Castell · SkyV2X

Misbehaviour · TS 103 759

Misbehaviour reporting
in C-ITS

Misbehaviour reporting is the part of C-ITS PKI where the trust framework reacts to receivers that detect attackers, faulty stations or implementations gone wrong. ETSI TS 103 759 specifies the report formats and the authority that consumes them. Castell runs one.

Misbehaviour report submission and acknowledgement flow Reporter vehicle with AT observed misbehaviour builds a signed MR MA misbehaviour authority 7F86BAC4F35D6505 verifies outer sig vs AA assigns report ID bumps mr_received_total Audit trail append-only log {id, reporter, cause} signed by MA POST MR ack signed persist
How a report reaches the MA and is acknowledged.

What ETSI TS 103 759 specifies

TS 103 759 (current version v2.2.1) defines the Misbehaviour Reporting framework for C-ITS. It sets out who can submit a report, what the report contains, how the receiving authority (the Misbehaviour Authority, MA) authenticates the submitter, and how the resulting evidence is structured for downstream forensic or revocation use.

A report is a single EtsiTs103759Mbr structure. It carries the reporter's own pseudonym cert, the identity of the station being reported, and evidence. The evidence can be the reporter's own observations (an enumerated reason such as a plausibility failure, a replay, or a signature that did not verify) and/or the offending PDU itself, wrapped as an ASR (Application Specific Report) so the MA can re-verify the original SignedData independently. A single report can hold both.

How Castell's MA works

Castell exposes a Misbehaviour Authority at HashedId8 7F86BAC4F35D6505. The MA cert is downloadable at GET /ma, served as COER-encoded bytes under application/octet-stream. Submitters pin this cert to verify acknowledgements signed by the MA.

Reports are submitted as IEEE 1609.2 messages addressed to the MA's HashedId8. Per TS 103 759 §7.2 a report is signed and encrypted (ECIES to the MA's encryption key). Castell accepts both the encrypted-and-signed form (spec-strict) and signed-only (a testbed convenience). The MA decrypts if needed, validates the outer signature (the reporter must hold a valid AT cert issued by a Castell AA), parses the report payload, and records the entry in an audit trail.

# MA cert fetch
curl -sS https://pki.skyv2x.com/ma -o ma.coer
wc -c ma.coer
# ~189 bytes (TS 103 097 explicit cert, NIST P-256)

# Counters of received reports are exposed live
curl -sS https://pki.skyv2x.com/status.json | jq .counters.mr_received_total

What Castell currently does, and what it doesn't yet

Castell accepts reports with or without attached ASR evidence today. The outer signature is verified against the issuing AA. The report enters the audit log and bumps the mr_received_total counter regardless of whether the inner ASR payload can be fully strict-decoded.

Inner ASR payload strict decode (parsing AsrCam / AsrDenm evidence per the ETSI ASN.1 Information Object Class definitions of TS 103 759) is not implemented in Castell yet. It is on the roadmap. Reports submitted today are accepted at the envelope level, and inner payload introspection is best-effort. See the changelog for status.

Submitting a report

Reports are POSTed as IEEE 1609.2 signed envelopes. The endpoint, full schema and a minimal Python example are in the integration walkthrough. Briefly:

  1. You already hold an AT cert issued by Castell. If not, see the integration walkthrough for the EC→AT flow.
  2. Build the report payload: observations (a cause code) and/or the signed message you want to report, wrapped as an ASR.
  3. Sign the report with your AT private key, addressed to MA HashedId8 = 7F86BAC4F35D6505.
  4. POST the resulting envelope to the MA endpoint. The MA responds with a signed acknowledgement carrying the report's assigned ID.
  5. Verify the ack signature against the pinned MA cert. Persist the report ID for any follow-up.

Why misbehaviour reporting exists

In C-ITS, every vehicle gets a pseudonym cert every few minutes. There is no continuous identity binding to a human or a VIN. Attributing a misbehaving station means the report has to reach an authority that can correlate pseudonyms back to enrolments. Only the EA holds that linkage, and only on the basis of a report it considers credible.

The MR/MA protocol is how that credible evidence reaches the EA. Without it, a station could spam the network with invalid CAMs indefinitely. With it, repeated reports drive the EA to revoke the offending enrolment, after which no further AT certs are issued and the station can no longer participate.

Related material