Consent and identity management

Overview

First, let's talk about the difference between consent and identity. It is extremely important to know which applications can access or modify devices' data. Applications need to process personal or private enterprise information, but to do so with "legitimate interest" and have a legal basis to handle this information, we need to get consent (authorization) from device owners. Network as Code (NaC) also adopts the privacy-by-design approach and must comply with data protection regulations, for example, the GDPR regulation in Europe and other ones depending on the region. In summary, this means that a device's owner will allow which applications or APIs can access their device. So, consent management is about granting or revoking the access an application has to APIs and their parameters, so that authorized devices can be safely used.

Now, let's suppose your organization already has several identifiers (IDs) assigned to its devices and now they need to be managed or authorized. Identity management literally means handling these different device IDs. This will allow choosing different authorization scopes (API names) for multiple device IDs and organizations. For example, let's say you need consent to query a device's location or modify its network parameters for Quality of Service (QoS). Then, you will need to know if these actions are within the scope authorized for this device ID before performing them. So, an enterprise will define which service or functionality scope can affect its devices through their IDs.

TIP: With NaC SDKs, you can create a Device object, which is a representation of a device's ID. There are multiple ways to identify mobile network devices. Learn more.

Consent-specific terminology

• Scope: Feature or operation that is authorized. It's usually defined by the API name, such as "Location Verification", "Quality-of-service-on-Demand (QoD) sessions", etc. In addition to the API name, the scope may be extended with a specific resource name and/or an allowed action, such as "read" or "write", to limit the access.

  NOTE: The scope names should be from the list of the supported scopes (e.g.: location-retrieval). Please, check the list below.

• Device ID: it can be a phone number or the email-like identifier for the device (or subscriber) into the network. E.g.: 36721601234567, device@testcsp.net, and so on.

• Authorized Party: the private enterprise or organization name, system integrator and so on, which will be authorized to use the devices within the defined scopes. The NaC Administrator ("Admin") will then validate this authorization with the Operator.

• Operator: the owner of a network that can be used through the NaC APIs.

Getting consent in a Business to Business (B2B) scenario

Let's first consider a B2B scenario, in which a farming enterprise owns multiple mobile devices that can be accessed by different organizations and perform different actions. In agriculture, we have many examples of drone applications, such as crop or soil analysis, yield estimation, taking high-quality images, videos or even spraying crops! Since different access types can be granted to different organizations or service providers, this enterprise will need to provide a form listing the different device IDs, API scopes, authorized parties and operators (depending on the area they are located).

Network as Code will make the link to make these actions possible seamlessly. The NaC Admin will validate the form data with the operators on the list and enable different organizations to access their allowed devices and scopes (qod-sessions, location-verification, specialized-network-create, device-status-roaming, etc.).

Submitting an authorization request

Here's how private enterprises can get consent for different devices and authorized parties. In the following document, an organization is authorizing the access of three different enterprises to distinct devices:

• First, download the Nokia Network as Code Consent & Authorization template.

• In the steps below, you will learn how to fill out the Consent & Authorization form.

  NOTE: The Organization Admin needs to send the request via e-mail to support.networkascode@nokia.com

1. At the top-left field, fill in the name details for the authorizing and authorized organizations, as well as the date for the consent to start. For example: If devices are owned by Enterprise 1 and Enterprise 2 will be authorized to access them, you can fill them like so:

   • Legal Name of the Authorizing Organization: Enterprise 1.
   • Authorized Party: Enterprise 2.
   • Date of Consent: 01/06/2024 (The date format is DD/MM/YYYY).

2. Fill the Device column with phone numbers and external identifiers as device IDs.

3. Provide the Scope column only with values described in the scope table below.

4. The Authorized Party column should contain the Organization Name, which is being authorized to have access to the devices. The Organization Name should be exactly as the one listed in your NaC Portal Dashboard / API Hub under the "Organizations" top menu.

5. Provide the Operator name from whom you have the mobile subscription.

6. Fill the Revocation Date with the date your organization wants each consent/authorization to end.

Device	Scope	Authorized Party	Operator	Revocation Date
device1@abc.com	location-verification, location-retrieval	Organization 1	Operator ABC	DD/MM/YYYY
36721601234567	qod-sessions, location-retrieval	Organization 1	Operator ABC	DD/MM/YYYY
device3@abc.com	specialized-network-create, specialized-network-delete	System Integrator 1	Operator ABC	DD/MM/YYYY

Submitting a new request

From time to time, it is necessary to add new devices, authorize new scopes, parties or even delete devices, revoke scopes or authorizations. An Organization Admin can submit a new request whenever necessary and the previous one will be completely cleaned up. This means that the devices that are not included in the new list will lose their authorization and be completely revoked. So, if you want to increase the number of scopes, authorize different parties and device or revoke their authorizations, just submit a new authorization request to Network as Code support e-mail address as described above.

Available scopes

Here are all of the scopes you can include or edit in the authorization request.

Device Status scopes

Scope	Description
device-status-roaming	Get device roaming status
device-status-connectivity	Get device connectivity status

Location scopes

Scope	Description
location-verification	Verify the location
location-retrieval	Get the location of a device

Quality-of-service on Demand scopes

Scope	Description
qod-sessions	Allow all QoD-session operations
qod-sessions-read	Retrieve QoS sessions

Specialized Networks scopes

Scope	Description
specialized-network-read	Get slice information
specialized-network-create	Create a slice
specialized-network-delete	Delete a slice
specialized-network-activate	Activate a slice
specialized-network-deactivate	Deactivate a slice
specialized-network-attach-device	Attach device to a slice
specialized-network-detach-device	Detach a device from a slice

Network Insights

Scope	Description
congestion-insight	Get Congestion Insights on devices

Other scopes

Scope	Description
other	Refer to other desired scopes, which are not listed here