Automated service enrollment in a machine-to-machine communications network
IoT service layer capabilities may be employed to automate and simplify the service enrollment process for IoT service subscribers/enrollees. These capabilities enable virtualization of a service subscriber and the physical IoT devices, applications, data and authorized users of the subscriber into a software profile that is representative of the subscriber. Once virtualized, a service subscriber may then delegate the complexities and burden of service enrollment to an automated IoT service enrollment software function.
1. An apparatus comprising a processor and a memory, the apparatus being connected to a communications network, the apparatus further including computer-executable instructions stored in the memory of the apparatus which, when executed by the processor of the apparatus, cause the apparatus to implement a service layer entity on the communications network and cause the service layer entity to:
receive an electronic profile comprising information concerning a service subscriber of a plurality of network devices that may be connected to the communications network, and information concerning each of the plurality of network devices, the information concerning each network device comprising at least an associated identifier of the network device, an identifier of each of one or more applications hosted on the network device, and an associated data control policy for each of the one or more applications comprising one or more allowed data types;
create, in the memory of the service layer entity, one or more resources and store within the one or more resources the information contained in the electronic profile concerning the service subscriber and concerning each of the plurality of network devices, including the associated identifiers of each of the one or more applications hosted on each said network device, and the associated data control policy of each of the one or more applications hosted on each said network device;
receive, from an application hosted on each said network device connected to the communications network, an electronic request to register the application with the service layer entity, the request comprising a first identifier and a first data type of data the requesting application is configured to transmit on the communications network;
determine, based on the one or more resources, that the first identifier of the requesting application matches an associated identifier of one of the plurality of applications in the electronic profile;
determine, based on the one or more resources, that the first data type of the requesting application matches one of the allowed data types of the associated data control policy of the application having the matching identifier in the electronic profile;
register, based on the determinations, the requesting application with the service layer entity;
create one or more access control policies based on one or more access control privileges defined in the electronic profile;
link the access control policies to resources created by the registered application; and
determine a plurality of applications allowed to access the resources based on the privileges defined in the access control policies.
2. The apparatus of claim 1 , wherein the instructions further cause the service layer entity to:
determine the requesting application produces a second data type;
determine the second data type does not match one or more of the allowed data types of the associated data control policy of the application having the matching identifier in the electronic profile; and
prevent the requesting application from registering.
3. The apparatus of claim 1 , wherein the electronic profile further comprises at least one of: one or more authorized users; one or more selected service enrollment electives; one or more specified access privileges; and one or more service enrollment lifetimes.
4. The apparatus of claim 1 , wherein an allowed data type of the one or more allowed data types comprises at least one of: one or more supported types of resources; one or more supported types of schemas; maximum number of instances of data; and maximum number of bytes of data.
5. The apparatus of claim 1 , wherein the instructions further cause the service layer entity to:
determine the identifier of the device upon which the requesting application is hosted;
determine the device identifier does not match one or more allowed device identifiers associated with the application in the electronic profile; and
prevent the requesting application from registering.
6. The apparatus of claim 1 , wherein the instructions further cause the service layer entity to:
determine a plurality of users allowed to access the resources based on the privileges defined in the access control policies.
7. The apparatus of claim 1 , wherein the instructions further cause the service layer entity to:
create one or more data control policies based on one or more data control privileges defined in the electronic profile;
link the data control policies to one or more resources created by the registered application; and
determine at least one of a maximum number of child resource instances or a maximum number of bytes allowed to be stored in a resource, based on the data control policies.
8. The apparatus of claim 1 , wherein the instructions further cause the service layer entity to:
create one or more data control policies based on one or more data control privileges defined in the electronic profile;
link the data control policies to one or more resources created by the registered application; and
determine one or more data schemas allowed to be stored in a resource based on the data control policies.
9. The apparatus of claim 1 , wherein the electronic profile is received from an enrollment function in the communications network.
10. A method performed by a service layer entity of a communications network, comprising:
receiving an electronic profile comprising information concerning a service subscriber of a plurality of network devices that may be connected to the communications network, and information concerning each of the plurality of network devices, the information concerning each network device comprising at least an associated identifier of the network device, an identifier of each of one or more applications hosted on the network device, and an associated data control policy for each of the one or more applications comprising one or more allowed data types;
creating, in a memory of the service layer entity, one or more resources and storing within the one or more resources the information contained in the electronic profile concerning the service subscriber and concerning each of the plurality of network devices, including the associated identifiers of each of the one or more applications hosted on each said network device, and the associated data control policy of each of the one or more applications hosted on each said network device;
receiving, from an application hosted on each said network device connected to the communications network, an electronic request to register the application with the service layer entity, the request comprising a first identifier and a first data type of data the requesting application is configured to transmit on the communications network;
determining, based on the one or more resources, that the first identifier of the requesting application matches an associated identifier of one of the plurality of applications in the electronic profile;
determining, based on the one or more resources, that the first data type of the requesting application matches one of the allowed data types of the associated data control policy of the application having the matching identifier in the electronic profile;
registering, based on the determinations, the requesting application with the service layer entity;
creating one or more access control policies based on one or more access control privileges defined in the electronic profile;
linking the access control policies to resources created by the registered application; and
determining a plurality of applications allowed to access the resources based on the privileges defined in the access control policies.
11. The method of claim 10 , further comprising:
determining the requesting application produces a second data type;
determining the second data type does not match one or more of the allowed data types of the associated data control policy of the application having the matching identifier in the electronic profile; and
preventing the requesting application from registering.
12. The method of claim 10 , wherein the electronic profile further comprises at least one of: one or more authorized users; one or more selected service enrollment electives; one or more specified access privileges; and one or more service enrollment lifetimes.
13. The method of claim 10 , wherein an allowed data type of the one or more allowed data types comprises at least one of: one or more supported types of resources; one or more supported types of schemas; maximum number of instances of data; and maximum number of bytes of data.
14. The method of claim 10 , further comprising:
determining the identifier of the device upon which the requesting application is hosted;
determining the device identifier does not match one or more allowed device identifiers associated with the application in the electronic profile; and
preventing the requesting application from registering.
15. The method of claim 10 , further comprising:
determining a plurality of users allowed to access the resources based on the privileges defined in the access control policies.
16. The method of claim 10 , further comprising:
creating one or more data control policies based on one or more data control privileges defined in the electronic profile;
linking the data control policies to one or more resources created by the registered application; and
determining at least one of a maximum number of child resource instances or a maximum number of bytes allowed to be stored in a resource, based on the data control policies.
17. The method of claim 10 , further comprising:
creating one or more data control policies based on one or more data control privileges defined in the electronic profile;
linking the data control policies to one or more resources created by the registered application; and
determining one or more data schemas allowed to be stored in a resource based on the data control policies.
18. The method of claim 10 , wherein the electronic profile is received from an enrollment function in the communications network.