docs/Architecture-signed-its.drawio

<mxfile host="app.diagrams.net" type="device"><diagram id="signed-its" name="Signed ITS architecture"><mxGraphModel dx="1600" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="2150" pageHeight="850" math="0" shadow="0"><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="title" value="&lt;b&gt;MicrOBU: signed ITS-G5 (CAM / VAM) with the ESP32-C5 station&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px&quot;&gt;Signing happens on the ESP32-C5. The phone builds the messages and sends time, position and data over USB-C or BLE.&lt;/font&gt;" style="text;html=1;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=16;" vertex="1" parent="1"><mxGeometry x="330" y="0" width="1180" height="50" as="geometry"/></mxCell><mxCell id="k_demo" value="&lt;b&gt;Today: demo PKI (throwaway)&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px&quot;&gt;Demo Root 6E7D0374FB021901&lt;br&gt;→ Demo AA B3312F29844299E0&lt;br&gt;→ AT B80B49387A4C12EB&lt;br&gt;psid 36 (CAM, SSP 010000) + 638 (VAM, SSP 01)&lt;br&gt;Not EU-registered: EU verifiers drop it&lt;/font&gt;" style="rounded=1;whiteSpace=wrap;html=1;fontSize=11;arcSize=8;fillColor=#ffe6cc;strokeColor=#d79b00;" vertex="1" parent="1"><mxGeometry x="20" y="60" width="280" height="140" as="geometry"/></mxCell><mxCell id="k_real" value="&lt;b&gt;Future: real PKI (EU C-ITS CCMS)&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px&quot;&gt;ECTL / trust list&lt;br&gt;→ UML L0 Root CA (registered 2026-09-11,&lt;br&gt;   colleague repo: pki/uml-l0-rca)&lt;br&gt;→ Enrolment Authority (EA)&lt;br&gt;→ Authorization Authority (AA)&lt;br&gt;→ pool of ATs (pseudonyms, short validity,&lt;br&gt;   region + permissions)&lt;/font&gt;" style="rounded=1;whiteSpace=wrap;html=1;fontSize=11;arcSize=8;fillColor=#ffe6cc;strokeColor=#d79b00;dashed=1;" vertex="1" parent="1"><mxGeometry x="20" y="240" width="280" height="170" as="geometry"/></mxCell><mxCell id="k_paths" value="&lt;b&gt;How real credentials reach the board&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px&quot;&gt;(a) Offline: bundle file (VCR1) issued by the&lt;br&gt;    key holder → copied to the phone&lt;br&gt;(b) Online: TS 102 941 enrolment + authorization&lt;br&gt;    from the phone (ECIES, HTTP to EA/AA),&lt;br&gt;    renewing tickets before they expire&lt;br&gt;Both end in CREDENTIALS_PROVISION → NVS&lt;/font&gt;" style="rounded=1;whiteSpace=wrap;html=1;fontSize=11;arcSize=8;fillColor=#f5f5f5;strokeColor=#666666;fontColor=#333333;dashed=1;" vertex="1" parent="1"><mxGeometry x="20" y="450" width="280" height="150" as="geometry"/></mxCell><mxCell id="phone" value="&lt;b&gt;Phone app (Android, MicrOBU)&lt;/b&gt;" style="rounded=1;whiteSpace=wrap;html=1;verticalAlign=top;align=left;spacingLeft=10;spacingTop=4;fontSize=14;arcSize=3;container=1;collapsible=0;fillColor=#dae8fc;strokeColor=#6c8ebf;" vertex="1" parent="1"><mxGeometry x="330" y="60" width="470" height="640" as="geometry"/></mxCell><mxCell id="p_sens" value="&lt;b&gt;Sensors&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px&quot;&gt;GNSS (fused location) + IMU&lt;/font&gt;" style="rounded=1;whiteSpace=wrap;html=1;fontSize=11;arcSize=8;fillColor=#ffffff;strokeColor=#6c8ebf;" vertex="1" parent="phone"><mxGeometry x="15" y="40" width="210" height="50" as="geometry"/></mxCell><mxCell id="p_time" value="&lt;b&gt;GnssTimeSource&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px&quot;&gt;phone clock → GNSS time&lt;br&gt;keeps last error indoors&lt;/font&gt;" style="rounded=1;whiteSpace=wrap;html=1;fontSize=11;arcSize=8;fillColor=#ffffff;strokeColor=#6c8ebf;" vertex="1" parent="phone"><mxGeometry x="245" y="40" width="210" height="50" as="geometry"/></mxCell><mxCell id="p_pseu" value="&lt;b&gt;PseudonymManager&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px&quot;&gt;station ID + MAC, rotated together&lt;/font&gt;" style="rounded=1;whiteSpace=wrap;html=1;fontSize=11;arcSize=8;fillColor=#ffffff;strokeColor=#6c8ebf;" vertex="1" parent="phone"><mxGeometry x="245" y="105"