GEISA Specification 0.9.0-d117517

Contents:

• 1. Abstract
• 2. Contributors
• 3. License
  • 3.1. Community Specification License 1.0
• 4. Introduction
• 5. Glossary
• 6. Design Principles
  • 6.1. Interoperability
  • 6.2. Constrained Environment
  • 6.3. Minimal Implementation
  • 6.4. Core Specification with Extensions
  • 6.5. Security
• 7. Operations
  • 7.1. Purpose and Scope
  • 7.2. Roles and Authorities
  • 7.3. End-to-End Operational Context
  • 7.4. Operational Capability
  • 7.5. Device Onboarding and Management Overview
  • 7.6. Application Approval and Deployment Overview
  • 7.7. Off-Device Communication Approval
  • 7.8. Application Activation and Runtime Visibility
  • 7.9. Operational Reporting and Visibility
  • 7.10. Utility and Enterprise Interaction Points
  • 7.11. Application Certification
  • 7.12. Future Considerations
• 8. System Architecture
  • 8.1. General Architecture
  • 8.2. Application Isolation
    • 8.2.1. Application Manifest
    • 8.2.2. Networking Control
    • 8.2.3. API Control
    • 8.2.4. Container Resource Management
• 9. Conformance
  • 9.1. Conformance Test Overview
  • 9.2. Validation Tools
  • 9.3. Running the Conformance Tests
  • 9.4. Conformance Test Coverage
  • 9.5. Contributing or Reporting Issues
  • 9.6. Other Resources
• 10. Hardware Expectations
  • 10.1. Metrology
  • 10.2. Sensors
  • 10.3. Actuators
• 11. Application & Device Management
  • 11.1. OMA Lightweight M2M
    • 11.1.1. GEISA ADM Object-version baseline
    • 11.1.2. GEISA ADM Object Model
  • 11.2. Bootstrapping
  • 11.3. Registration
  • 11.4. Application Manifests
  • 11.5. Device Management
  • 11.6. Firmware Management
  • 11.7. Application Management
    • 11.7.1. Software Management
  • 11.8. Application Messaging and Configuration
• 12. Linux Execution Environment
  • 12.1. Operating System
  • 12.2. Application Isolation
    • 12.2.1. Isolation Requirements
    • 12.2.2. Container Image Requirements
  • 12.3. Linux Base Libraries
  • 12.4. Core Services
  • 12.5. Base Filesystem
    • 12.5.1. Filesystem Mounts
    • 12.5.2. Utilities and Environment
    • 12.5.3. GEISA Components
    • 12.5.4. Base Libraries
    • 12.5.5. Construction of the Filesystem
    • 12.5.6. Example Filesystem Construction
• 13. Virtual Execution Environment
  • 13.1. Virtual Execution Runtime
    • 13.1.1. Processing Unit
    • 13.1.2. Scheduler
    • 13.1.3. Java Language Support
    • 13.1.4. C/C++ Language Support
    • 13.1.5. Multi-Sandbox Execution Control
    • 13.1.6. Security Manager
  • 13.2. Virtual Base Libraries
• 14. Application Programming Interface (API)
  • 14.1. API Architecture
    • 14.1.1. Message bus communication
    • 14.1.2. Message bus connection and credentials
    • 14.1.3. Message bus topics and reliability
    • 14.1.4. Non-message bus communication
  • 14.2. API Catalog Reference
    • 14.2.1. API Topic and Permission Catalog
  • 14.3. Platform Discovery
    • 14.3.1. Hardware, Firmware, and Platform Software
    • 14.3.2. Application Information
    • 14.3.3. Metrology Hardware
    • 14.3.4. Sensor Hardware
    • 14.3.5. Network Hardware
    • 14.3.6. Waveform Discovery
    • 14.3.7. Application Deployment Manifest
  • 14.4. Platform and App Status
    • 14.4.1. Runtime Mode
    • 14.4.2. Urgent Platform Updates
    • 14.4.3. Application Updates
    • 14.4.4. Timestamps
    • 14.4.5. Application Status
    • 14.4.6. Connectivity Updates
  • 14.5. Common Response Status
    • 14.5.1. Summary
    • 14.5.2. Status Message Model
    • 14.5.3. Status Code Handling
    • 14.5.4. API Usage
    • 14.5.5. Implementation Guidance
    • 14.5.6. Transaction Data
  • 14.6. Instantaneous Data
    • 14.6.1. Summary
    • 14.6.2. Profiles and Required Values
    • 14.6.3. AC Meter Profile Required Fields
    • 14.6.4. Additional Standardized Instantaneous Quantities
    • 14.6.5. Value Semantics
    • 14.6.6. MQTT Details
    • 14.6.7. API Permissions
    • 14.6.8. Transaction Data
  • 14.7. Billing Data
    • 14.7.1. Summary
    • 14.7.2. Billing Data Broadcast
    • 14.7.3. Billing Payload Model
    • 14.7.4. Value Semantics
    • 14.7.5. Profile and Example
    • 14.7.6. MQTT Details
    • 14.7.7. API Permissions
    • 14.7.8. Transaction Data
  • 14.8. Waveform Data
    • 14.8.1. Baseline Stream Requirement
    • 14.8.2. Device Capabilities
    • 14.8.3. API Request Response
    • 14.8.4. Data Format
    • 14.8.5. MQTT Details
    • 14.8.6. API Permissions
    • 14.8.7. Transaction Data
    • 14.8.8. Examples
  • 14.9. References
  • 14.10. Actuator Status & Control
    • 14.10.1. Summary
    • 14.10.2. Permission and safety model
    • 14.10.3. Actuator targets
    • 14.10.4. Getting actuator status
    • 14.10.5. Setting actuator state
    • 14.10.6. MQTT Details
    • 14.10.7. API Permissions
    • 14.10.8. Transaction Data
    • 14.10.9. Notes
  • 14.11. Sensors
    • 14.11.1. Scope
    • 14.11.2. Sensor Discovery Model
    • 14.11.3. Geolocation Metadata
    • 14.11.4. Sensor Type Enumeration
    • 14.11.5. Runtime Data Model
    • 14.11.6. Sensor Value Model
    • 14.11.7. Read Request and Response
    • 14.11.8. MQTT Details
    • 14.11.9. API Permissions
    • 14.11.10. Transaction Data
    • 14.11.11. Notes
    • 14.11.12. References
  • 14.12. Off-Device Communication
    • 14.12.1. Message-based via LwM2M
    • 14.12.2. IP socket based to local devices, private clouds, or public clouds
    • 14.12.3. Interface Types
    • 14.12.4. Destination Classes
    • 14.12.5. Network State
    • 14.12.6. Volume Limits
    • 14.12.7. Security considerations
    • 14.12.8. Connectivity
    • 14.12.9. Policy Rules
    • 14.12.10. DNS
    • 14.12.11. Local Endpoint Considerations
  • 14.13. App-to-App Communication
    • 14.13.1. Platform implementation
    • 14.13.2. Application Manifest
    • 14.13.3. Runtime and Dependency Considerations
    • 14.13.4. Security Considerations
• 15. Security
  • 15.1. Responsibilities
    • 15.1.1. Shared Responsibility Model
    • 15.1.2. GEISA Responsibilities
    • 15.1.3. Implementer Responsibilities
  • 15.2. Threat Model
    • 15.2.1. Software Provenance and Deployment Authorization
    • 15.2.2. Lifecycle Trust Enforcement
    • 15.2.3. Trust Revocation and Credential Lifecycle
    • 15.2.4. Assets Requiring Protection
    • 15.2.5. Trust Boundaries and External Interfaces
    • 15.2.6. Threat Actors Considered
    • 15.2.7. Representative Threat Scenarios
    • 15.2.8. Unauthorized Use of Local Service Interfaces
    • 15.2.9. Compromise of a Customer-Network Connected Device
    • 15.2.10. Malicious or Altered Software Introduced During Update
    • 15.2.11. Remote Exploitation of Exposed Services
    • 15.2.12. Insider Abuse of Authorized Privileges
    • 15.2.13. Coordinated Manipulation Across Multiple Devices
  • 15.3. Interpretation of Conformance
  • 15.4. Security Capability Expectations
    • 15.4.1. Identity and Authentication
    • 15.4.2. Authorization and Policy Enforcement
    • 15.4.3. Integrity Protection
    • 15.4.4. Isolation of Workloads
    • 15.4.5. Secure Lifecycle Management
    • 15.4.6. Protection of Data
    • 15.4.7. Auditability and Visibility
    • 15.4.8. Resilience and Availability
  • 15.5. Digital Signatures
    • 15.5.1. Support Signature Algorithms
    • 15.5.2. Signature Validation
  • 15.6. Certificates
    • 15.6.1. Signing Certificates
    • 15.6.2. Bootstrapping Certificates
  • 15.7. Network Security
    • 15.7.1. Interface Access
    • 15.7.2. Network Permissions
  • 15.8. GEISA API Security
    • 15.8.1. API Authentication and Encryption
    • 15.8.2. API Access Control and Authorization
• 16. Revision History

[CSNA20]

The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ

[FIPS186]

FIPS 186 Digital Signature Standard (DSS)

[FIPS204]

FIPS 204 Module-Lattice-Based Digital Signature Standard

[IEEE8021AR]

IEEE Standard for Local and metropolitan area networks–Secure Device Identity

[LWM2M]

OMA Lightweight M2M

[LWM2M-Core]

OMA Lightweight Machine to Machine Technical Specification Core 1.2.2

[LWM2M-Transport]

OMA Lightweight Machine to Machine Technical Specification: Transport Bindings 1.2.2

[NIST800-186]

NIST SP 800-186 Recommendations for Discrete Logarithm-based Cryptography: Elliptic Curve Domain Parameters

[RFC2119]

Key words for use in RFCs to Indicate Requirement Levels

[RFC7252]

The Constrained Application Protocol (CoAP)

[RFC9148]

EST-coaps: Enrollment over Secure Transport with the Secure Constrained Application Protocol

[X509]

X.509 : Information technology - Open Systems Interconnection - The Directory: Public-key and attribute certificate frameworks