (starting with 22 [7]) and/or a DID-rule, both the pattern-rules and the DID-rules must be parsed when evaluating each DID. When the client is performing the actual read operation (ReadDataByIdentifier [7]), the conditions and rules for all DIDs, aliased by the dynamically defined identifier, must be met, otherwise the request shall be rejected with an appropriate NRC.

Open point OP-003
Details
Section

4.1 Normative references

Page

page 26

Security capability

Certificate handling

—RFQX-CVS151-0001Referencepage-1 Page 1page 1

Page 1

RBAC for diagnostics Foreword This Commercial Vehicle Standard (“CVS151”) contains requirement specifications for TRATON Group and may be referred to by any of its commercial vehicle Affiliates.

Details
Section

page-1 Page 1

Page

page 1

—RFQX-CVS151-0073Reference3.12 Logicpage 16

Logic

E.g: For the evaluate pattern the rule setting Confidentiality is set to 0x01 (Confidentiality is required).

Details
Section

3.12 Logic

Page

page 16

Derived Supplier System Requirements

This table is horizontally scrollable. Use the bottom scrollbar to view all columns.

SSRStatement / TraceFeatureSecurity CapabilityInterfaceResponsibilityStatusVerification
SSR-COM-004Secure Communication and Boundary Control — Secure Communication and Boundary ControlThe ECU shall restrict and protect communication for Secure Communication and Boundary Control, exposing only OEM-agreed services and applying authenticity/integrity/freshness and boundary controls on allocated signals (IT / backend domain; allocated to Backend and IT Systems).From this PDF: RFQX-CVS151-0065. Secure Communication and Boundary ControlNoneNoneSharedBlocked by Customer ClarificationReview + Test + table/diagram context review
SSR-KEY-001Key and Certificate Handling — Key and Certificate HandlingThe ECU shall manage key and certificate material for Key and Certificate Handling across provisioning, storage, use, renewal and revocation per the agreed key lifecycle (Cybersecurity domain; allocated to Security Services; security capability: Certificate handling; interface: OEM/Customer Review Interface).From this PDF: RFQX-CVS151-0060; RFQX-CVS151-0066. Key and Certificate HandlingCertificate handlingOEM/Customer Review InterfaceSharedBlocked by Customer ClarificationReview + Test + table/diagram context review
SSR-RBAC-001Secure Diagnostics / RBAC — Secure Diagnostics / RBACThe ECU shall enforce authenticated, role-authorised access for Secure Diagnostics / RBAC, restricting security-relevant diagnostic services per the OEM-agreed role model (Cybersecurity domain; allocated to Security Services; security capability: Diagnostic security; interface: OEM/Customer Review Interface).From this PDF: RFQX-CVS151-0045; RFQX-CVS151-0083. Secure Diagnostics / RBACDiagnostic securityOEM/Customer Review InterfaceSharedBlocked by Customer ClarificationReview + Test + table/diagram context review
SSR-RBAC-003Secure Diagnostics / RBAC — Secure Diagnostics / RBACThe ECU shall enforce authenticated, role-authorised access for Secure Diagnostics / RBAC, restricting security-relevant diagnostic services per the OEM-agreed role model (IT / backend domain; allocated to Backend and IT Systems).From this PDF: RFQX-CVS151-0019; RFQX-CVS151-0030; RFQX-CVS151-0035; RFQX-CVS151-0037; RFQX-CVS151-0040; RFQX-CVS151-0041; RFQX-CVS151-0062; RFQX-CVS151-0074; RFQX-CVS151-0075; RFQX-CVS151-0086; RFQX-CVS151-0088. Secure Diagnostics / RBACNoneNoneSharedBlocked by Customer ClarificationReview + Test + table/diagram context review
SSR-RBAC-004Secure Diagnostics / RBAC — Secure Diagnostics / RBACThe ECU shall enforce authenticated, role-authorised access for Secure Diagnostics / RBAC, restricting security-relevant diagnostic services per the OEM-agreed role model (Software domain; allocated to Application Software).From this PDF: RFQX-CVS151-0068; RFQX-CVS151-0071; RFQX-CVS151-0085. Secure Diagnostics / RBACNoneNoneSharedBlocked by Customer ClarificationReview + Test + table/diagram context review
SSR-RBAC-005Secure Diagnostics / RBAC — Secure Diagnostics / RBACThe ECU shall enforce authenticated, role-authorised access for Secure Diagnostics / RBAC, restricting security-relevant diagnostic services per the OEM-agreed role model (System domain; allocated to System Core).From this PDF: RFQX-CVS151-0011; RFQX-CVS151-0078. Secure Diagnostics / RBACNoneNoneSupplier-OwnedCandidateReview + Test
SSR-SYS-001System Function — System FunctionThe ECU shall implement the System Function behaviour required by its allocated customer requirements, including the specified functions, signals, states and timing (System domain; allocated to System Core; interface: OEM/Customer Review Interface).From this PDF: RFQX-CVS151-0051. System FunctionNoneOEM/Customer Review InterfaceSupplier-OwnedCandidateTest + table/diagram context review
SSR-TOOL-002Tooling / IT / Evidence Storage — Tooling / IT / Evidence StorageThe supplier shall provide the tooling, IT infrastructure and evidence storage required for Tooling / IT / Evidence Storage (IT / backend domain; allocated to Backend and IT Systems; interface: OEM/Customer Review Interface).From this PDF: RFQX-CVS151-0014; RFQX-CVS151-0016; RFQX-CVS151-0018; RFQX-CVS151-0023; RFQX-CVS151-0028; RFQX-CVS151-0032; RFQX-CVS151-0033; RFQX-CVS151-0044; RFQX-CVS151-0048; RFQX-CVS151-0050; RFQX-CVS151-0053; RFQX-CVS151-0055; RFQX-CVS151-0057; RFQX-CVS151-0079; RFQX-CVS151-0080; RFQX-CVS151-0081. Tooling / IT / Evidence StorageNoneOEM/Customer Review InterfaceSharedBlocked by Customer ClarificationReview + Test + table/diagram context review

System / Security Design Impact

Impact AreaEvidence From This PDF
Impacted system featuresNone
Impacted interfacesExternal Interfaces
Impacted security capabilitiesAuthentication; Certificate handling; Diagnostic security
Impacted architecture elementsApplication Software; Backend and IT Systems; Compliance Process; External Interfaces; Hardware Platform; Security Services; System Core
Impacted work productsCybersecurity concept; Cybersecurity verification report; DIA / cybersecurity case; Requirement traceability record; System/architecture design
Tools / IT / hardware / testHigh/High/Low; High/High/Medium; High/Low/Low; High/Low/Medium; Low/High/Low; Low/High/Medium; Low/Low/Low; Low/Low/Medium; Medium/High/High; Medium/High/Low; Medium/High/Medium; Medium/Low/Low (sample: 12 of 13)
Design assumptions introducedSecurity-relevant requirement the ECU can own once responsibility/method is confirmed.; Security-relevant requirement the ECU can own once responsibility/method is confirmed. Linked source table/diagram context was considered for interpretation.
Design decisions requiredConfirm with customer whether this is a binding requirement and assign a customer ID.; Agree responsibility split (DIA) for the non-ECU portion.

Estimation / Resource / Tooling Impact

ImpactStatus
Estimation impactyes
Resource/tool/IT/HW/test impactHigh/High/Low; High/High/Medium; High/Low/Low; High/Low/Medium; Low/High/Low; Low/High/Medium; Low/Low/Low; Low/Low/Medium; Medium/High/High; Medium/High/Low; Medium/High/Medium; Medium/Low/Low (sample: 12 of 13)

Document Impact Diagram

Document Impact

Generated from document-specific requirement, traceability, SSR, and open-point evidence.

flowchart LR doc["CVS151.pdf"] d0["Authentication"] doc --> d0 d1["Certificate handling"] doc --> d1 d2["Diagnostic security"] doc --> d2 i0["Interface: External Interfaces"] doc --> i0 s0["SSR: SSR-COM-004"] doc --> s0 s1["SSR: SSR-KEY-001"] doc --> s1 s2["SSR: SSR-RBAC-001"] doc --> s2 o0["Open point: OP-002"] doc --> o0 o1["Open point: OP-003"] doc --> o1 o2["Open point: OP-009"] doc --> o2
Mermaid source 
flowchart LR
  doc["CVS151.pdf"]
  d0["Authentication"]
  doc --> d0
  d1["Certificate handling"]
  doc --> d1
  d2["Diagnostic security"]
  doc --> d2
  i0["Interface: External Interfaces"]
  doc --> i0
  s0["SSR: SSR-COM-004"]
  doc --> s0
  s1["SSR: SSR-KEY-001"]
  doc --> s1
  s2["SSR: SSR-RBAC-001"]
  doc --> s2
  o0["Open point: OP-002"]
  doc --> o0
  o1["Open point: OP-003"]
  doc --> o1
  o2["Open point: OP-009"]
  doc --> o2

Source Traceability

Source document

CVS151.pdf

Document type

Security Access / RBAC Standard

Domain

Security Access / RBAC

Generated records

36 requirements, 45 information, 8 SSRs

Linked artifacts

3 tables, 12 diagrams

Evidence basis

Markdown-derived requirements and registers; OCR disabled; no downstream PDF analysis

Requirement to SSR Traceability

This table is horizontally scrollable. Use the bottom scrollbar to view all columns.

Customer RequirementSSRDispositionConfidenceReason
RFQX-CVS151-0001NoneCovered by Existing Supplier System Requirementn/aAccepted requirement; covered by a clustered SSR.
RFQX-CVS151-0002NoneBlocked by Customer Clarificationn/aNeeds customer clarification before derivation.
RFQX-CVS151-0003NoneBlocked by Customer Clarificationn/aNeeds customer clarification before derivation.
RFQX-CVS151-0004NoneBlocked by Customer Clarificationn/aNeeds customer clarification before derivation.
RFQX-CVS151-0005NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0006NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0007NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0008NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0009NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0010NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0011SSR-RBAC-005Derive Supplier System RequirementMediumAccepted requirement; seed of its SSR cluster.
RFQX-CVS151-0012NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0013NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0014SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0015NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0016SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0017NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0018SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0019SSR-RBAC-003Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0020NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0021NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0022NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0023SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0024NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0025NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0026NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0027NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0028SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0029NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0030SSR-RBAC-003Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0031NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0032SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0033SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0034NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0035SSR-RBAC-003Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0036NoneBlocked by Customer Clarificationn/aNeeds customer clarification before derivation.
RFQX-CVS151-0037SSR-RBAC-003Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0038NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0039NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0040SSR-RBAC-003Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0041SSR-RBAC-003Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0042NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0043NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0044SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0045SSR-RBAC-001Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0046NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0047NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0048SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0049NoneBlocked by Customer Clarificationn/aNeeds customer clarification before derivation.
RFQX-CVS151-0050SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0051SSR-SYS-001Covered by Existing Supplier System RequirementMediumAccepted requirement; covered by a clustered SSR.
RFQX-CVS151-0052NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0053SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0054NoneBlocked by Customer Clarificationn/aNeeds customer clarification before derivation.
RFQX-CVS151-0055SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0056NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0057SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0058NoneBlocked by Customer Clarificationn/aNeeds customer clarification before derivation.
RFQX-CVS151-0059NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0060SSR-KEY-001Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0061NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0062SSR-RBAC-003Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0063NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0064NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0065SSR-COM-004Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0066SSR-KEY-001Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0067NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0068SSR-RBAC-004Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0069NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0070NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0071SSR-RBAC-004Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0072NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0073NoneCovered by Existing Supplier System Requirementn/aAccepted requirement; covered by a clustered SSR.
RFQX-CVS151-0074SSR-RBAC-003Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0075SSR-RBAC-003Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0076NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0077NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0078SSR-RBAC-005Covered by Existing Supplier System RequirementMediumAccepted requirement; covered by a clustered SSR.
RFQX-CVS151-0079SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0080SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0081SSR-TOOL-002Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0082NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0083SSR-RBAC-001Shared Responsibility / CIA NeededMediumPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0084NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0085SSR-RBAC-004Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0086SSR-RBAC-003Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0087NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0088SSR-RBAC-003Shared Responsibility / CIA NeededLowPartially accepted; ECU portion mapped, OEM portion needs CIA/RASIC.
RFQX-CVS151-0089NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0090NoneInformational Onlyn/aNon-binding; not derived.
RFQX-CVS151-0091NoneBlocked by Customer Clarificationn/aNeeds customer clarification before derivation.
RFQX-CVS151-0092NoneBlocked by Customer Clarificationn/aNeeds customer clarification before derivation.
RFQX-CVS151-0093NoneBlocked by Customer Clarificationn/aNeeds customer clarification before derivation.
RFQX-CVS151-0094NoneBlocked by Customer Clarificationn/aNeeds customer clarification before derivation.

Next Actions

Resolve 4 open clarification point(s) with the customer

Blocks the agreement baseline until confirmed.

Go

Confirm 43 critical requirement(s) with the customer

High impact on concept, design, estimation, or SSR derivation.

Go

Review derived supplier system requirements

Validate allocation, responsibility, and verification intent.

Go

Detailed Evidence

Document intelligence markdown

CVS151

  • Source PDF: CVS151.pdf
  • Converted Markdown: converted/markdown/source document
  • Document type: Security Access / RBAC Standard
  • Domain: Security Access / RBAC
  • Confidence: High
  • Evidence basis: Markdown-derived requirements and generated RFQX registers; no downstream PDF analysis.

Executive Summary

Scope: this security access / rbac standard specifies cybersecurity concept and evidence, covering 3 Technical content; 3.2 Role Based Access Control Configuration; 3.3 ASN.1 definition; 3.6 role-configuration; 3.8 did-rules; 3.9 rid-rules. System boundary and interfaces: the document constrains no explicitly mapped external interface yet.

Engineering obligations: 36 confirmed customer requirement(s) carry an explicit ID and normative wording and must be implemented and verified; 6 further requirement-like statement(s) have no customer ID and must be clarified before they can be baselined; 45 informational and 7 reference item(s) were separated out as non-binding. Design and security impact: no specific system feature mapped yet; security capabilities touched: Diagnostic security; Certificate handling; Authentication; 8 supplier system requirement(s) were derived from this document.

Open for the customer: 4 document-linked open point(s) - mainly Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.; Confirm ownership and provisioning flow for keys/certificates (generation, injection, storage, renewal, revocation) between OEM and supplier.; Confirm the DIA / responsibility (RASIC/CIA) split for each cybersecurity work product before supplier scope is fixed. (sample: 3 of 4) - plus 6 unidentified requirement-like statement(s). Do not baseline these until the customer confirms. Confidence and limits: High confidence. Categorisation is derived from the converted Markdown (customer IDs, normative wording, and section context); no OCR or downstream PDF analysis is used.

Document Abstract

FieldInterpretation
Document PurposeScope: this security access / rbac standard specifies cybersecurity concept and evidence, covering 3 Technical content; 3.2 Role Based Access Control Configuration; 3.3 ASN.1 definition; 3.6 role-configuration; 3.8 did-rules; 3.9 rid-rules.
Engineering InterpretationSystem boundary and interfaces: the document constrains no explicitly mapped external interface yet.
Supplier Proposal ImpactEngineering obligations: 36 confirmed customer requirement(s) carry an explicit ID and normative wording and must be implemented and verified; 6 further requirement-like statement(s) have no customer ID and must be clarified before they can be baselined; 45 informational and 7 reference item(s) were separated out as non-binding.
System / Security ImpactDesign and security impact: no specific system feature mapped yet; security capabilities touched: Diagnostic security; Certificate handling; Authentication; 8 supplier system requirement(s) were derived from this document.
Customer Clarification ImpactOpen for the customer: 4 document-linked open point(s) - mainly Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.; Confirm ownership and provisioning flow for keys/certificates (generation, injection, storage, renewal, revocation) between OEM and supplier.; Confirm the DIA / responsibility (RASIC/CIA) split for each cybersecurity work product before supplier scope is fixed. (sample: 3 of 4) - plus 6 unidentified requirement-like statement(s). Do not baseline these until the customer confirms.
Confidence and LimitsConfidence and limits: High confidence. Categorisation is derived from the converted Markdown (customer IDs, normative wording, and section context); no OCR or downstream PDF analysis is used.

Main Requirement Themes

ThemeSummaryRequirement CountRepresentative Requirements
Cybersecurity concept and evidenceDrives cybersecurity concept, risk treatment, verification evidence, and traceability obligations.58RFQX-CVS151-0002; RFQX-CVS151-0004; RFQX-CVS151-0005
Responsibility and customer approval modelCreates supplier/OEM allocation decisions for work products, backend infrastructure, approvals, and residual risk.54RFQX-CVS151-0001; RFQX-CVS151-0002; RFQX-CVS151-0004
InformationGroups related document requirements into a single engineering theme.45RFQX-CVS151-0005; RFQX-CVS151-0006; RFQX-CVS151-0007
Diagnostics and service accessDefines UDS service behavior, authorization expectations, safe-state checks, and diagnostic evidence.37RFQX-CVS151-0001; RFQX-CVS151-0004; RFQX-CVS151-0005
RequirementGroups related document requirements into a single engineering theme.36RFQX-CVS151-0011; RFQX-CVS151-0014; RFQX-CVS151-0016
System architecture designGroups related document requirements into a single engineering theme.36RFQX-CVS151-0001; RFQX-CVS151-0003; RFQX-CVS151-0006
SystemGroups related document requirements into a single engineering theme.22RFQX-CVS151-0001; RFQX-CVS151-0003; RFQX-CVS151-0010
CybersecurityGroups related document requirements into a single engineering theme.17RFQX-CVS151-0004; RFQX-CVS151-0008; RFQX-CVS151-0012

Document Content Structure

SectionRequirementsInformationUnknownExcludedTotal ItemsCriticalOpen PointsSSR Links
2 Terms, definitions and abbrevations00001110
-- 2.1 Document quirks00001110
3 Technical content364500863938
-- 3.2 Role Based Access Control Configuration7180025603
-- 3.3 ASN.1 definition10001101
-- 3.6 role-configuration760014822
-- 3.8 did-rules53009513
-- 3.9 rid-rules21004311
-- 3.10 Extending the Role Based Access Control Configuration using a certificate12004221
-- 3.12 Logic680015714
-- 3.14 Requests Specific Requirements770014715
-- -- 3.14.1 Diagnostic over USD770014715
4 Referenced documents00004420
-- 4.1 Normative references00004420

Tables and Diagrams

ArtifactTypeCaptionPageRelated RequirementsImpact
TABLE-CVS151-0001TableTable 1 – Pattern Rule Settingspage 9RFQX-CVS151-0045; RFQX-CVS151-0049; RFQX-CVS151-0046; RFQX-CVS151-0047; RFQX-CVS151-0048; RFQX-CVS151-0050; RFQX-CVS151-0051; RFQX-CVS151-0052Diagnostic parameter or service behavior
TABLE-CVS151-0002TableTable 2 – DID Rule Settingspage 10RFQX-CVS151-0054; RFQX-CVS151-0055; RFQX-CVS151-0056; RFQX-CVS151-0057; RFQX-CVS151-0053; RFQX-CVS151-0052Diagnostic parameter or service behavior
TABLE-CVS151-0003TableTable 3 – RID Rule Settingpage 11RFQX-CVS151-0058; RFQX-CVS151-0059; RFQX-CVS151-0060; RFQX-CVS151-0061; RFQX-CVS151-0056; RFQX-CVS151-0057Diagnostic parameter or service behavior
DIAGRAM-CVS151-0001DiagramFigure 1 – Overviewpage 4RFQX-CVS151-0005; RFQX-CVS151-0007; RFQX-CVS151-0006; RFQX-CVS151-0008; RFQX-CVS151-0009Diagnostic parameter or service behavior
DIAGRAM-CVS151-0002DiagramFigure 1 shows a highlevel view of the RBAC concept.page 4RFQX-CVS151-0005; RFQX-CVS151-0007; RFQX-CVS151-0006; RFQX-CVS151-0008; RFQX-CVS151-0009Diagnostic parameter or service behavior
DIAGRAM-CVS151-0003DiagramFigure 2 – Visual representation of the RBACCpage 7RFQX-CVS151-0030Diagram source context
DIAGRAM-CVS151-0004DiagramFigure 3 shows the interaction between the diagnostics server and the RBAC enforcer logic.page 12RFQX-CVS151-0067; RFQX-CVS151-0066; RFQX-CVS151-0063; RFQX-CVS151-0064; RFQX-CVS151-0068Diagnostic parameter or service behavior
DIAGRAM-CVS151-0005DiagramFigure 3 – Logic Overviewpage 13RFQX-CVS151-0067; RFQX-CVS151-0068Diagram source context
DIAGRAM-CVS151-0006DiagramFigure 4 – RBAC internal logicpage 14RFQX-CVS151-0069; RFQX-CVS151-0070State-machine or transition behavior
DIAGRAM-CVS151-0007DiagramFigure 5 – Pattern-rules evaluationpage 15RFQX-CVS151-0072; RFQX-CVS151-0074Diagram source context
DIAGRAM-CVS151-0008DiagramFigure 6 – DID-rules evaluationpage 16RFQX-CVS151-0075Diagram source context
DIAGRAM-CVS151-0009DiagramFigure 7 – RID-rules evaluationpage 17RFQX-CVS151-0076Diagram source context
DIAGRAM-CVS151-0010DiagramFigure 8 – The full rule evaluation scheme (Figure 5 Figure 6, Figure 7 tied together)page 18RFQX-CVS151-0077; RFQX-CVS151-0079; RFQX-CVS151-0080Diagram source context
DIAGRAM-CVS151-0011DiagramFigure 9 – Updating the RBACC using EMPpage 22NoneDiagram source context
DIAGRAM-CVS151-0012DiagramFigure 10 – Examplepage 26NoneDiagram source context

What this document does not confirm

Customer-owned responsibility, final customer decisions, and unresolved open points remain unconfirmed.

Critical Requirements

IDScoreCategoryReasonStatement
RFQX-CVS151-004995High risk due to unclear OEM/supplier responsibilitysecurity relevant; architecture relevant; Needs Customer Clarification; linked open point; High estimation impact; blocks SSR derivationTable 1 – Pattern Rule Settings Bit index Name Description 0 Reserved Reserved 1 UDS 0 == This rule is not valid for a UDS-server 1 == This rule is valid for a UDS-server This bit shall always assume value 1 2 Reserved Reserved 3 Confidentiality 0 == No confidentiality is required on the diagnostics request 1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules.
RFQX-CVS151-005495High risk due to unclear OEM/supplier responsibilitysecurity relevant; architecture relevant; Needs Customer Clarification; linked open point; High estimation impact; blocks SSR derivationTable 2 – DID Rule Settings Bit index Name Description 0 Reserved Reserved 1 UDS 0 == This rule is not valid for a UDS-server 1 == This rule is valid for a UDS-server This bit shall always assume value 1 2 Reserved Reserved 3 Confidentiality 0 == No confidentiality is required on the diagnostics request 1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules.
RFQX-CVS151-005895High risk due to unclear OEM/supplier responsibilitysecurity relevant; architecture relevant; Needs Customer Clarification; linked open point; High estimation impact; blocks SSR derivationTable 3 – RID Rule Setting Bit index Name Description 0 Reserved Reserved 1 UDS 0 == This rule is not valid for a UDS-server 1 == This rule is valid for a UDS-server This bit shall always assume value 1 2 Reserved Reserved 3 Confidentiality 0 == No confidentiality is required on the diagnostics request 1 == Confidentiality is required on the diagnostics request e.g., 0x84 (CVS32) Note: This bit is supported but not used for deny rules.
RFQX-CVS151-000495High risk due to unclear OEM/supplier responsibilitysecurity relevant; architecture relevant; Needs Customer Clarification; linked open point; High estimation impact; blocks SSR derivation1 Scope Concepts such as secure-update (CVS37) requires Role Based Access Control (RBAC) for diagnostics (UDS).
RFQX-CVS151-009195High risk due to unclear OEM/supplier responsibilitysecurity relevant; architecture relevant; Needs Customer Clarification; linked open point; High estimation impact; blocks SSR derivationAnnex D DynamicallyDefineDataIdentifier When this service is being used, each DID included in the request must be evaluated against the rules that are applicable for the client (the rules in the client’s certificate and in the RBACC). The client must have read access for all included DIDs and have access to the service themselves. Since reading of DIDs can be allowed by either a pattern-rule (starting with 22 [7]) and/or a DID-rule, both the pattern-rules and the DID-rules must be parsed when evaluating each DID. When the client is performing the actual read operation (ReadDataByIdentifier [7]), the conditions and rules for all DIDs, aliased by the dynamically defined identifier, must be met, otherwise the request shall be rejected with an appropriate NRC.
RFQX-CVS151-003777High risk due to unclear OEM/supplier responsibilitysecurity relevant; architecture relevant; Partially Accept; linked open point; High estimation impactThe server shall report the currently stored RBACC’s version via diagnostics.
RFQX-CVS151-004177High risk due to unclear OEM/supplier responsibilitysecurity relevant; architecture relevant; Partially Accept; linked open point; High estimation impactThe server shall report the currently stored RBACC’s rbacc-id via diagnostics.
RFQX-CVS151-004577High risk due to unclear OEM/supplier responsibilitysecurity relevant; architecture relevant; Partially Accept; linked open point; High estimation impactThe server shall support for every entry in the pattern-rules one octet for the pattern rule settings followed by the diagnostic pattern of variable length.
RFQX-CVS151-006077High risk due to unclear OEM/supplier responsibilitysecurity relevant; architecture relevant; Partially Accept; linked open point; High estimation impactIf conflicting/overlapping rules are found between the client certificate D-RBACC extension and any rules in the RBAC-configuration in the RBACC, the server shall enforce the rules in the client certificate D-RBACC extension.
RFQX-CVS151-006677High risk due to unclear OEM/supplier responsibilitysecurity relevant; architecture relevant; Partially Accept; linked open point; High estimation impactThe server shall exert the RBACC roles based on the ECU-diagnostics-Role extension on the client’s certificate.

Open Points

Open PointPriorityQuestionImpactStatus
OP-002Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.Security-access design and verification scope cannot be frozen; risk of an unprotected diagnostic service.Open
OP-003Confirm ownership and provisioning flow for keys/certificates (generation, injection, storage, renewal, revocation) between OEM and supplier.ECU secure-storage and provisioning design is blocked; production-line and PKI dependencies stay open.Open
OP-009Confirm the DIA / responsibility (RASIC/CIA) split for each cybersecurity work product before supplier scope is fixed.Without an agreed DIA the supplier risks owning customer work products or leaving cybersecurity gaps in the case.Open
OP-011Confirm whether each listed requirement is binding supplier scope, customer-owned scope, or evidence-only context for the ECA ECU baseline.Supplier position, estimation, and affected design allocation remain conditional for the listed requirements.Open

Supplier System Requirements

SSRTitleStatementReqs From This PDFOther PDFsStatus
SSR-COM-004Secure Communication and Boundary Control — Secure Communication and Boundary ControlThe ECU shall restrict and protect communication for Secure Communication and Boundary Control, exposing only OEM-agreed services and applying authenticity/integrity/freshness and boundary controls on allocated signals (IT / backend domain; allocated to Backend and IT Systems).RFQX-CVS151-0065noBlocked by Customer Clarification
SSR-KEY-001Key and Certificate Handling — Key and Certificate HandlingThe ECU shall manage key and certificate material for Key and Certificate Handling across provisioning, storage, use, renewal and revocation per the agreed key lifecycle (Cybersecurity domain; allocated to Security Services; security capability: Certificate handling; interface: OEM/Customer Review Interface).RFQX-CVS151-0060; RFQX-CVS151-0066noBlocked by Customer Clarification
SSR-RBAC-001Secure Diagnostics / RBAC — Secure Diagnostics / RBACThe ECU shall enforce authenticated, role-authorised access for Secure Diagnostics / RBAC, restricting security-relevant diagnostic services per the OEM-agreed role model (Cybersecurity domain; allocated to Security Services; security capability: Diagnostic security; interface: OEM/Customer Review Interface).RFQX-CVS151-0045; RFQX-CVS151-0083noBlocked by Customer Clarification
SSR-RBAC-003Secure Diagnostics / RBAC — Secure Diagnostics / RBACThe ECU shall enforce authenticated, role-authorised access for Secure Diagnostics / RBAC, restricting security-relevant diagnostic services per the OEM-agreed role model (IT / backend domain; allocated to Backend and IT Systems).RFQX-CVS151-0019; RFQX-CVS151-0030; RFQX-CVS151-0035; RFQX-CVS151-0037; RFQX-CVS151-0040; RFQX-CVS151-0041; RFQX-CVS151-0062; RFQX-CVS151-0074; RFQX-CVS151-0075; RFQX-CVS151-0086; RFQX-CVS151-0088noBlocked by Customer Clarification
SSR-RBAC-004Secure Diagnostics / RBAC — Secure Diagnostics / RBACThe ECU shall enforce authenticated, role-authorised access for Secure Diagnostics / RBAC, restricting security-relevant diagnostic services per the OEM-agreed role model (Software domain; allocated to Application Software).RFQX-CVS151-0068; RFQX-CVS151-0071; RFQX-CVS151-0085noBlocked by Customer Clarification
SSR-RBAC-005Secure Diagnostics / RBAC — Secure Diagnostics / RBACThe ECU shall enforce authenticated, role-authorised access for Secure Diagnostics / RBAC, restricting security-relevant diagnostic services per the OEM-agreed role model (System domain; allocated to System Core).RFQX-CVS151-0011; RFQX-CVS151-0078noCandidate
SSR-SYS-001System Function — System FunctionThe ECU shall implement the System Function behaviour required by its allocated customer requirements, including the specified functions, signals, states and timing (System domain; allocated to System Core; interface: OEM/Customer Review Interface).RFQX-CVS151-0051noCandidate
SSR-TOOL-002Tooling / IT / Evidence Storage — Tooling / IT / Evidence StorageThe supplier shall provide the tooling, IT infrastructure and evidence storage required for Tooling / IT / Evidence Storage (IT / backend domain; allocated to Backend and IT Systems; interface: OEM/Customer Review Interface).RFQX-CVS151-0014; RFQX-CVS151-0016; RFQX-CVS151-0018; RFQX-CVS151-0023; RFQX-CVS151-0028; RFQX-CVS151-0032; RFQX-CVS151-0033; RFQX-CVS151-0044; RFQX-CVS151-0048; RFQX-CVS151-0050; RFQX-CVS151-0053; RFQX-CVS151-0055; RFQX-CVS151-0057; RFQX-CVS151-0079; RFQX-CVS151-0080; RFQX-CVS151-0081noBlocked by Customer Clarification

Design Impact

  • Impacted System Features: None
  • Impacted Interfaces: External Interfaces
  • Impacted Security Capabilities: Authentication; Certificate handling; Diagnostic security
  • Impacted Architecture Elements: Application Software; Backend and IT Systems; Compliance Process; External Interfaces; Hardware Platform; Security Services; System Core
  • Impacted Work Products: Cybersecurity concept; Cybersecurity verification report; DIA / cybersecurity case; Requirement traceability record; System/architecture design
  • Impacted Document Artifacts: TABLE-CVS151-0001; TABLE-CVS151-0002; TABLE-CVS151-0003; DIAGRAM-CVS151-0001; DIAGRAM-CVS151-0002; DIAGRAM-CVS151-0003; DIAGRAM-CVS151-0004; DIAGRAM-CVS151-0005 (sample: 8 of 13)
  • Impacted Tools It Hardware Test: High/High/Low; High/High/Medium; High/Low/Low; High/Low/Medium; Low/High/Low; Low/High/Medium; Low/Low/Low; Low/Low/Medium (sample: 8 of 13)
  • Impacted Supplier System Requirements: SSR-COM-004; SSR-KEY-001; SSR-RBAC-001; SSR-RBAC-003; SSR-RBAC-004; SSR-RBAC-005; SSR-SYS-001; SSR-TOOL-002
  • Design Assumptions Introduced: Security-relevant requirement the ECU can own once responsibility/method is confirmed.; Security-relevant requirement the ECU can own once responsibility/method is confirmed. Linked source table/diagram context was considered for interpretation.
  • Design Decisions Required: Confirm with customer whether this is a binding requirement and assign a customer ID.; Agree responsibility split (DIA) for the non-ECU portion.