1. Introducing User’s Role concept Group Name: WG2(ARC) and WG4(SEC) Source: Shingo Fujimoto, FUJITSU, shingo_fujimoto@jp.fujitsu.com Meeting Date: 2013-10-17 Agenda Item: Access Control

2. Introduction Role-Based Access Control had discussed with collaborating WG2 and WG4 experts What is ‘Role’ is still not clear This contribution illustrates one view on the issue regarding concept of Role in M2M Service 2

3. oneM2M-ARC-2013-0457R01-User_Role_Concept Role-based Access Control In RBAC, Activity will be controlled following permissions to given to specific ‘Role’ RBAC steps: – Define Role: Roles are defined as allowed Activities in specific context – Assign Role(s) for user Authorization is minimal requirement – Control Activity by assigned Role Access control is enforced by Role 3

4. oneM2M-ARC-2013-0457R01-User_Role_Concept Discussion What kind of Roles should be defined in M2M System ? Clarification on the model of delegation of Ownership The way forward … 4

5. oneM2M-ARC-2013-0457R01-User_Role_Concept Actors in M2M System Privileged Actor – Administrator: Responsible to keep system running (But no responsibility on data content) Normal Actors – Device Owner: full access to device and its data – Data Provider: partial access only to the data – Application: restricted access with authorization 5

6. oneM2M-ARC-2013-0457R01-User_Role_Concept Characteristics of Data in M2M DataUse of DataOwnerActorsNote Measured Value Collecting information for application Device Owner, Data Provider Device Owner, Application Provider, Application Raw data collected from M2M Device, Note: updating data is only allowed Owner Processed Data Information generated from ‘Measured Value’ Data ProviderDevice Owner, Application Provider, Application Device Settings Control the behavior of Device or Gateways Device OwnerDevice Owner, Administrator Settings are User Configurable Parameters Device Runtime Manage Device to keep it healthy Device OwnerDevice Owner, Administrator Firmware, Applications on Device 6

7. oneM2M-ARC-2013-0457R01-User_Role_Concept Example of RBAC Attr-A Attr-B Attr-C Attr-D Att-E Attr-A Attr-B Attr-C Attr-D Att-E Attr-A Attr-B Attr-C Attr-D Att-E Attr-A Attr-B Attr-C Attr-D Att-E AdministratorDevice OwnerApp-1 App-2 Cannot Create resource Hidden From App-1 Hidden From App-1 Hidden From App-2 Can anything but never do it 7

8. oneM2M-ARC-2013-0457R01-User_Role_Concept [FYI]Difference of RBAC with ACL ACL assigns the permission to data object “RBAC differs from access control lists (ACLs), used in traditional discretionary access-control systems, in that it assigns permissions to specific operations with meaning in the organization, rather than to low level data objects. “ ACL does not support semantics: “The assignment of permission to perform a particular operation is meaningful” 8