ISO/IEC 29341-13-10:2008

Overview

ISO/IEC 29341-13-10:2008 - "Information technology - UPnP Device Architecture - Part 13-10: Device Security Device Control Protocol - Device Security Service" defines the UPnP Device Security Service used to protect UPnP SOAP actions. The standard specifies services and message formats that enable strong authentication, authorization, replay prevention, and privacy for communication between UPnP Control Points, Security Consoles and devices in ad-hoc or unmanaged networks (e.g., smart homes, small businesses, public spaces).

Key topics and technical requirements

• Authentication & Authorization
  • Mechanisms for device and client identity management, ownership, and role-based access.
  • Procedures such as TakeOwnership, GrantOwnership, RevokeOwnership to manage device owners and privileges.
• Access Control Lists (ACLs)
  • ACL structures and operations (read, write, add, delete, replace) to control access to device services and actions.
• Certificates & Cryptography
  • Use of certificates, certificate caching, public-key operations and canonical encodings to validate identities and signatures.
  • Guidance for RSA and symmetric algorithms, padding considerations, and secure key handling.
• Session Management
  • Establishment, distribution and expiration of session keys to protect message confidentiality and prevent replay attacks.
  • Actions like SetSessionKeys and ExpireSessionKeys for secure session lifecycle control.
• Message Protection & Replay Prevention
  • Signed and/or encrypted SOAP payloads, sequence numbering, hashing and canonicalization to ensure integrity and freshness.
• Service Modeling & XML
  • XML service description, schema (Device Security Schema) and namespaces for interoperable implementation.
• Supporting Elements
  • State variables, eventing moderation, common error codes, and operational "security ceremonies" for discovery and ownership transfer.

Practical applications & who uses it

• Device manufacturers building UPnP-enabled products (smart TVs, printers, routers, IoT appliances) implement this standard to secure device control interfaces.
• Firmware and embedded systems developers integrate Device Security Service APIs to manage ownership, ACLs, certificates and session keys.
• Smart home platform vendors, integrators and system architects use the standard to ensure secure peer-to-peer connectivity and interoperability.
• Network security engineers and certification testers reference the standard to validate authentication, authorization and message protection behavior.

Related standards

• ISO/IEC 29341 series (UPnP Device Architecture) - parent architecture for pervasive peer-to-peer device connectivity.
• UPnP Device Architecture and SOAP/HTTP specifications used alongside this part for full protocol implementation.

Keywords: ISO/IEC 29341-13-10:2008, UPnP device security, SOAP authentication, ACL, certificates, session keys, IoT security, smart home device security.