Council Regulation (EEC) No 3821/85Show full title

[F1 [F2 3. Product Rationale U.K.

3.1. Tachograph card description and method of use U.K.

A tachograph card is a smart card, as described in (IC PP) and (ES PP), carrying an application intended for its use with the recording equipment.

The basic functions of the tachograph card are:

• to store card identification and card holder identification data. These data are used by the vehicle unit to identify the cardholder, provide accordingly functions and data access rights, and ensure cardholder accountability for his activities,

• to store cardholder activities data, events and faults data and control activities data, related to the cardholder.

A tachograph card is therefore intended to be used by a card interface device of a vehicle unit. It may also be used by any card reader (e.g. of a personal computer) which shall have full read access right on any user data.

During the end-usage phase of a tachograph card life cycle (phase 7 of life-cycle as described in (ES PP)), vehicle units only may write user data to the card.

The functional requirements for a tachograph card are specified in Annex I B body text and Appendix 2.

3.2. Tachograph card life cycle U.K.

The tachograph card life cycle conforms to smart card life cycle described in (ES PP).

3.3. Threats U.K.

In addition to the smart card general threats listed in (ES PP) and (IC PP), the tachograph card may face the following threats:

3.3.1. Final aims U.K.

The final aim of attackers will be to modify user data stored within the TOE.

T.Ident_Data

A successful modification of identification data held by the TOE (e.g. the type of card, or the card expiry date or the cardholder identification data) would allow a fraudulent use of the TOE and would be a major threat to the global security objective of the system.

T.Activity_Data

A successful modification of activity data stored in the TOE would be a threat to the security of the TOE.

T.Data_Exchange

A successful modification of activity data (addition, deletion, modification) during import or export would be a threat to the security of the TOE.

3.3.2. Attack paths U.K.

TOE's assets may be attacked by:

• trying to gain illicit knowledge of TOE's hardware and software design and especially of its security functions or security data. Illicit knowledge may be gained though attacks to designer or manufacturer material (theft, bribery, …) or through direct examination of the TOE (physical probing, inference analysis, …),

• taking advantage of weaknesses in TOE design or realisation (exploit errors in hardware, errors in software, transmission faults, errors induced in TOE by environmental stress, exploit weaknesses of security functions such as authentication procedures, data access control, cryptographic operations, …),

• modifying the TOE or its security functions through physical, electrical or logical attacks or combination of these.

3.4. Security Objectives U.K.

The main security objective of the entire digital tachograph system is the following:

O.Main

The data to be checked by control authorities must be available and reflect fully and accurately the activity of controlled drivers and vehicles in terms of driving, work, availability and rest period and in terms of vehicle speed.

Therefore the main security objectives of the TOE, contributing to this global security objective are the following:

O.Card_Identification_Data

The TOE must preserve card identification data and cardholder identification data stored during card personalisation process,

O.Card_Activity_Storage

The TOE must preserve user data stored in the card by vehicle units.

3.5. Information technology security objectives U.K.

In addition to the smart card general security objectives listed in (ES PP) and (IC PP), the specific IT security objectives of the TOE that contributes to its main security objectives during its end-usage life-cycle phase are the following:

O.Data_Access

The TOE must limit user data write access rights to authenticated vehicle units,

O.Secure_Communications

The TOE must be able to support secure communication protocols and procedures between the card and the card interface device when required by the application.

3.6. Physical, personnel or procedural means U.K.

The physical, personnel or procedural requirements that contribute to the security of the TOE are listed in (ES PP) and (IC PP) (chapters security objectives for the environment).] ]

Textual Amendments

F1 Inserted by Council Regulation (EC) No 2135/98 of 24 September 1998 amending Regulation (EEC) No 3821/85 on recording equipment in road transport and Directive 88/599/EEC concerning the application of Regulations (EEC) No 3820/85 and (EEC) No 3821/85.

F2 Substituted by Commission Regulation (EC) No 1360/2002 of 13 June 2002 adapting for the seventh time to technical progress Council Regulation (EEC) No 3821/85 on recording equipment in road transport (Text with EEA relevance).