[authenticationProfile] <mgmtObj> specialization Group Name: SEC WG Source: Qualcomm Inc., Phil Hawkes, Wolfgang Granzow Meeting Date: SEC#25.1/MAS, 2016-11-21 Agenda Item: Device Configuration

Device Configuration and Security TS-0022 Device configuration defines the [registration] <mgmtObj> specialization Initial proposal was to include the security credentials in [registration] SEC participants objected, since TS-0003 defines (or is in the process of defining) other procedures for provisioning credentials, … …and are reluctant to use device management servers for this purpose without further investigation.

Current [registration] Attribute Name Request Optionality Data Type Default Value and Constraints Create Update Universal attributes, and following <mgmtObj> attributes not shown: mgmtDefinition, objectID, objectPaths, description originatorID O m2m:ID AE-ID or CSE-ID to be used on registration request. If the setting is for CSE, then this attribute shall be present. poA M Xs:anyURI The URI for point of acess address of registrar CSE. Protocol binding is determined from the protol in this URI. resourcePath The path of <CSEBase> resource to create <AE> or <remoteCSE> resource.

Proposed [registration] Attribute Name Request Optionality Data Type Default Value and Constraints Create Update Universal attributes, and following <mgmtObj> attributes not shown: mgmtDefinition, objectID, objectPaths, description originatorID O m2m:ID AE-ID or CSE-ID to be used on registration request. If the setting is for CSE, then this attribute shall be present. poA M xs:anyURI The URI for point of acess address of registrar CSE. Protocol binding is determined from the protol in this URI. resourcePath The path of <CSEBase> resource to create <AE> or <remoteCSE> resource. authProfileRef m2m:mgmtLinkRef Link to the [authenticationProfile] to be used for mutual authentication for this registration

Proposed [authenticationProfile] Attribute Name Request Optionality Data Type Notes Create Update Universal attributes, and following <mgmtObj> attributes not shown: mgmtDefinition, objectID, objectPaths, description symmKeyID O sec:credentialID Present when-Provisioned Symmetric Key SAEF is to be used with pre-provisioning mef sec:tefKeyRegCfg Present when Provisioned Symmetric Key SAEF is to be used with remote provisioning maf Used when MAF-based SAEF is to be used cert sec:certAuthnProfile (To be defined, see next slide) Present when Certificate-based SAEF is to be used Add attributes for domain/scope/usage. NOTE 1: Exactly one of the symmKeyID, mef, maf or cert elements shall be present Note: Can be extended to end-to-end security of primitives (ESPrim) with change to description

sec:certAuthnProfile Element Path Element Data Type Multiplicity Note deviceCertHash or deviceCertCredID xs:base64binary or sec:credentialID 0..1 SHA-256 hash of a DER-encoded certificate of the management target. Used when there is more than one certificate on the device. peerCertHash xs:base64binary SHA-256 hash of the DER-encoded certificate of the intended peer See Note. trustAnchor (anonymous) 0..n Present when a CA-issued certificate is used by peer. See Note. trustAnchor/hash 1 SHA-256 hash of the CA Certificate trustAnchor/uri URI URI from which the certificate can be retrieved by the management target NOTE: Either exactly one peerCertHash element is present, or at least one trustAnchor element is present. In the former case, the peer must present a certificate which hashes to the peerCertHash. In the latter case, the peer must present a certificate chain to one of the identified trust anchors Note: designed to be used for hop-by-hop security and end-to-end security of primitives (ESPrim)

Device credentials not included The [AuthenticationProfile] does not provision credentials authenticating the device. symmKeyID identifies a symmetric key, BUT assumes that symmetric key is already provisioned. mef (sec:tefKeyRegCfg) Details for requesting remote security provisioning by a MEF, BUT details for mutual authentication with MEF are expected to be configured separately. maf (sec:tefKeyRegCfg) Details for requesting MAF facilitates authentication BUT details for mutual authentication with MAF are expected to be configured separately. cert (sec:certAuthnProfile) Identifies a certificate of the Registree – but assumes it is already provisioned. Configures details for validating certificate of the Registrar (peer) We will continue working on the “other details”

Next Steps Configuring Credentials to Field Domain using Device Management Symmetric key Device/Node/AE/CSE Certificate Roots of trust for certificates? Agreement Security parameters in a separate MO, with link to that MO MAS would like to finalize TS-0022 at next F2F