scms-policy.asn

-- 
--  Copyright 2017 Crash Avoidance Metrics Partner, VSC5 Consortium
-- 
--  Licensed under the Apache License, Version 2.0 (the "License");
--  you may not use this file except in compliance with the License.
--  You may obtain a copy of the License at
-- 
--     http://www.apache.org/licenses/LICENSE-2.0
-- 
--  Unless required by applicable law or agreed to in writing, software
--  distributed under the License is distributed on an "AS IS" BASIS,
--  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
--  See the License for the specific language governing permissions and
--  limitations under the License.
-- 
-- @namespace Ieee1609dot2ScmsPolicyTypes 
Ieee1609dot2ScmsPolicyTypes {iso(1) identified-organization(3) ieee(111)
standards-association-numbered-series-standards(2) wave-stds(1609)  dot2(2)
scms (2) interfaces(1) policy-types (500)}

DEFINITIONS AUTOMATIC TAGS ::= BEGIN

EXPORTS ALL;

IMPORTS

    Countersignature,
    ExplicitCertificate,
    Ieee1609Dot2Data,
    SequenceOfCertificate

FROM IEEE1609dot2 {iso(1) identified-organization(3) ieee(111)
standards-association-numbered-series-standards(2) wave-stds(1609)
dot2(2) base (1) schema (1)}

    Duration,
    Hostname,
    Opaque,
    Time64,
    Uint8,
    Uint16,
    Uint32,
    Uint64

FROM IEEE1609dot2BaseTypes {iso(1) identified-organization(3) ieee(111)
standards-association-numbered-series-standards(2) wave-stds(1609)
dot2(2) base(1) base-types(2)}

    LaHostnameId,
    PcaHostnameId,
    RaHostnameId

FROM Ieee1609dot2ScmsBaseTypes {iso(1) identified-organization(3) ieee(111)
standards-association-numbered-series-standards(2) wave-stds(1609)  dot2(2)
scms (2) interfaces(1) base-types (2)}

;

---
-- @brief The PolicyFiles structure defines the parent structure for all 
--        policy files (GCCF & LCCF). Each policy file resides in its own file
--        and its signed by one or more components. to ensure the policy is
--        valid.
-- @class PolicyFiles 
-- @param globalPolicyFile contains the global policy file generated by Policy
--                         Generator (PG).
-- @param localPolicyFile  contains the local policy file genrated by a
--                         Registration Authority (RA). Note that RA has to
--                         get this signed by PG before sending to EEs.
PolicyFiles ::= CHOICE {
    globalPolicyFile GlobalPolicyFile,
    localPolicyFile LocalPolicyFile,
    ...
}

---
-- @brief This data type defines the inherent policy file structure created
--        either by PG or RA.
-- @class BasePolicyFile 
-- @param version    defines the version of BasePolicyFile. Currently, it is
--                   denoted by integer 1.
-- @param tbsData    is the policy data that is signed by PG at the scms
--                   protocol level.
-- @param signatures denote the counter signatures that are generated by
--                   auditors of the policy file. Note that PG or RA must
--                   obtain these signatures before sending to any EE.
-- @see Uint8, Countersignature
BasePolicyFile ::= SEQUENCE {
    version Uint8(1),
    tbsData ToBeSignedPolicyData,
    -- countersignatures generated by auditors of the policy file
    signatures SEQUENCE SIZE(1..MAX) OF Countersignature,
    ...
}

---
-- @brief This data type contains the policy file data that is signed by the
--        PG at scms-protocol level.
-- @class ToBeSignedPolicyData 
-- @param policyID denotes the unique identifier for a policy file.
-- @param generationTime is the point of time when a policy file was generated.
-- @param activeTime     is the duration of time for which the policy file is
--                       valid.
-- @param policy         is the policy data for either global, local or custom
--                       file.
-- @see Time64
ToBeSignedPolicyData ::= SEQUENCE {
    policyID OCTET STRING (SIZE (0..32)),
    generationTime Time64,
    activeTime Time64,
    policy Policy,
    ...
}

---
-- @brief This data type is generated by PG and contains global policy data.
-- @class GlobalPolicyFile 
-- @param tbsData is the policy data that is signed by PG at scms-protocol level.
GlobalPolicyFile ::= BasePolicyFile (WITH COMPONENTS {...,
    tbsData( WITH COMPONENTS {...,
        policy(WITH COMPONENTS {...,
            global PRESENT
        })
    })
})

---
-- @brief This data type is generated by an RA and contains local policy data
--        derived from global policy data.
-- @class LocalPolicyFile 
-- @param globalParameters denotes all the values inherited from
--                         GlobalPolicyFile.
-- @param localParameters  denotes all values defined by RA for local policy
--                         file specifically.
LocalPolicyFile ::= SEQUENCE {
    globalParameters BasePolicyFile (WITH COMPONENTS {...,
        tbsData( WITH COMPONENTS {...,
            policy( WITH COMPONENTS {...,
                custom PRESENT
            })
        })
    }),

    localParamters BasePolicyFile (WITH COMPONENTS {...,
        tbsData( WITH COMPONENTS {...,
            policy( WITH COMPONENTS {...,
                local PRESENT
            })
        })
    })
}

---
-- @brief This data type contains policy file data depending on the type of
--        policy file i.e. global, local or custom.
-- @class Policy 
-- @param global denotes global policy data.
-- @param custom denotes custom policy data.
-- @param local denotes local policy data.
Policy ::= CHOICE {
    global  GlobalPolicyData,
    custom  CustomPolicyData,
    local   LocalPolicyData,
    ...
}

---
-- @brief This data type contains global policy data generated by PG.
-- @class GlobalPolicyData 
-- @param temporalSeriesOfScmsVersion                 SCMS Version, default value is 1
-- @param temporalSeriesOfCertChainFileID             File ID number of the current GCCF
-- @param temporalSeriesOfOverdueCrlTolerance         max time to operate without a new
--                                                    CRL, specified in weeks (4 bytes)
-- @param temporalSeriesOfIPeriod                     i-value / i-period; default: 1 week
-- @param temporalSeriesOfMinCertsPerIPeriod          minimum certs per i-period; default: 20
-- @param temporalSeriesOfCertValidityModel           pseudonym cert validity model -
--                                                    "concurrent" or "non-concurrent"
-- @param temporalSeriesOfMaxAvailableCertSupply      max time covered by a certificate
--                                                    batch in years, default: 3 years
-- @param temporalSeriesOfMaxCertRequestAge           maximum time for individual cert
--                                                    request; to remain in aggregator;
--                                                    default: 2 days
-- @param temporalSeriesOfShuffleThreshold            minimum # of individual cert requests
--                                                    before shuffle/send to PCA; default: 1000
-- @param temporalSeriesOfHashOfRequestSize           bytes in "hash of request" between
--                                                    PCA and RA for individual cert requests; default: 32
-- @param temporalSeriesOfMaxGpfGccfRetrievalInterval maximum interval (in hours) before
--                                                    retreiving new GPF or GCCF; default: 1 hour
-- @param temporalSeriesOfRseApplicationCertValidity  validity time for an RSE cert (in hours)
--                                                    Default value is 1 week + 1 hour = 168 hours
-- @param temporalSeriesOfRseApplicationCertOVerlap   RSE application cert overlap; Default value is 1 hour
-- @see Time64
GlobalPolicyData ::= SEQUENCE {
    temporalSeriesOfScmsVersion SEQUENCE {
        initialScmsVersion ScmsVersion DEFAULT 1,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            scmsVersion ScmsVersion
        }
    } OPTIONAL,

    temporalSeriesOfCertChainFileID SEQUENCE {
        initialGlobalCertChainFileID GlobalCertChainFileID,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            globalCertChainFileID GlobalCertChainFileID
        }
    } OPTIONAL,

    temporalSeriesOfOverdueCrlTolerance SEQUENCE {
        initialOverdueCrlTolerance OverdueCrlTolerance,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            overdueCrlTolerance OverdueCrlTolerance
        }
    } OPTIONAL,

    temporalSeriesOfIPeriod SEQUENCE {
        initialIPeriod IPeriod,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            iPeriod IPeriod
        }
    } OPTIONAL,

    temporalSeriesOfMinCertsPerIPeriod SEQUENCE {
        initialMinCertsPerIPeriod MinCertsPerIPeriod DEFAULT 20,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            minCertsPerIPeriod MinCertsPerIPeriod
        }
    } OPTIONAL,

    temporalSeriesOfCertValidityModel SEQUENCE {
        initialCertValidityModel CertValidityModel,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            certValidityModel CertValidityModel
        }
    } OPTIONAL,

    temporalSeriesOfMaxAvailableCertSupply SEQUENCE {
        initialMaxAvailableCertSupply MaxAvailableCertSupply,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            maxAvailableCertSupply MaxAvailableCertSupply
        }
    } OPTIONAL,

    temporalSeriesOfMaxCertRequestAge SEQUENCE {
        initialMaxCertRequestAge MaxCertRequestAge,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            maxCertRequestAge MaxCertRequestAge
        }
    } OPTIONAL,

    temporalSeriesOfShuffleThreshold SEQUENCE {
        initialShuffleThreshold ShuffleThreshold DEFAULT 1000,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            shuffleThreshold ShuffleThreshold
        }
    } OPTIONAL,

    temporalSeriesOfHashOfRequestSize SEQUENCE {
        initialHashOfRequestSize HashOfRequestSize DEFAULT 32,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            hashOfRequestSize HashOfRequestSize
        }
    } OPTIONAL,

    temporalSeriesOfMaxGpfGccfRetrievalInterval SEQUENCE {
        initialMaxGpfGccfRetrievalInterval MaxGpfGccfRetrievalInterval,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
	    startTime Time64,
	    maxGpfGccfRetrievalInterval MaxGpfGccfRetrievalInterval
        }
    } OPTIONAL,

    temporalSeriesOfRseApplicationCertValidity SEQUENCE {
        initialRseApplicationCertValidity RseApplicationCertValidity,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            rseApplicationCertValidity RseApplicationCertValidity
        }
    } OPTIONAL,

    temporalSeriesOfRseApplicationCertOVerlap SEQUENCE {
    initialRseApplicationCertOverlap RseApplicationCertOverlap,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            rseApplicationCertOverlap RseApplicationCertOverlap
	}
    } OPTIONAL,	

    ...
}

---
-- @brief This data type defines the current scms version.
-- @class ScmsVersion 
ScmsVersion ::= Uint8                   

---
-- @brief This data type denotes the 16-byte global certificate chain ID.
-- @class GlobalCertChainFileID 
GlobalCertChainFileID ::= Uint16

---
-- @brief This data type denotes the maximum time to operate without a new CRL,
--        specified in weeks (4 bytes)
-- @class OverdueCrlTolerance 
OverdueCrlTolerance ::= Duration        

---
-- @brief This data type denotes the i-value / i-period; default
-- @class IPeriod 
IPeriod ::= Duration                    

---
-- @brief This data type denotes the minimum certs per i-period
-- @class MinCertsPerIPeriod 
MinCertsPerIPeriod ::= Uint8            

---
-- @brief This data type denotes the pseudonym cert validity model - 
--        concurrent" or "non-concurrent"
-- @class CertValidityModel
-- @param concurrent     denotes the certificate can be used with other active
--                       certificates.
-- @param non-concurrent denotes the certificate cannot be used with other
--                       active certificates.
CertValidityModel ::= ENUMERATED {
    concurrent      (1),
    non-concurrent  (2),
    ...
}

---
-- @brief This data type denotes the maximum time covered by a certificate
--        batch in years.
-- @class MaxAvailableCertSupply 
MaxAvailableCertSupply ::= Duration

---
-- @brief This data type denotes the maximum time for individual certificate
--        request.
-- @class MaxCertRequestAge 
MaxCertRequestAge ::= Duration          

---
-- @brief This data type denotes the minimum number of individual certificate
--        requests before shuffle/send to PCA.
-- @class ShuffleThreshold 
ShuffleThreshold ::= Uint32             

---
-- @brief This data type denotes the number of bytes in "has of request"
--        between PCA and RA for indicidaul certificate requests.
-- @class HashOfRequestSize 
HashOfRequestSize ::= Uint8            

---
-- @brief This data type denotes the maximum interval (in hours) before
--        retrieving new GPF and GCCF.
-- @class MaxGpfGccfRetrievalInterval 
MaxGpfGccfRetrievalInterval ::= Duration

---
-- @brief This data type denotes the validity time for an RSE certificate (in
--        hours).
-- @class RseApplicationCertValidity 
RseApplicationCertValidity ::= Duration

---
-- @brief This data type denotes the RSE certificate overlap period (in hours).
-- @class RseApplicationCertOverlap 
RseApplicationCertOverlap ::= Duration

---
-- @brief This type is used by an RA that wants to create a custom version of 
--        the GlobalPolicyData. This structure adds an element with the RA's 
--        ID to differentiate it from a conventional GlobalPolicyFile.  
-- @class CustomPolicyData 
-- @param requestingRaHostname is the 256-bit unique hostname of the RA
--                             requesting custom policy data.
-- @param globalPolicy         is the global policy file data.
-- @see RaHostnameId
CustomPolicyData ::= SEQUENCE {
    requestingRaHostname RaHostnameId OPTIONAL,
    -- Hostname of the RA that customized this policy data
    globalPolicy GlobalPolicyData,
    ...
}

---
-- @brief This data type contains local policy data generated by RA from
--        global policy data derived from GPF of PG.
-- @class LocalPolicyData 
-- @param temporalSeriesOfShuffleThreshold        minimum # of individual cert
--                                                requests before shuffle/send
--                                                to PCA.
-- @param temporalSeriesOfCertsPerIPeriod         certs per i-period.
--                                                overrides global value);
--                                                default: 20
-- @param temporalSeriesOfLaOneHost               LA1 256-bit unique hostname.
-- @param temporalSeriesOfLaTwoHost               LA2 256-bit unique hostname.
-- @param temporalSeriesOfPcaHost                 PCA 256-bit unique hostname.
-- @param temporalSeriesOfRaX509TlsCert           RA TLS certificate for
--                                                connection over HTTP.
-- @param temporalSeriesOfLaX509TlsCert           LA TLS certificate.
-- @param temporalSeriesOfPcaX509TlsCert          PCA TLS certificate.
-- @param temporalSeriesOfSharedKeyUpdateInterval maximum time between changes
--                                                to pre-linkage value enc/dec
--                                                key.
-- @see Time64, LaHostnameId, RaHostnameId, PcaHostnameId
LocalPolicyData ::= SEQUENCE {
    temporalSeriesOfShuffleThreshold SEQUENCE {
        initialShuffleThreshold ShuffleThreshold,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            shuffleThreshold ShuffleThreshold
        }
    } OPTIONAL,
    temporalSeriesOfCertsPerIPeriod SEQUENCE {
        initialCertsPerIPeriod CertsPerIPeriod DEFAULT 20,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            certsPerIPeriod CertsPerIPeriod
        }
    } OPTIONAL,
    temporalSeriesOfLaOneHost SEQUENCE {
        initialLaOneHost LaHostnameId,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            laOneHost LaHostnameId
        }
    } OPTIONAL,
    temporalSeriesOfLaTwoHost SEQUENCE {
        initialLaTwoHost LaHostnameId,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            laTwoHost LaHostnameId
        }
    } OPTIONAL,
    temporalSeriesOfPcaHost SEQUENCE {
        initialPcaHost PcaHostnameId,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            pcaHost PcaHostnameId
        }
    } OPTIONAL,
    temporalSeriesOfRaX509TlsCert SEQUENCE {
        initialRaX509TlsCert X509TlsCert,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            raX509TlsCert X509TlsCert
        }
    } OPTIONAL,
    temporalSeriesOfLaX509TlsCert SEQUENCE {
        initialLaX509TlsCert X509TlsCert,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            laX509TlsCert X509TlsCert
        }
    } OPTIONAL,
    temporalSeriesOfPcaX509TlsCert SEQUENCE {
        initialPcaX509TlsCert X509TlsCert,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            pcaX509TlsCert X509TlsCert
        }
    } OPTIONAL, 
    temporalSeriesOfSharedKeyUpdateInterval SEQUENCE {
        initialSharedKeyUpdateInterval SharedKeyUpdateInterval,
        intervals SEQUENCE SIZE(0..MAX) OF SEQUENCE {
            startTime Time64,
            sharedKeyUpdateInterval SharedKeyUpdateInterval
        }
    } OPTIONAL,
    ...
}

---
-- @brief This data type denotes the certificates per i-period. This overrides
--        the global value.
-- @class CertsPerIPeriod
CertsPerIPeriod ::= Uint8                

---
-- @brief This data type denotes the TLS certificate for secure communication
--        over HTTP.
-- @class X509TlsCert 
X509TlsCert ::= Opaque

---
-- @brief This data type denotes the maximum time between changes to pre
--        linkage value encryption/decryption key.
-- @class SharedKeyUpdateInterval 
SharedKeyUpdateInterval ::= Duration    


END