SNIP_CLASSIC_SECOCPROTOCOL_SECTION_5_1_3_Verification_of_I_PDUs

5.1.3 Verification of I-PDUs [PRS_SecOc_00300] ⌈The verification of a Secured I-PDU consists of the following six steps: 1. Parse Authentic I-PDU, Freshness Value and Authenticator 2. Get Freshness Value from Freshness Manager 3. Construct Data to Authentication 4. Verify Authentication Information 5. Send Confirmation to Freshness Manager 6. Pass Authentic I-PDU to upper layer ⌋(RS_Main_00510) [PRS_SecOc_00301] ⌈For every processed Secured I-PDU within SecOC an authentication build counter and an authentication verify attempt counter shall be maintained.⌋(RS_Main_00510) [PRS_SecOc_00302] ⌈Upon the initial processing of a received Secured I-PDU , the authentication build counter and the authentication verify attempt counter shall be set to 0.⌋(RS_Main_00510) [PRS_SecOc_00303] ⌈If the query of the freshness value for the received PDU does not return a result (example: a new freshness value could not be provided) the authentication build counter shall be incremented and no attempt for verification of authentication shall be executed.⌋(RS_Main_00510) [PRS_SecOc_00304] ⌈If the verification of the authenticator returns a recoverable error (example: crypto stack is busy), the authentication build counter shall be incremented.⌋(RS_Main_00510) Protocol [PRS_SecOc_00305] ⌈If the authentication build attempts have failed and the authentication build counter has not yet reached the configuration value , the freshness attempt and the Authenticator verification shall be retried in the next call to the Rx main function.⌋(RS_Main_00510) [PRS_SecOc_00306] ⌈If the verification of the Authenticator could be successfully executed but the verification failed (e.g. the MAC verification has failed or the key was invalid), the authentication verify attempt counter shall be incremented and the authentication build counter shall be set to 0.⌋(RS_Main_00510) Note: Resetting the authentication build counter shall prevent to drop the authentication process too early even though authentication verify attempts are still possible. [PRS_SecOc_00307] ⌈If the authentication build counter has reached the configuration value SecOCAuthenticationBuildAttempts the SecOC module shall remove the Authentic I-PDU from its internal buffer and shall drop the received message. The VerificationResultType shall be set to SECOC_AUTHENTICATIONBUILDFAILURE. If SecOC_VerifyStatusOverride is used, the verification result and I-PDU are handled according to overrideStatus value.⌋(RS_Main_00510) [PRS_SecOc_00308] ⌈If the query of the freshness function returns a non-recoverable error (example: a systematic failure due to freshness value configuration ) the SecOC module shall remove the Authentic I-PDU from its internal buffer and shall drop the received message. The VerificationResultType shall be set to SECOC_FRESHNESSFAILURE.⌋() [PRS_SecOc_00309] ⌈If the authentication verify attempt counter has reached the configuration value SecOCAuthenticationVerifyAttempts or the verification of the Authenticator has returned a non-recoverable error (example: a systematic error due to a not configured key) the SecOC module shall remove the Authentic I-PDU from its internal buffer and shall drop the received message. The VerificationResultType shall be set to SECOC_VERIFICATIONFAILURE. If SecOC_VerifyStatusOverride is used, the verification result and I-PDU are handled according to overrideStatus value.⌋(RS_Main_00510) [PRS_SecOc_00310] ⌈If the verification of the Authenticator was successful, the VerificationResultType shall be set to SECOC_VERIFICATIONSUCCESS.⌋(RS_Main_00510) [PRS_SecOc_00311] ⌈The Freshness Management shall use the verification status callout function to get the result of the verification of a Secured I-PDU. This notification can be used as example to synchronize additional freshness attempts or can be used for counter increments.⌋(RS_Main_00510) Note: SecOC allows to overwrite the status. Therefore, care must be taken if the Freshness Management relies on the status callout while status overwrite function is also used. This can lead to conflicts in the Freshness Management and may lead to incorrect freshness values. Protocol [PRS_SecOc_00312] ⌈If the Rx freshness request function returns a non-recoverable error (example: a systematic failure due to freshness value configuration) the verification of an Authentic I-PDU is considered to be failed and the authentication retry counter for this PDU shall be incremented. If the number of authentication attempts has reached SecOCAuthenticationVerifyAttempts, the SecOC module shall remove the Authentic I-PDU from its internal buffer. The failure SEC- OCE_RE_FRESHNESS_FAILURE shall be reported.⌋(RS_Main_00510) [PRS_SecOc_00313] ⌈If SecOCRxSecuredPduCollection is used, then SecOC shall not perform any verification until it has received both the Authentic I-PDU and Cryptographic I-PDU which make up the Secured I-PDU. Only after both have been received SecOC shall attempt to verify the resulting Secured I-PDU. If SecOC_VerifyStatusOverride is used, the verification result and I-PDU are handled according to overrideStatus value.⌋(RS_Main_00510) Note: This applies to all instances when a Secured I-PDU is received by SecOC from the lower layer, which happens in parts as described above when SecOCRxSecuredPduCollection is used. There is no further distinction made throughout this document to avoid duplication and clutter. [PRS_SecOc_00314] ⌈If SecOCRxSecuredPduCollection is used then SecOC shall not attempt to verify the Secured I-PDU until it has received and buffered an Authentic I-PDU and Cryptographic I-PDU with matching Message Linker values. If SecOC_VerifyStatusOverride is used, the verification result and I-PDU are handled according to overrideStatus value.⌋(RS_Main_00510) Note: If If SecOCUseMessageLink has 0 multiplicity, it means If SecOCMessageLinkLen is 0 and that Message Linker Values are always matching. [PRS_SecOc_00315] ⌈Upon reception of a Secured I-PDU, SecOC shall parse the Authentic I-PDU, the Freshness Value and the Authenticator from it.⌋(RS_Main_00510) [PRS_SecOc_00316] ⌈The SecOC module shall construct the data that is used to calculate the Authenticator (DataToAuthenticator) on the receiver side. This data is comprised of SecOCDataId | AuthenticIPDU | FreshnessVerifyValue.⌋(RS_Main_00510) [PRS_SecOc_00317] ⌈The SecOC module shall verify the Authenticator by passing DataToAuthenticator, length of DataToAuthenticator, the Authenticator parsed from Secured I-PDU, and SecOCAuthInfoTruncLength into the authentication algorithm corresponding to configured cryptographic service. If SecOC_VerifyStatusOverride is used, the verification result and I-PDU are handled according to overrideStatus value.⌋(RS_Main_00510) Protocol Figure 5.3: Verification of MAC [PRS_SecOc_00318] ⌈The SecOC module shall report each individual verification status (the final one as well as all intermediate ones) according to its current configuration (see parameter SecOCVerificationStatusPropagationMode).⌋(RS_Main_- 00510) Note: If the Freshness Manager requires the status of a Secured I-PDU if it was verified successfully or not, e.g. to synchronize time or counter, then this status shall be taken from the VerificationStatus service provided by SecOC.