# Secure Service Proxy: A CoAP(s) Intermediary for a Securer and Smarter Web of Things
## 4 The Secure Service Proxy
### Secure Service Proxy: Implementation
#### 4.3.3. Adapter Chain Management: Interface  
Once an endpoint for a virtual host has been allocated on the proxy, adapter chains can be created and hosted on that endpoint. Building on our previous example, the listing below contains a CoAP request that instantiates an adapter chain, which contains the access control, well-known core rewriting, caching and forward CoAPs proxy adapters. Again, the payload is a JSON object that describes the chain and contains the parameters for the different adapter instances. The adapter chain is created as the default chain via the wildcard character in the chain path. The default chain is executed for requests where no other adapter chains with a matching URI path are found. ``` POST/virtualDevices/2001:6a8:ld80:23::1^128^5684 Content-Formatapplication/json { \"path\": \"/*\", \"pipeline\": {  \"type\": \"acl\",  \"default_access_control_policy\": \"demy\",  \"rules\": {  \"username\": \"fvdabeele\", \"rules\": [{\"uri-regex\": \"regex1\", \"allowMethods\":[\"*\"]},  {\"uri-regex\": \"regex2\", \"allowMethods\":[\"GET\"]})},  {\"username\": \"*\". \"rules\": [{\"uri-regex\": \"regex1\", \"demyMethods\":[\"*\"]},  {\"uri-regex\": \"regex2\", \"allowMethods\":[\"GET\"]}}  },  {  \"type\": \"wkc\"  },  {  \"type\": \"cache\",  \"default_lifetime\": 60  },  {  \"type\": \"proxy\",\"scheme\": \"coaps\", \"addr\": \"bubbles::\", \"port\": 5684 ) ]
2.01 Created /virtualDevices/2001:688:1d80:23::1\"128\"5684/*

The second example, shown in the listing below, details how a static resource is created on the endpoint of our virtual host (in this case, it contains a semantic description of the virtual host in the RDF format). The chain also illustrates the linked adapter, which refers to the ACL adapter instance that was created in the previous listing. The link points to the management resource of the adapter instance. POST /virtualDevices/2001:688:1d80:23::1\"128\"5684 Content-Format: application/json { \"path\": \"/rdf\", \"pipeline\": [ {  \"type\": \"linkeddapter\", \"link\": \"virtualDevices/2001:688:1d80:23::1\"128\"5684/*/0\"  } {  \"type\": \"static\", \"contentType\": 41,  \"value\": \"PGD0d......\"  } } }
2.01 Created /virtualDevices/2001:688:1d80:23::1\"128\"5684/rdf

Finally, note that the parameters of existing adapters can be updated via a PUT request to the management resource of the adapter instance. In this case, the payload is a JSON object where the keys are the parameter names. Likewise, adapters and chains can be deleted via their respective management resources. #### 4.3.4 Authenticating (D)TLS Clients on the SSP

In order to facilitate the authentication of users and the authorization of user actions, the SSP links client authentication information (e.g., TLS PSK or X.509 client certificate) with users and roles. The current implementation is limited to using TLS primitives for supplying authentication credentials, although in the future, alternatives might be considered (e.g., lightweight application-layer access tokens). For example, a (D)TLS session that was setup with \(PSK_{1}\) as the pre-shared key can be linked with \(user_{A}\). Likewise, attributes in a client X.509 certificate that is signed by a party trusted by the SSP can be linked with a specific user, e.g., a certificate issued by \(CA_{A}\) with the common name attribute set to _fodabeele_ can be linked with \(user_{B}\). Finally, the proxy also exposes a RESTful interface for managing which credentials belong to which user and the roles of users. #### 4.3.5 Key Management between SSP and Constrained Devices

The SSP contains an in-memory repository of pre-shared keys and corresponding identity hints in order to setup DTLS sessions with resource-constrained CoAPs servers. As this repository contains all of the keying material for the constrained devices known to the proxy, it contains sensitive information and should be handled accordingly. In the current implementation, this repository is initialized when the SSP process is started.