1. Authorization Architecture Discussion Group Name: SEC WG Source: Seongyoon Kim, LG Electronics, seongyoon.kim@lge.com Meeting Date: 28 MAY, 2014 Agenda Item: TBD

2. Introduction Discussion on PIP, PAP and PDP Whether it is possible them to be the same entity © 2013 oneM2M Partners 2

3. Current SEC Specification © 2013 oneM2M Partners 3 We decided not to separate PIP, PAP and PDP. “NOTE: Release 1 does not support separation of PAP and PIP on different CSE from PDP.” However, Through my observation in ARC TS and SEC contribution, it is not feasible.

4. PIP Case © 2013 oneM2M Partners 4 In description of accessControlPolicyIDs attribute “If a resource type does have an accessControlPolicyIDs attribute definition, but the (optional) accessControlPolicyIDs attribute is not set, or it is set to a value that does not correspond to a valid, existing resource, or it refers to an resource that is not reachable (e.g. because it is located on a remote CSE that is offline or not reachable), then the system default access permissions shall apply.”  ARC TS considers the separation of PDP and PIP.

5. PAP Case © 2013 oneM2M Partners 5 Due to Location contexts, PDP need to retrieve location information of originator.  separation of PDP and PAP happens Location Hosting CSE (PAP) PDP AE (Originator) PEP Request Access Control Decision Request Location Request Access Control Decision Response Response

6. Summary © 2013 oneM2M Partners 6 PDP, PIP, and PAP need to be separated. We need to remove the limit “NOTE: Release 1 does not support separation of PAP and PIP on different CSE from PDP.”

7. PEP = PDP Discussion © 2013 oneM2M Partners 7 The fact that PEP and PDP are in the same point is very obvious. Hosting CSE works as PEP and PDP Hosting CSE gets all the needed information (e.g., access control policy, m2m service subscription, attributes of originator, etc.) Hosting CSE make access control decision

8. PEP != PDP Discussion © 2013 oneM2M Partners 8 PEP and PDP are separated As I mentioned in previous pages, PDP may not be PIP and PAP. Then who is PDP when PEP and PDP are separated? Always IN-CSE?

9. Conclusion © 2013 oneM2M Partners 9 PDP may not work as PIP and PAP Who is PDP, when PDP and PEP are separated, needs further discussion