1. SEC Clarification Group Name: WG4 (SEC-2014-xxxx) Decision  Meeting Date: 2014-05-07 Discussion  Source: OBERTHUR Technologies Information  Contact: v.dragan@oberthur.com Other  Agenda Item:

2. Authentication & Protocol Stack Layers Field Node HTTP/CoAP/MQTT TLS/DTLS Infrastr.ucture Node IP Data Link Layer PHY Layer Application oneM2M Layer TCP/UDP HTTP/CoAP/MQTT TLS/DTLS IP Application oneM2M Layer TCP/UDP – All data used in oneM2M security protocol should be protected using a secure protocol (such as TLS) – Authentication can be handled within the application layer, while using transport layer security for confidentiality and integrity. – When app. layer delegate the authentication to the transport layer security then security channel binding mechanism is to be used, based on RFC 5056 (On the Use of Channel Bindings to Secure Channels), RFC 5929(Channel Bindings for TLS) and/or RFC 5705(Keying Material Exporters for TLS).

3. Authentication in Application Layer AE CSE Mca ASN/MN/IN Authentication protocol at Application Layer performed when AE and CSE reside in the same Node.

4. Delegation of Authentication to lower layer Delegation of Authentication to transport security layer (use of channel binding) when AE and CSE reside in different Nodes RFC 5056: « The concept of channel binding allows applications to establish that the two end- points of a secure channel at one network layer are the same as at a higher layer by binding authentication at the higher layer to the channel at the lower layer” INADN ? AE CSE Mca AE Mca Mcc CSE ASN MN Mcc

5. Other clarification (to be cont. …) What’s to be authenticated by the oneM2M security Protocol: – AE-ID – CSE-ID – Node (i.e; device or gateway) - Out of scope Which entity shall get oneM2M Service Subscription prior consuming M2M Service/Resource? – AE Should ACP be applied to the AE and CSE or only the AE? – It applies to both. – The case when host CSE request registration to the remote CSE, the remote CSE may forbid the access to some specific CSE. Can we assume multiple Roles for an AE in Rel1, knowing that sessions feature is not part of Rel1 ? TBD