]> North Carolina State University

Department of Computer Science 890 Oval Drive Campus Box 8206 RaleighNC 27695-8206 United States of America mshahza@ncsu.edu

North Carolina State University

Department of Computer Science 890 Oval Drive Campus Box 8206 RaleighNC 27695-8206 United States of America hassaniqbal931@gmail.com

Cisco Systems

Richtistrasse 7 Wallisellen 8304 Switzerland +41 44 878 9200 lear@cisco.com

SEC scim example The initial core schema for the System for Cross-domain Identity Management (SCIM) was designed for provisioning users. This memo specifies schema extensions that enable provisioning of devices using various underlying bootstrapping systems such as Wi-Fi Easy Connect, FIDO device onboarding vouchers, Bluetooth Low Energy (BLE) passcodes, and MAC Authenticated Bypass (MAB).

Introduction The Internet of Things presents a management challenge in many dimensions. One of them is the ability to onboard and manage a large number of devices. There are many models for bootstrapping trust between devices and network deployments. Indeed, it is expected that different manufacturers will make use of different methods. The System for Cross-domain Identity Management (SCIM) defines a protocol and a schema for the provisioning of users. However, it can easily be extended to provision device credentials and other attributes into a network. The protocol and core schema were designed to permit just such extensions. Bulk operations are supported. This is good because often devices are procured in bulk. A primary purpose of this specification is to provision the network for onboarding and communications access to and from devices within a local deployment based on the underlying capabilities of those devices. The underlying security mechanisms of some devices range from non-existent such as the Bluetooth Low Energy (BLE) "Just Works" pairing method to a robust FIDO Device Onboard (FDO) mechanism. Information from the SCIM server is dispatched to control functions based on selected schema extensions to enable these communications within a network. The SCIM database is therefore essentially equivalent to a network's Authentication, Authorization, and Accounting (AAA) database and should be carefully managed as such.

Why SCIM for Devices? There are a number of existing models that might provide the basis for a scheme for provisioning devices onto a network, including two standardized by the IETF: NETCONF or RESTCONF with YANG . SCIM was chosen for the following reasons:

• NETCONF and RESTCONF focus on configuration rather than provisioning.
• SCIM is designed with inter-domain provisioning in mind. The use of HTTP as a substrate permits both user-based authentication for local provisioning applications, as well as OAUTH or certificate- based authentication. The inter-domain nature of these operations does not expose local policy, which itself must be (and often is) configured with other APIs, many of which are not standardized.
• SCIM is also a familiar tool within the enterprise environment, used extensively to configure federated user accounts.
• Finally, once one chooses a vehicle such as SCIM, one is beholden to its data model. The SCIM data model is more targeted to provisioning as articulated in .

This taken together with the fact that end devices are not intended to be directly configured leaves us with SCIM as the best standard option.

Protocol Participants In the normal SCIM model, it was presumed that large federated deployments would be SCIM clients who provision and remove employees and contractors as they enter and depart those deployments, and federated services such as sales, payment, or conferencing services would be the servers. In the device model, the roles are reversed and may be somewhat more varied. The SCIM server resides within a deployment and is used for receiving information about devices that are expected to be connected to its network. That server will apply appropriate local policies regarding whether/how the device should be connected. The client may be one of a number of entities:

• A vendor who is authorized to add devices to a network as part of a sales transaction. This is similar to the sales integration sometimes envisioned by Bootstrapping Remote Secure Key Infrastructure (BRSKI) .
• A client application that administrators or employees use to add, remove, or get information about devices. An example might be a tablet or phone app that scans Wi-Fi Easy Connect QR codes.

Basic Architecture - Non-IP Example | SCIM | | | App |<-------------| Server | | +-----------+ Ctrl Endpt +---------+ | | | | | |(Device Info) | | v | +-----------+ | +------------+ +-------+ | | Control |...........|..| ALG |.........|Device | | | App | | +------------+ +-------+ | +-----------+ | | | Local Network | +-----------------------------------+ ]]>

In , the onboarding application (app) provides the device particulars, which will vary based on the type of device, as indicated by the selection of schema extensions. As part of the response, the SCIM server might provide additional information, especially in the case of non-IP devices, where an application-layer gateway may need to be used to communicate with the device (c.f., ). The control endpoint is one among a number of objects that may be returned. That control endpoint will then communicate with the Application Layer Gateway (ALG) to reach the device.

Interaction with AAA | SCIM |-->| AAA|<-->|Switch| | | App |<-------------| Server | +----+ +------+ | +-----------+ Ctrl Endpt +---------+ | | | | | +-----------+ | +------------+ +-------+ | | Control |...........|..| Router/fw |.........|Device | | | App | | +------------+ +-------+ | +-----------+ | | | Local Network | +------------------------------------+ ]]>

shows how IP-based endpoints can be provisioned. In this case, the onboarding application provisions a device via SCIM. The necessary information is passed to the Authentication, Authorization, and Accounting (AAA) subsystem, such that the device is permitted to connect. Once it is online, since the device is based on IP, it will not need an ALG, but it will use the normal IP infrastructure to communicate with its control application.

Schema Description does not prescribe a language to describe a schema but instead uses a narrative description with examples. We follow that approach. In addition, we provide non-normative JSON Schemas and OpenAPI versions in the appendices for ease of implementation, neither of which existed when SCIM was originally developed. The only difference the authors note between the normative schema representations is that the JSON Schemas and OpenAPI versions do not have a means to express case sensitivity, and thus attributes that are not case sensitive must be manually validated. Several additional schemas specify specific onboarding mechanisms, such as Bluetooth Low Energy (BLE) , Wi-Fi Easy Connect , and FIDO Device Onboard .

Schema Representation Attributes defined in the device core schema and extensions comprise characteristics and SCIM datatypes defined in Sections and of . This specification does not define new characteristics and datatypes for the SCIM attributes.

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. The reader is also expected to be familiar with the narrative schema language used in .

ResourceType Device A new resource type 'Device' is specified. The "ResourceType" schema specifies the metadata about a resource type (see ). It comprises a core device schema and several extension schemas. This schema provides a minimal resource representation, whereas extension schemas extend it depending on the device's capability.

Common Attributes The Device schema contains three common attributes as defined in . No semantic or syntax changes are made here, but the attributes are listed merely for completeness.

id:

A required and unique attribute of the core device schema (see ).

externalId:

An optional attribute (see ).

meta:

A required and complex attribute (see ).

SCIM Core Device Schema The core device schema provides the minimal representation of a resource "Device". It contains only those attributes that any device may need, and only one attribute is required. It is identified using the schema URI: urn:ietf:params:scim:schemas:core:2.0:Device The following attributes are defined in the core device schema.

Singular Attributes

displayName:

A string that provides a human-readable name for a device. It is intended to be displayed to end users and should be suitable for that purpose. The attribute is not required and is not case sensitive. It may be modified and SHOULD be returned by default. No uniqueness constraints are imposed on this attribute.

active:

A mutable boolean that is required. If set to TRUE, it means that this device is intended to be operational. Attempts to control or access a device where this value is set to FALSE may fail. For example, when used in conjunction with Non-IP Device Control (NIPC) , commands such as connect, disconnect, and subscribe that control application sends to the controller for the devices any command will be rejected by the controller.

mudUrl:

A string that represents the URL to the Manufacturer Usage Description (MUD) file associated with this device. This attribute is optional and mutable. The mudUrl value is case sensitive and not unique. When present, this attribute may be used as described in . This attribute is case sensitive and returned by default.

groups:

An optional read-only complex object that indicates group membership. Its form is precisely the same as that defined in .

Characteristics of Device Schema Attributes

Attribute	Multi Value	Req	Case Exact	Mutable	Return	Unique
displayName	F	F	F	RW	Def	None
active	F	T	F	RW	Def	None
mudUrl	F	F	T	RW	Def	None
groups	T	F	T	RO	Def	n/a

Legend:

Req:

Required

T:

True

F:

False

RO:

ReadOnly

RW:

ReadWrite

Def:

Default

Core Device Example Entries

Groups Device and EndpointApp groups are created using the SCIM groups as defined in . If set, the "type" subattribute of the "members" attribute MUST be set to "Device" for devices and "EndpointApp" for endpoint applications.

Resource Type EndpointApp This section defines the 'EndpointApp' resource type. The "ResourceType" schema specifies the metadata about a resource type (see ). The resource "EndpointApp" represents client applications that can control and/or receive data from the devices.

SCIM EndpointApp Schema The EndpointApp schema is used to authorize control or telemetry services for clients. The schema identifies the application and how clients are to authenticate to the various services. The schema for "EndpointApp" is identified using the schema URI: urn:ietf:params:scim:schemas:core:2.0:EndpointApp The following attributes are defined in this schema.

Common Attributes Like , the EndpointApp schema contains the three common attributes specified in .

Singular Attributes

applicationType:

A string that represents the type of application. It will only contain two values: 'deviceControl' or 'telemetry'. deviceControl is the application that sends commands to control the device. telemetry is the application that receives data from the device. The attribute is required and is not case sensitive. The attribute is readOnly and should be returned by default. No uniqueness constraints are imposed on this attribute.

applicationName:

A string that represents a human-readable name for the application. This attribute is required and mutable. The attribute should be returned by default and there is no uniqueness constraint on the attribute.

clientToken:

A string that contains a token that the client will use to authenticate itself. Each token may be a string up to 500 characters in length. It is not mutable, read only, generated if no certificateInfo object is provisioned, case sensitive, and returned by default if it exists. The SCIM server should expect that client tokens will be shared by the SCIM client with other components within the client's infrastructure.

groups:

An optional read-only complex object that indicates group membership. Its form is precisely the same as that defined in .

Complex Attributes

certificateInfo certificateInfo is a complex attribute that contains an X.509 certificate's subject name and root Certificate Authority (CA) information associated with application clients that will connect for purposes of device control or telemetry.

rootCA:

A base64-encoded string as described in a trust anchor certificate. This trust anchor is applicable for certificates used for client application access. The object is not required, singular, case sensitive, and read/write. If not present, a set of trust anchors MUST be configured out of band.

subjectName:

When present, a string that contains one of two names:

• a distinguished name that will be present in the certificate subject field, as described in or
• a dnsName as part of a subjectAlternateName, as described in .

In the latter case, servers validating such certificates SHALL reject connections when the name of the peer as resolved by a DNS reverse lookup does not match the dnsName in the certificate. If multiple dnsNames are present, it is left to server implementations to address any authorization conflicts associated with those names. This attribute is not required, mutable, singular, and NOT case sensitive.

Characteristics of EndpointApp Schema Attributes

Attribute	Multi Value	Req	Case Exact	Mutable	Return	Unique
applicationType	F	T	F	R	Def	None
applicationName	F	T	F	RW	Def	None
clientToken	F	F	T	R	N	None
certificateInfo	F	F	F	RW	Def	None
rootCA	F	F	T	RW	Def	None
subjectName	F	T	T	RW	Def	None

Legend:

Req:

Required

T:

True

F:

False

R:

ReadOnly

RW:

ReadWrite

Manuf:

Manufacturer

N:

No

Def:

Default

Note that either clientToken or certificateInfo is used for the authentication of the application. If certificateInfo is NOT present when an endpointApp object is created, then the server SHOULD return a clientToken. Otherwise, if the server accepts the certificateInfo object for authentication, it SHOULD NOT return a clientToken. If the server accepts and produces a clientToken, then control and telemetry servers MUST validate both. The SCIM client will know that this is the case based on the SCIM object that is returned. certificateInfo is preferred in situations where client functions are federated such that different clients may connect for different purposes.

Endpoint App Example

SCIM Device Extensions SCIM provides various extension schemas, their attributes, JSON representation, and example object. The core schema is extended with a new resource type, Device. No schemaExtensions list is specified in that definition. Instead, IANA registry entries have been created, where all values for "required" are set to false. All extensions to the Device schema MUST be registered via IANA, as described in . The schemas below demonstrate how this model is to work. All the SCIM server-related schema URIs are valid only with Device resource types.

Bluetooth Low Energy (BLE) Extension This schema extends the device schema to represent the devices supporting BLE. The extension is identified using the following schema URI: urn:ietf:params:scim:schemas:extension:ble:2.0:Device The attributes are as follows.

Singular Attributes

deviceMacAddress:

A string value that represents a public MAC address assigned by the manufacturer. It is a unique 48-bit value. It is required, case insensitive, mutable, and returned by default. The ECMA regular expression pattern is the following:

isRandom:

A boolean flag taken from . If FALSE, the device is using a public MAC address. If TRUE, the device uses a random address. If an Identifying Resolving Key (IRK) is present, the address represents a resolvable private address. Otherwise, the address is assumed to be a random static address. Non-resolvable private addresses are not supported by this specification. This attribute is not required. It is mutable and is returned by default. The default value is FALSE.

separateBroadcastAddress:

When present, this string represents an address used for broadcasts/advertisements. This value MUST NOT be set when an IRK is provided. Its form is the same as deviceMacAddress. It is not required, multivalued, mutable, and returned by default.

irk:

A string value that specifies the IRK, which is unique to each device. It is used to resolve a private random address. It should only be provisioned when isRandom is TRUE. It is mutable and never returned. For more information about the use of the IRK, see Volume 1, Part A, Section 5.4.5 of .

mobility:

A boolean attribute to enable BLE device mobility. If set to TRUE, the device could be expected to move within a network of APs. For example, if a BLE device is connected with AP-1 and moves out of range but comes in range of AP-2, it will be disconnected with AP-1 and connected with AP-2. It is returned by default and mutable.

Multivalued Attributes

versionSupport:

A multivalued set of strings that specifies the BLE versions supported by the device in the form of an array, for example, ["4.1", "4.2", "5.0", "5.1", "5.2", "5.3", "5.4"]. It is required, mutable, and returned by default.

pairingMethods:

A multivalued set of strings that specifies pairing methods associated with the BLE device. The pairing methods may require subattributes such as key/password for the device pairing process. To enable the scalability of pairing methods in the future, they are represented as extensions to incorporate various attributes that are part of the respective pairing process. Pairing method extensions are nested inside the BLE extension. It is required, case sensitive, mutable, and returned by default.

BLE Pairing Method Extensions The details on pairing methods and their associated attributes are in Volume 1, Part A, Section 5.2.4 of . This memo defines extensions for four pairing methods that are nested inside the BLE extension schema. Each extension contains the common attributes in . These extensions are as follows:

1. The pairingNull extension is identified using the following schema URI: urn:ietf:params:scim:schemas:extension:pairingNull:2.0:Device pairingNull does not have any attribute. It allows pairing for BLE devices that do not require a pairing method.
2. The pairingJustWorks extension is identified using the following schema URI: urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Device The Just Works pairing method does not require a key to pair devices. For completeness, the key attribute is included and is set to 'null'. The key attribute is required, immutable, and returned by default.
3. The pairingPassKey extension is identified using the following schema URI: urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Device The passkey pairing method requires a 6-digit key to pair devices. This extension has one singular integer attribute, "key", which is required, mutable, and returned by default. The key pattern is as follows:
4. The pairingOOB extension is identified using the following schema URI: urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device The out-of-band (OOB) pairing method includes three singular attributes: key, randomNumber, and confirmationNumber.

   key:

   A string value that is required and received from out-of-band sources such as Near Field Communication (NFC). It is case sensitive, mutable, and returned by default.

   randomNumber:

   An integer that represents a nonce added to the key. It is a required attribute. It is mutable and returned by default.

   confirmationNumber:

   An integer that some solutions require in a RESTful message exchange. It is not required. It is mutable and returned by default if it exists.

Characteristics of BLE Extension Schema Attributes

Attribute	Multi Value	Req	Case Exact	Mutable	Return	Unique
deviceMacAddress	F	T	F	RW	Def	Manuf
isRandom	F	T	F	RW	Def	None
sepBroadcastAdd	T	F	F	RW	Def	None
irk	F	F	F	WO	Nev	Manuf
versionSupport	T	T	F	RW	Def	None
mobility	F	F	F	RW	Def	None
pairingMethods	T	T	T	RW	Def	None

Legend:

sepBroadcastAdd:

separateBroadcastAddress

Req:

Required

T:

True

F:

False

RW:

ReadWrite

WO:

Write Only

Def:

Default

Nev:

Never

Manuf:

Manufacturer

BLE Example

In the above example, the pairing method is "pairingPassKey", which implies that this BLE device pairs using only a passkey. In another example below, the pairing method is "pairingOOB", denoting that this BLE device uses the out-of-band pairing method.

BLE with pairingOOB

However, a device can have more than one pairing method. Support for multiple pairing methods is also provided by the multivalued attribute pairingMethods. In the example below, the BLE device can pair with both passkey and OOB pairing methods.

BLE Pairing with Both Passkey and OOB

Wi-Fi Easy Connect Extension A schema that extends the device schema to enable Wi-Fi Easy Connect (otherwise known as Device Provisioning Protocol (DPP)). Throughout this specification, we use the term "DPP". The extension is identified using the following schema URI: urn:ietf:params:scim:schemas:extension:dpp:2.0:Device The attributes in this extension are adopted from . The attributes are as follows.

Singular Attributes

dppVersion:

An integer that represents the version of DPP the device supports. This attribute is required, case insensitive, mutable, and returned by default.

bootstrapKey:

A string value representing an Elliptic Curve Diffie-Hellman (ECDH) public key. The base64-encoded lengths for P-256, P-384, and P-521 are 80, 96, and 120 characters. This attribute is required, case sensitive, mutable, and returned by default.

deviceMacAddress:

A MAC address stored as a string. It is a unique 48-bit value. This attribute is optional, case insensitive, mutable, and returned by default. Its form is identical to that of the deviceMacAddress for BLE devices.

serialNumber:

An alphanumeric serial number stored as a string. It may also be passed as bootstrapping information. This attribute is optional, case insensitive, mutable, and returned by default.

Multivalued Attributes

bootstrappingMethod:

One or more strings of all the bootstrapping methods available on the enrollee device, for example, [QR, NFC]. This attribute is optional, case insensitive, mutable, and returned by default.

classChannel:

One or more strings representing the global operating class and channel shared as bootstrapping information. It is formatted as class/channel, for example, ['81/1','115/36']. This attribute is optional, case insensitive, mutable, and returned by default.

Characteristics of DPP Extension Schema Attributes

Attribute	Multi Value	Req	Case Exact	Mutable	Return	Unique
dppVersion	F	T	F	RW	Def	None
bootstrapKey	F	T	T	WO	Nev	None
deviceMacAddress	F	F	F	RW	Def	Manuf
serialNumber	F	F	F	RW	Def	None
bootstrappingMethod	T	F	F	RW	Def	None
classChannel	T	F	F	RW	Def	None

Legend:

Req:

Required

T:

True

F:

False

RW:

ReadWrite

WO:

Write Only

Def:

Default

Nev:

Never

Manuf:

Manufacturer

DPP Example

Ethernet MAB Extension This extension enables a legacy means of (very) weak authentication, known as MAC Authenticated Bypass (MAB), that is supported in many wired ethernet solutions. If the MAC address is known, then the device may be permitted (perhaps limited) access. The extension is identified by the following URI: urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:Device Note that this method is not likely to work properly with MAC address randomization.

Single Attribute This extension has a singular attribute:

deviceMacAddress:

This is the Ethernet address to be provisioned onto the network. It takes the identical form as found in the BLE extension.

Characteristics of MAB Extension Schema Attributes

Attribute	Multi Value	Req	Case Exact	Mutable	Return	Unique
deviceMacAddress	F	T	F	RW	Def	None

Legend:

Req:

Required

T:

True

F:

False

RW:

ReadWrite

Def:

Default

MAB Example

FIDO Device Onboard Extension This extension specifies a voucher to be used by the FDO Device Onboard (FDO) protocols to complete a trusted transfer of ownership and control of the device to the environment. The SCIM server MUST know how to process the voucher, either directly or by forwarding it along to an owner process as defined in the FDO specification. The extension is identified using the following schema URI: urn:ietf:params:scim:schemas:extension:fido-device-onboard:2.0:Device

Single Attribute This extension has a singular attribute:

fdoVoucher:

The voucher is formatted as a PEM-encoded object in accordance with .

Characteristics of FDO Extension Schema Attributes

Attribute	Multi Value	Req	Case Exact	Mutable	Return	Unique
fdoVoucher	F	T	F	WO	Nev	None

Legend:

Req:

Required

T:

True

F:

False

WO:

WriteOnly

Nev:

Never

FDO Example

Zigbee Extension A schema that extends the device schema to enable the provisioning of Zigbee devices . The extension is identified using the following schema URI: urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device It has one singular attribute and one multivalued attribute. The attributes are as follows.

Singular Attribute

deviceEui64Address:

A 64-bit Extended Unique Identifier (EUI-64) device address stored as string. This attribute is required, case insensitive, mutable, and returned by default. It takes the same form as the deviceMACaddress in the BLE extension.

Multivalued Attribute

versionSupport:

One or more strings of all the Zigbee versions supported by the device, for example, [3.0]. This attribute is required, case insensitive, mutable, and returned by default.

Characteristics of Zigbee Extension Schema Attributes

Attribute	Multi Value	Req	Case Exact	Mutable	Return	Unique
deviceEui64Address	F	T	F	RW	Def	None
versionSupport	T	T	F	RW	Def	None

Legend:

Req:

Required

T:

True

F:

False

RW:

ReadWrite

Def:

Default

Zigbee Example

The Endpoint Applications Extension Schema Sometimes non-IP devices such as those using BLE or Zigbee require an application gateway interface to manage them. SCIM clients MUST NOT specify this to describe native IP-based devices. endpointAppsExt provides the list of applications that connect to an enterprise gateway. endpointAppsExt has one multivalued attribute and two singular attributes. The extension is identified using the following schema URI: urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device

Singular Attributes

deviceControlEnterpriseEndpoint:

A string representing the URL of the enterprise endpoint to reach the enterprise gateway. When the enterprise receives the SCIM object from the onboarding application, it adds this attribute to it and sends it back as a response to the onboarding application. This attribute is required, case sensitive, mutable, and returned by default. The uniqueness is enforced by the enterprise.

telemetryEnterpriseEndpoint:

A string representing a URL of the enterprise endpoint to reach an enterprise gateway for telemetry. When the enterprise receives the SCIM object from the onboarding application, it adds this attribute to it and sends it back as a response to the onboarding application. This attribute is optional, case sensitive, mutable, and returned by default. The uniqueness is enforced by the enterprise. An implementation MUST generate an exception if telemetryEnterpriseEndpoint is not returned and telemetry is required for the proper functioning of a device.

Multivalued Attribute

applications:

A multivalued attribute of one or more complex attributes that represent a list of endpoint applications, i.e., deviceControl and telemetry. Each entry in the list comprises two attributes including "value" and "$ref".

value:

A string containing the identifier of the endpoint application formatted as a Universally Unique Identifier (UUID). It is the same as the common attribute "$id" of the resource "endpointApp". It is read/write, required, case insensitive, and returned by default.

$ref:

A reference to the respective endpointApp resource object stored in the SCIM server. It is readOnly, required, case sensitive, and returned by default.

Characteristics of EndpointAppsExt Extension Schema Attributes

Attribute	Multi Value	Req	Case Exact	Mutable	Return	Unique
devContEntEndpoint	F	T	T	R	Def	Ent
telEntEndpoint	F	F	T	R	Def	Ent
applications	T	T	F	RW	Def	None
value	F	T	F	RW	Def	None
$ref	F	T	F	R	Def	None

Legend:

devContEntEndpoint:

deviceControlEnterpriseEndpoint

telEntEndpoint:

telemetryEnterpriseEndpoint

Req:

Required

T:

True

F:

False

R:

ReadOnly

RW:

ReadWrite

Ent:

Enterprise

Def:

Default

Endpoint Applications Extension Example

The schema for the endpointAppsExt extension along with BLE extension is presented in JSON format in , while the OpenAPI representation is provided in .

Security Considerations Because provisioning operations permit device access to a network, each SCIM client MUST be appropriately authenticated.

SCIM Operations An attacker that has authenticated to a trusted SCIM client could manipulate portions of the SCIM database. To be clear on the risks, we specify each operation below.

Unauthorized Object Creation An attacker that is authenticated could attempt to add elements that the enterprise would not normally permit on a network. For instance, an enterprise may not wish specific devices that have well-known vulnerabilities to be introduced to their environment. To mitigate the attack, network administrators should layer additional policies regarding what devices are permitted on the network. An attacker that gains access to SCIM could attempt to add an IP-based device that itself attempts unauthorized access, effectively acting as a bot. Network administrators SHOULD establish appropriate access-control policies that follow the principle of least privilege to mitigate this attack.

Object Deletion Once granted, even if the object is removed, the server may or may not act on that removal. The deletion of the object is a signal of intent by the application that it no longer expects the device to be on the network. It is strictly up to the SCIM server and its back end policy to decide whether or not to revoke access to the infrastructure. It is RECOMMENDED that SCIM delete operations trigger a workflow in accordance with local network policy.

Read Operations Read operations are necessary in order for an application to sync its state to know what devices it is expected to manage. An attacker with access to SCIM objects may gain access to the devices themselves. To prevent one SCIM client from interfering with devices that it has no business managing, only clients that have created objects or those they authorize SHOULD have the ability to read those objects.

Update Operations Update operations may be necessary if a device has been modified in some way. Attackers with update access may be able to disable network access to devices or device access to networks. To avoid this, the same access control policy for read operations is RECOMMENDED here.

Higher Level Protection for Certain Systems Devices provisioned with this model may be completely controlled by the administrator of the SCIM server, depending on how those systems are defined. For instance, if BLE passkeys are provided, the device can be connected to, and perhaps paired with. If the administrator of the SCIM client does not wish the network to have complete access to the device, the device itself MUST support finer levels of access control and additional authentication mechanisms. Any additional security must be provided at higher application layers. For example, if client applications wish to keep private information to and from the device, they should encrypt that information over-the-top.

Logging An attacker could learn what devices are on a network by examining SCIM logs. Due to the sensitive nature of SCIM operations, logs SHOULD be encrypted both on the disk and in transit.

IANA Considerations

New Schemas IANA has added the following additions to the "SCIM Schema URIs for Data Resources" registry:

Schema URI	Name	Reference
urn:ietf:params:scim:schemas:core: 2.0:Device	Core Device Schema	RFC 9944,
urn:ietf:params:scim:schemas:core: 2.0:EndpointApp	Endpoint Application	RFC 9944,

Device Schema Extensions IANA has created the following extensions in the "SCIM Server-Related Schema URIs" registry as described in :

Schema URI	Description	Resource Type	Reference
urn:ietf:params:scim: schemas:extension: ble:2.0:Device	BLE Extension	Device	RFC 9944,
urn:ietf:params:scim: schemas:extension: ethernet-mab:2.0:Device	Ethernet MAB	Device	RFC 9944,
urn:ietf:params:scim: schemas:extension: fido-device-onboard:2.0:Device	FIDO Device Onboard	Device	RFC 9944,
urn:ietf:params:scim: schemas:extension: dpp:2.0:Device	Wi-Fi Easy Connect	Device	RFC 9944,
urn:ietf:params:scim: schemas:extension: endpointAppsExt:2.0:Device	Application Endpoint Extension	Device	RFC 9944,
urn:ietf:params:scim: schemas:extension: pairingJustWorks:2.0:Device	Just Works Auth BLE	Device	RFC 9944,
urn:ietf:params:scim: schemas:extension: pairingOOB:2.0:Device	Out-of-Band Pairing for BLE	Device	RFC 9944,
urn:ietf:params:scim: schemas:extension: pairingPassKey:2.0:Device	Passkey Pairing for BLE	Device	RFC 9944,

References Normative References Bluetooth SIG Version 5.4 Wi-Fi Alliance Version 2.0 ECMA International ECMA-262, 16th Edition FIDO Alliance Proposed Standard Zigbee Alliance ZigBee Document 05-3474-21 Informative References Postman Swagger Version 3.1.1

JSON Schema Representation

Resource Schema

Core Device Schema

EndpointApp Schema

BLE Extension Schema

DPP Extension Schema

Ethernet MAB Extension Schema

FDO Extension Schema

Zigbee Extension Schema

EndpointAppsExt Extension Schema

OpenAPI Representation The following sections are provided for informational purposes.

Core Device Schema OpenAPI Representation OpenAPI representation of core device schema is as follows:

EndpointApp Schema OpenAPI Representation OpenAPI representation of endpointApp schema is as follows:

BLE Extension Schema OpenAPI Representation OpenAPI representation of BLE extension schema is as follows:

DPP Extension Schema OpenAPI Representation OpenAPI representation of DPP extension schema is as follows:

Ethernet MAB Extension Schema OpenAPI Representation OpenAPI representation of Ethernet MAB extension schema is as follows:

FDO Extension Schema OpenAPI Representation OpenAPI representation of FDO extension schema is as follows:

Zigbee Extension Schema OpenAPI Representation OpenAPI representation of Zigbee extension schema is as follows:

EndpointAppsExt Extension Schema OpenAPI Representation OpenAPI representation of endpoint Apps extension schema is as follows:

FIDO Device Onboarding Example Flow The following diagrams are included to demonstrate how FDO can be used. In this first diagram, a device is onboarded not only to the device owner process but also to the AAA server for initial onboarding. The voucher contains a device certificate that is used by the AAA system for authentication. | | | | | | | | |----. | | | | | 2 Recover X.509 | | | |<---' cert chain | | | | from voucher | | | | | | | | | | | |3 Add device(voucher) | | | |/HTTP | | | |--------------------->| | | | | | | | 4 200 "ok" | | | |<---------------------| | | | | | | | 5 Add identity | | |------------------------------->| | | | | | | 6 200 "ok" | | |<-------------------------------| | | | | | 7 200 "ok" | | | |<---------------------| | | | | | | | | | | ]]> After this flow is complete, the device can then first provisionally onboard and then later receive a trust anchor through FDO's TO2 process. This is shown below. | | | | | | | ,-----------------------!. | | |Limited access |_\ | | |for now | | | `-------------------------' | | | |4 Result=Success | | | |----------------->| | | | | | | 5 FDO TO2 | | |<----------------------------------------------------| | | | | ,-------------------------------------------------------------!. |FSIM, Runtime SSID, |_\ |Credentials incl. | |local trust anchor | `---------------------------------------------------------------' | | | 6 dissasociate | | | |<-----------------| | | | | | | |7 EAP-TLS w/ LSC | | | |<-----------------| | | | | | | | | . . etc . . ]]>

Acknowledgments The authors would like to thank , , , , , , , , , , and for their reviews and for his contribution to the appendix.