1. Role Based Access Control In oneM2m
Group Name: Requirements Working Group
Source: Timothy Carey, Alcatel-Lucent,
Meeting Date:
Agenda Item: Requirements Working Group

2. Role Based Access Control
In Role Based Access Control (RBAC), permissions to access a resource is based on the Role (job function) of the requestor.
RBAC has been described by NIST:
This is similar to the user/group permission mechanism in a Unix OS
A group is basically composed of a set of users. The administrator can give that group Read, Write and Execute privileges to that group
For instance: the admin can create a group with all under-graduate students and grant that group read privilege to all under-graduate lecture (files)
An under-graduate student is therefore a ‘Role’
A specific user can be in multiple groups -> therefore have multiple roles

3. oneM2M RBAC
RBAC is expected to be used for the Services (e.g., Device Management) provided by the M2M Service Layer. Example roles for Device Management and Charging are:
Device Management Administration – Systems that maintain device management functionalities
Device Management Software Update – Systems that update software on the device
Device Management Technical Support – Systems that provide device troubleshooting
Charging Administration – Systems that maintain charging functionalities
Charging Recorder – Systems that record charging data
Charging Collector – Systems that collect charging data
Roles are given access permissions on resources associated with the Service
Device Management Software Update role might allow download, install, revert operations on application software within a device.
Device Management Technical Support role might allow reset and read operations for a device.

4. Roles to Service Subscription
Subscribers are associated with Services via Service Subscriptions:
Devices and Applications are associated with Service Subscriptions
Roles are associated with Service Subscriptions which provides access control to the associated devices and applications
Take for example:
Subscriber X subscribes to Device Management Service (Subscription1) for Smart Grid Applications
Device1 and Smart Grid Technical Support Application1 are associated with Subscription1
Role Device Management Technical Support is assigned to Smart Grid Technical Support Application1 in Subscription1

5. Role Based Translation
Role to Account Translation
Account to ACL Translation

6. Role to ACL Translation
Application requests an Operation
Smart Grid Technical Support Application1 requests a Reset operation in Device 1
M2M Service Layer Determines the DMS Account
Role for Smart Grid Technical Support Application1 for Reset Operation on Device 1 in Subscription 1 is Device Management Technical Support
DMS Account for Device Management Technical Support on Device 1 is Account1
DMS Translates Account to Device based ACL if necessary
Some DMSs will not need to translate but will have mechanisms to secure the clients within the DMS.

7. OMA-DM Server Delegation
OMA-DM Servers provide the capability to delegate control of resources within a OMA-DM Client
A Delegating DM Server controls access of a Delegated DM Server to resources within a DM Client via control of ACLs within the DM Client
The DM Client connects to multiple servers to both DM Servers

8. DM Server Delegation Translation
Network Operator represents the delegating DM-Server; the Service Provider represents the delegated DM-Server.
Access Control is enforced using the OMA-DM Delegation principles.