Device Schema Extensions to the SCIM model

Introduction The Internet of Things presents a management challenge in many dimensions. One of them is the ability to onboard and manage large number of devices. There are many models for bootstrapping trust between devices and network deployments. Indeed it is expected that different manufacturers will make use of different methods. SCIM (System for Cross Identity Management) defines a protocol and a schema for provisioning of users. However, it can easily be extended to provision devices. The protocol and core schema were designed to permit just such extensions. Bulk operations are supported. This is good because often devices are procured in bulk.

Why SCIM for devices? Some might ask why SCIM is well suited for this purpose and not, for example, NETCONF or RESTCONF with YANG. After all, there are all sorts of existing models available. The answer is that the only information being passed about the device is neither state nor device configuration information, but only information necessary to bootstrap trust so that the device may establish connectivity.

Protocol Participants In the normal SCIM model, it was presumed that large federated deployments would be SCIM clients who provision and remove employees and contractors as they are enter and depart those deployments, and federated services such as sales, payment, or conferencing services would be the servers. In the device model, the roles are reversed, and may be somewhat more varied. A deployment network management system gateway (NMS gateway) plays the role of the server, receiving information about devices that are expected to be connected to its network. That server will apply appropriate local policies regarding whether/how the device should be connected. The client may be one of a number of entities: A vendor who is authorized to add devices to a network as part of a sales transaction. This is similar to the sales integration sometimes envisioned by Bootstrapping Remote Key Infrastructure (BRSKI) . A client application that administrators or employees use to add, remove, or get information about devices. An example might be an tablet or phone app that scans Easyconnect QR codes.

Schema Description RFC 7643 does not prescribe a language to describe a schema. We have chosen the JSON schema language for this purpose. This implies that use of XML for this device extension is not supported. Several additional schemas specify specific onboarding mechanisms, such as BLE and Wifi Easy Connect.

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

The Device Schema The core device schema contains only those elements that any device may need. Not all elements are optional.

{ "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://json-schema.org/draft/2020-12/schema", "type": "object", "title": "SCIM zigbee device core schema", "required": [ "schemas", "id", "adminState", "connectivity", "meta" ], "properties": { "schemas": { "$id": "#/properties/schemas", "type": "array", "item": { "type": "string" }, "description": "This is a default attribute of SCIM which contains the list of schema URIs that are present in the SCIM JSON object. It contains URI of core schema and extension schema. It may also include URI for applications schema depending on use-case.", "examples": ["urn:ietf:params:scim:schemas:core:2.0:Device"] }, "id": { "$id": "#/properties/id", "type": "string", "title": "ID", "uniqueItems": true, "description": "It represents a unique device ID, formated as 128 bit UUID format. It provides a uniform way of uniquely identifying the device in the scope of the application.", "examples": ["e9e30dba-f08f-4109-8486-d5c6a3312345"], "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" }, "displayName": { "$id": "#/properties/displayName", "type": "string", "title": "Display Name", "description": "Human readable name of the device, suitable for displaying to end-users.", "examples": ["BLE Heart Monitor"] }, "adminState": { "$id": "#/properties/adminState", "type": "boolean", "title": "Admin State", "default": false, "description": "A mutable boolean value indicating the device administrative status. If set TRUE, the commands (such as connect, disconnect, subscribe) that control app sends to the controller for the devices will be processeed by the controller. If set FALSE, any command comming from the control app for the device will be rejected by the controller." }, "connectivity": { "$id": "#/properties/connectivity", "type": "array", "items": { "type": "string" }, "title": "Connectivity", "description": "It represents the communication technology supported by the device such as BLE, WiFi, LoRa, Zigbee.", "examples": ["BLE", "Zigbee"] }, "mudUrl": { "$id": "#/properties/mudurl", "type": "string", "format": "iri-reference", "title": "MUD URL", "description": "A URL to MUD file of the device (RFC 8520). It is added for future use. Current usage is not defined yet." } }, "meta": { "type": "object", "title": "MetaData", "required": [ "resourceType", "created", "lastModified", "version", "location" ], "properties": { "resourceType": { "type": "string", "title": "Resource type", "enum": ["Device"], "description": "The name of the resource type of the resource. This attribute has a mutability of readOnly.", "readOnly": true }, "created": { "type": "string", "format": "dateTime", "title": "Created", "description": "The DateTime that the resource was added to the service provider. This attribute MUST be a DateTime." }, "lastModified": { "type": "string", "format": "dateTime", "title": "Last modified", "description": "The most recent DateTime that the details of this resource were updated at the service provider. If this resource has never been modified since its initial creation, the value MUST be the same as the value of created." }, "version": { "type": "string", "title": "Version", "description": "The version of the resource being returned. This value must be the same as the entity-tag (ETag) HTTP response header (see Sections 2.1 and 2.3 of [RFC7232])." }, "location": { "type": "string", "format": "iri-reference", "title": "Location", "description": "The URI of the resource being returned. This value MUST be the same as the Content-Location HTTP response header (see Section 3.1.4.2 of [RFC7231])." } } } }

]]>


The Endpoint Extension Schema

Sometimes devices require and application gateway interface to manage
them.  This is the case with BLE and Zigbee non-IP devices.  SCIM
clients MUST NOT specify this to describe native IP-based devices.

The device schema is a base schema upon which specific onboarding
technology schemas are built.  It is described below.


{
    "urn:ietf:params:scim:schemas:extension:Endpoints:2.0:Device":{
        "type": "object",
        "$id": "urn:ietf:params:scim:schemas:extension:endpoints:2.0:Device",
        "title": "Endpoints extension schema for partner application",
        "description": "Endpoint schema contains URLs and root certificates for the partner application and URLs for enterprise endpoints.",
        "required": [
          "onboarding",
          "deviceControl",
          "dataReceiver"
        ],
  
        "properties": {
  
          "onboarding": {
            "type": "object",
            "$id": "#/properties/onboarding",
            "title": "Onboarding",
            "description": "Onboarding application attributes.",
  
            "required": [
              "onboardingAppUrl",
              "onboardingAppRootCertificate",
                    "onboardingEnterpriseEndpoint"
            ],
  
            "properties": {
              "onboardingAppUrl": {
                "$id": "#/properties/onboardingAppUrl",
                "type": "string",
                "format": "iri-reference",
                "title": "Onboarding application URL",
                "description": "The URL of the onboarding application which can be used to access the application. This attribute is provided by the onboarding application when it creates the SCIM object for the device.",
                "examples": ["https//example.com/onboardingapp/"]
              },
              "onboardingAppRootCertificate": {
                "$id": "#/properties/onboardingAppRootCertificate",
                "type": "string",
                "title": "The root certificate of onboarding application",
                "description": "This attribute comprises of the root certificate signed by the root CA. Onboarding application provides this attribute when it creates the SCIM object for the device."
              },
              "onboardingEnterpriseEndpoint": {
                "$id": "#/properties/onboardingEnterpriseEndpoint",
                "type": "string",
                "format": "iri-reference",
                "title": "Enterprise endpoint for onboarding app",
                "description": "The URL of the enterprise endpoint which oboarding app uses to reach enterprise network gateway. This attribute is already known to the onboarding app and adds it to the SCIM object, when it creates the SCIM object for the device.",
                "examples": ["https//enterprise.com/onboardingapp_endpoint/"]
              }
            }
          },
  
          "deviceControl": {
            "type": "object",
            "$id": "#/properties/deviceControl",
            "title": "Device Control",
            "description": "Device controll application attributes.",
  
            "required": [
              "deviceControlApps",
                    "deviceControlEnterpriseEndpoint"
            ],
  
            "properties": {
              
              "deviceControlApps": {
                "type": "array",
                "items": {
                  "type": "object"
                },
                "title": "Device control apps",
                "description": "The list of device control apps where each list entry contains i) URL and ii) root certificate for each device control app that can control the device.",
                "properties": {
                  "deviceControlAppUrl": {
                    "$id": "#/properties/deviceControlAppUrl",
                    "type": "string",
                    "format": "iri-reference",
                    "title": "Device control app url",
                    "description": "The URL of the device control application which can be used to access the app. This attribute is provided by the onboarding application when it creates the SCIM object for the device.",
                    "examples": ["https//example.com/device_control_app1/"]
                  },
                  "deviceControlAppRootCertificate": {
                    "$id": "#/properties/deviceControlAppRootCertificate",
                    "type": "string",
                    "title": "Device control root certificate",
                    "description": "This attribute comprises of the root certificate signed by the root CA. This attribute is already known to the onboarding app and adds it to the SCIM object, when it creates the SCIM object for the device."
                  }
                }
              },
              
              "deviceControlEnterpriseEndpoint": {
                "$id": "#/properties/deviceControlEnterpriseEndpoint",
                "type": "string",
                "format": "iri-reference",
                "title": "Device control enterprise endpoint",
                "description": "The URL of the enterprise endpoint which device control apps uses to reach enterprise network gateway. When enterprise receives the SCIM object from onboarding app, it adds this attribute to the object and sends back the object as response back to the onboarding app.",
                "examples": ["https//enterprise.com/device_control_endpoint/"]
              }
            }
          },
  
          "dataReceiver": {
            "type": "object",
            "$id": "#/properties/dataReceiver",
            "title": "Data Receiver",
            "description": "Data receiver application attributes.",
  
            "required": [
              "dataReceiverApps",
                    "dataReceiverEnterpriseEndpoint"
            ],
  
            "properties": {
              
              "dataReceiverApps": {
                "type": "array",
                "items": {
                  "type": "object"
                },
                "title": "Data receiver apps",
                "description": "The list of data receiver apps where each list entry contains i) URL and ii) root certificate for each of the data receiver app.",
                "properties": {
                  "dataReceiverAppUrl": {
                    "$id": "#/properties/dataReceiverAppUrl",
                    "type": "string",
                    "format": "iri-reference",
                    "title": "Data receiver app URL",
                    "description": "The URL of the data receiver application which can be used to access the application. This attribute is provided by the device control app when it communicates with the controller. Controller will add this in the SCIM object locally stored in the SCIM server.",
                    "examples": ["https//example.com/dataReceoiverapp1/"]
                  },
                  "dataReceiverAppRootCertificate": {
                    "$id": "#/properties/dataReceiverAppRootCertificate",
                    "type": "string",
                    "title": "Data receiver root certificate",
                    "description": "This attribute comprises of the root certificate signed by the root CA. This attribute is provided by the device control app when it communicates with the controller. Controller will add this in the SCIM object locally stored in the SCIM server."
                  }
                }
              },
              
              "dataReceiverEnterpriseEndpoint": {
                "$id": "#/properties/dataReceiverEnterpriseEndpoint",
                "type": "string",
                "format": "iri-reference",
                "title": "Data receiver enterprise endpoint",
                "description": "The URL of the enterprise endpoint which data receiver apps uses to reach enterprise network gateway. When enterprise receives the SCIM object from onboarding app, it adds this attribute to the object and sends back the object as response back to the onboarding app.",
                "examples": ["https//enterprise.com/data_receiver_endpoint/"]
              }
            }
          }
        }
    }
}}

]]>



The BLE Device Extension

This schema extends the Device schema to specify how the device is to
be authenticated, as well as well as a URL to a control interface for
the device.


{
    "urn:ietf:params:scim:schemas:extension:Ble:2.0:Device":{
      "type": "object",
      "$id": "#/properties/urn:ietf:params:scim:schemas:extension:Ble:2.0:Device",
      "title": "Device extension schema for BLE",
      "description": "Extension schema for devices that support BLE. It contains the attributes that are specific BLE devices only.",

      "required": [
        "versionSupport",
        "deviceMacAddress",
        "addressType",
        "pairingMethods"
      ],
      
      "properties": {
        "versionSupport": {
          "$id": "#/properties/versionSupport",
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "Version support",
          "description": "Provides a list of all the BLE versions supported by the device.",
          "examples": ["4.1", "4.2", "5.0", "5.1", "5.2", "5.3"]
        },
        "deviceMacAddress": {
          "$id": "#/properties/deviceMacAddress",
          "type": "string",
          "title": "Device MAC address",
          "description": "It is the public MAC address assigned by the manufacturer. It is unique 48 bit value.",
          "examples": ["01:23:45:67:89:AB"],
          "pattern": "^[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}$"
        },
        "addressType": {
          "$id": "#/properties/addressType",
          "type": "boolean",
          "title": "Address type",
          "default": false,
          "description": "AddressType flag is taken from the BLE core specifications 5.3. If FALSE, the device is using public MAC address. If TRUE, device is using Random address which is resolved using IRK. "
        },
        "irk": {
          "$id": "#/properties/irk",
          "type": "string",
          "title": "Identity resolving key",
          "description": "Identity resolving key, which is unique for every device. It is used to resolve random address."
        },
        "pairingMethods": {
          "$id": "#/properties/pairingMethods",
          "type": "array",
          "item":{
            "type": "string"
          },
          "title": "Pairing methods",
          "examples": ["urn:ietf:params:scim:schemas:extension:pairingNull:2.0:Device", "urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Device", "urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Device", "urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device"]
        },
        
        "urn:ietf:params:scim:schemas:extension:pairingNull:2.0:Device": {
          "type": "null",
          "title": "Extension for null pairing method",
          "description": "This pairing method is for the BLE devices that do not use any pairing method and connects with the nearest device when powered up. There is no attribute for this method."
        },
        "urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Device": {
          "type": "object",
          "title": "Extension for just works pairing method.",
          "properties": {
            "key": {
              "type": "null",
              "title": "Key",
              "description": "Just works does not have any key value. For completeness, it is added with a key value 'null'."
            }
          }
        },
        "urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Device": {
          "type": "object",
          "title": "Extension for pass key pairing method.",
          "properties": {
            "key": {
              "type": "integer",
              "title": "Key",
              "description": "A six digit passkey for ble device",
              "pattern": "^[0-9]{6}$"
            }
          }
        },
        "urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device": {
          "type": "object",
          "title": "Extension for out of band pairing method.",
          "required": [
            "key",
            "randNumber"
          ],
          "properties": {
            "key": {
              "type": "string",
              "title": "Key",
              "description": "A key value retrieved from out of band source such as NFC."
            },
            "randNumber": {
              "type": "integer",
              "title": "Random number",
              "description": "Nonce added to the key."
            },
            "confirmationNumber": {
              "type": "integer",
              "title": "Confirmation number",
              "description": "Some solutions require confirmation number RESTful message exchange."
            }
          }
        }
      }
    }
}

]]>



Wifi EasyConnect Extension

This schema extends the device schema to enable Wifi EasyConnect
(otherwise known as Device Provisioning Protocol).


{
    "urn:ietf:params:scim:schemas:extension:Wifi:2.0:Device":{
      "type": "object",
      "$id": "urn:ietf:params:scim:schemas:extension:Wifi:2.0:Device",
      "title": "Device extension schema for WiFi",
      "description": "Extension schema for devices that support WiFi. It contains the attributes that are specific WiFi devices only.",

      "required": [
        "versionSupport",
        "bootstrapKey"
      ],
      
      "properties": {
        "versionSupport": {
          "$id": "#/properties/versionSupport",
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "Version support",
          "description": "Provides a list of all the WiFi versions supported by the device.",
          "examples": ["802.11ax"]
        },
        "bootstrappingMethod": {
          "$id": "#/properties/bootstrappingMethod",
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "Bootstrapping method",
          "description": "The list of all the bootstrapping methods available on the enrollee device.",
          "examples": ["QR", "NFC"]
        },
        "bootstrapKey": {
          "$id": "#/properties/bootstrapKey",
          "type": "string",
          "title": "Bootstrap key",
          "description": "This key is Elliptic-Curve Diffie–Hellman (ECDH) public key. The base64 encoded length for P-256, P-384, and P-521 is 80, 96, and 120 characters.",
          "examples": ["MDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgADURzxmttZoIRIPWGoQMV00XHWCAQIhXruVWOz0NjlkIA="]
        },
        "deviceMacAddress": {
          "$id": "#/properties/deviceMacAddress",
          "type": "string",
          "title": "Device MAC address",
          "description": "The MAC address assigned by the manufacturer. It is unique 48 bit value.",
          "examples": ["01:23:45:67:89:AB"],
          "pattern": "^[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}$"
        },
        "classChannel": {
          "$id": "#/properties/classChannel",
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "Class channel",
          "description": "A list of global operating class and channel shared as bootstrapping information. It is formatted as class/channel.",
          "examples": ["81/1", "115/36"]
        },
         "serialNumber": {
          "$id": "#/properties/serialNumber",
          "type": "string",
          "title": "Serial number",
          "description": "An alphanumeric serial number that may also be passed as bootstrapping information.",
          "examples": ["4774LH2b4044"]
        }
      }
    }
}

]]>



Zigbee Extension

This schema extends the device schema to enable provisioning of
Zigbee devices.




Security Considerations

Because provisioning operations are senstive, each client must be
appropriately authenticated.  Certain objects may be read-only or
not visible based on who is connected.

[ More to be added here. ]


IANA Considerations

TBD


Changes from Earlier Versions

Draft -01:


  Doh! We forgot the core device schemea!


Draft -00:


  Initial revision