Introduction

This document was developed to address the needs of different parties to access data, aggregated information and functionalities (resources) from connected vehicles in a standardized, safe and secure way. A framework is defined for interoperable web services used by several parties via the internet by adapting current and widely used IT approaches based on OAuth 2.0 and OpenID Connect 1.0 (see ISO 20078‑3).

As personal data protection rights are becoming stronger in several countries, this document also defines and recommends common methods to handle data protection and data privacy issues when accessing personalized vehicle data, information or functionalities via web services.

The ISO 20078 series is supported by the fact that vehicle manufacturers (VM) include telematics support for their vehicles, making vehicle data, information and functionalities available at their VM backend system. Thus, instead of installing additional third-party telematics equipment in the vehicle to achieve intended service goals, the already existing infrastructure can be (re)used via interoperable web services. Such web services allow a third party to (re)use the infrastructure in same manners as the VM uses it.

NOTE Web service interfaces have been available and have been offered by VMs previous to this document but lack of standardization over the VMs, especially on authentication and authorization, led to the fact that third parties accommodate and design for several different VM implementations.

The ISO 20078 series is applicable for any application or service that intends to use web services.

The ISO 20078 series does not cover requirements for specific applications, resource definitions or XML/JSON schemas. These are described in the specific application or use case; e.g. see ISO 20080 remote diagnostics support.

This document, ISO 20078‑1, defines all entities and roles that are used over in the ISO 20078 series. It standardizes how an offering party defines resources. Depending on resource category, the offering party uses different kind of identifiers. Such resources can be exposed directly or through containers. It also describes different ways of representing resources in web services, such as JSON and XML.

ISO 20078‑2 defines the usage of a common communication protocol that enables access to resources (URIs), thereby standardizing how an accessing party can access resources via web services of an offering party, using Hypertext Transfer Protocol (HTTP) over Transport Layer Security (TLS); i.e. HTTP secure (HTTPS). The Representational State Transfer (REST) is selected for using a common way to represent data, aggregated information, and functions (resources).

ISO 20078‑3 standardizes the security model of the web services, including different roles and entities involved in an authorization policy. Three roles are defined: identity provider, authorization provider and resource provider at the offering party. Additional roles are the accessing party and the resource owner. The resource owner is in charge of its resources. The role model is defined as a reference implementation of OAuth 2.0 and OpenID Connect 1.0 compatible frameworks.

ISO/TR 20078‑4 summarizes this document, ISO 20078‑2, and ISO 20078‑3 by logical processes for displaying the interaction of all defined roles and entities^[⁴^]. The processes of registration, authentication, and authorization of an accessing party are determined by the requirements set by previous parts. The processes described include registration between the entities, granting, denying, ignoring and revoking access as well as container management possibilities.

In this document, entities are defined as the fundamental objects that represent, for example, vehicles, ECUs, drivers and fleets, and servers at an ExVe backend. Roles are defined as a grouping of entities and have relationships that allow for an interaction; e.g. the “offering party” (ExVe backend) offers resources (ECU data) to an “accessing party” (service implementer).

Figure 1 — Schematic presentation of the vision of the ISO 20078 series

ISO 20078‑1 Content	TU — vehicle integrated telematics unit
ISO 20078‑2 Access	LOG — records access, events, failures, and intrusions
ISO 20078‑3 Security	APP and WEB — application and web services
ISO/TR 20078‑4 Control	Stakeholders — customer, authorities, VM, third party

ExVe web services are comprised of road vehicles combined with the ExVe backend system of the vehicle manufacturer (the “offering party”), mainly acting as a resource provider. This enables for both a third party and a vehicle manufacturer, mainly acting as a service/application provider (the “accessing party”) to access offered resources via the internet; see Figure 1.

The concept of containers is also introduced which allows resource grouping for a single accessing party purpose. Containers are a recommended solution where (data) privacy by design applies.

Logging (LOG of Figure 1) is an important part of any IT solution. It is, however, not considered within the scope of the ISO 20078 series due to potentially strong dependencies on certain IT backend infrastructures.

JSON (recommended) or XML are used for representation of resources (URIs).

The ISO 20078 series defines in general a framework based on the communication and authorization protocols listed in Table 1. Those technologies can be used for implementation of individual web services to share resources and, therefore, allow for any service or application implementation on the accessing party domain.

Table 1 — List of used information technologies

Transport protocol	HTTP 1.1 (or later version) over TLS 1.2 (or later version)
Service design	RESTful
Data format	JSON (recommended)
Data format	XML
Authorization	An OAuth 2.0 (or later version) compatible framework
End user authentication	An OpenID Connect 1.0 (or later version) compatible framework

BS ISO 20078-1:2021

Road vehicles. Extended vehicle (ExVe) web services - Content and definitions

Current

Published:

31 Dec 2021