diff --git a/spec/VISSv2_Core.html b/spec/VISSv2_Core.html index 57db68e..79227a4 100644 --- a/spec/VISSv2_Core.html +++ b/spec/VISSv2_Core.html @@ -207,8 +207,10 @@
The client may have to issue several requests before an access token can be obtained, even in the case of having a valid access grant token.
- The reason for this is that if a consent is required, the ATS will forward the consent request to the External Consent Framework,
- and it is likely that there will not be an immediate response from the ECF.
+ The reason for this is that if consent is required, the ATS will forward the consent request to the External Consent Framework,
+ and it is likely that there will not be an immediate response from the ECF.
The ATS will then on the initial access token request respond to the client with a session handle that the client must use in subsequent requests for the access token.
- When the ATS has obtained a consent reply from the ECF it can in the thereafter following client inquiry request in the case of a positive consent
+ When the ATS has obtained a consent reply from the ECF it can thereafter following client inquiry request in the case of a positive consent
respond with the access token, or in the case of a negative consent respond with only the negative consent result.
Access Token Response To Initial Access Token Request
an immediate response is not possible, and the response to an initial access token request shall contain the parameter:
There are three different responses possible to an inquiry access token request.
- In the case that there is still no consent reply availablefrom the ECF, the response is identical to the response to the initial access token response, see above.
- In the case that there is a negative consent reply from the ECF, the response shall contain the parameter:
+ In the case that there is still no consent reply available from the ECF, the response is identical to the response to the initial access token response, see above.
+ In the case that there is a negative consent reply from the ECF, the response shall contain the parameter:
Handling of consent involves vehicle and cloud architectural subsystems that is out of scope in VISSv2.
However, a VISSv2 vehicle server has a capability to enforce consent results, i. e. to allow or block access to requested data.
- This can be leveraged in a model where the server receives consent results from an “External Consent Framework” (ECF) and uses that information to either grant client requests,
- or not, for data that is consent protected. How the ECF obtains the consent status is out-of-scope in this specification.
- A secure, local communication channel exists between the in-vehicle ECF and the server as shown in the figure below,
+ This can be leveraged in a model where the server receives consent results from an ECF and uses that information to either grant client requests,
+ or not, for data that is consent protected. How the ECF obtains the consent status is out-of-scope in this specification.
+ A secure, local communication channel exists between the in-vehicle ECF and the server as shown in the figure below,
over which the server can inquire about the consent status for data requested by a client.
- The ECF is responsible for the lifetime management of the consent status for all data that is managed by the server, which may involve initialization,
+ The ECF is responsible for the lifetime management of the consent status for all data that is managed by the server, which may involve initialization,
event based update, consent status removal.
The consent status can be set to any of the following values:
- A server receiving a client request that involves obtaining a consent status shall send a request to the ECF + A server receiving a client request that involves obtaining a consent status shall send a request to the ECF on which it shall receive a response cintaining the consent status. The request shall contain the data from the list in the previous chapter.