Overview
ISO 20078-3:2021 - "Road vehicles - Extended vehicle (ExVe) web services - Part 3: Security" specifies how to secure ExVe web-service interfaces. It defines authentication of resource owners, how accessing parties obtain delegated access to vehicle-related resources, and the required roles and separation of duties to meet security, data privacy and data protection requirements. The standard frames these roles against a reference implementation based on OAuth 2.0 and OpenID Connect 1.0 compatible frameworks.
Key topics and technical requirements
- Authentication and identity management
- Identity provider authenticates resource owners and manages profiles (REQ_05_01_01 - REQ_05_01_04).
- Resource owner credentials are known only to the identity provider.
- Identity provider issues identity tokens (ID tokens) as digitally signed JWTs.
- Authorization and delegation
- Authorization provider manages access policies and issues scoped authorizations to accessing parties (REQ_05_01_05 - REQ_05_01_11).
- Only a resource owner can grant or revoke access; access may be direct or via containers (REQ_05_01_10 - REQ_05_01_14).
- Authorization provider must trust identity confirmation from the identity provider (REQ_05_01_07).
- Resource access control
- Resource provider enforces access control according to the authorization policy (REQ_05_01_19).
- Support for both request/reply and push communication methods; push introduces dual authorization domains.
- Separation of duties
- Clear role boundaries: identity provider, authorization provider, resource provider (REQ_05_01_20 - REQ_05_01_25).
- Identity provider must not influence authorization policy or access resources; authorization provider must not access resource owner profiles or resources.
- Operational processes & conditions
- Offering party responsibilities: register resource owners, register accessing parties, verify vehicle eligibility and resource ownership (REQ_04_01_x).
- Revocation and restrictions: offering or accessing parties may restrict or revoke access to satisfy security or legal requirements (REQ_04_02_x).
Applications and who uses it
ISO 20078-3 is relevant for:
- Automotive OEMs and telematics providers implementing ExVe web services
- API architects and backend engineers building vehicle data platforms
- Identity and access management (IAM) teams designing OAuth/OpenID Connect integrations
- Cybersecurity, privacy and compliance teams ensuring data protection and role separation
- Third-party service providers and app developers seeking delegated access to vehicle resources
Practical use cases include secure telematics data sharing, third‑party diagnostic apps, and controlled push of vehicle events to authorized services.
Related standards
- ISO 20078-1 (Content and definitions) - normative reference for terms and content structure.
- OAuth 2.0 and OpenID Connect 1.0 - referenced for the reference implementation and token flows.
Keywords: ISO 20078-3, Extended vehicle, ExVe, web services security, OAuth 2.0, OpenID Connect, authentication, authorization, resource owner, identity provider, authorization provider, separation of duties, vehicle data privacy.
