The unique USP identifier for this USP Agent.
The current USP Agent software version; not the version of the overall
device firmware, which is located in
{{param|.DeviceInfo.SoftwareVersion}}.
To allow version comparisons, this element SHOULD be in the form of
dot-delimited integers, where each successive integer represents a more
minor category of variation. For example, ''3.0.21'' where the
components mean: ''Major.Minor.Build''.
Time in {{units}} since the USP Agent was last restarted (either via a
reset of the software or reboot of the underlying device).
USP Message Transfer Protocols supported by this USP Agent. The USP
Agent MUST support at least one Protocol.
See {{bibref|RFC7252}}.
{{deprecated|2.15|because the CoAP MTP was deprecated in USP
1.2}}
See {{bibref|RFC6455}}
See {{bibref|STOMP1.2}}
See {{bibref|MQTT311}} and {{bibref|MQTT50}}
See {{bibref|TR-369}}
{{list|each entry is an algorithm for calculating firgerprints that is
supported by the Agent}}
As specified in {{bibref|RFC3174}}.
As specified in {{bibref|RFC6234}}.
As specified in {{bibref|RFC6234}}.
As specified in {{bibref|RFC6234}}.
As specified in {{bibref|RFC6234}}.
{{list|each entry is a subtype component of the service type that is
advertised for the device using mDNS as defined in {{bibref|RFC6762}}}}
The acceptable amount of time in {{units}} between the alteration of
the Agent's Subscriptions (e.g. updated subscription, new subscription,
removed subscription, etc.) and the notifications related to those
subscriptions being delivered.
For example, if this parameter is set to 30 {{units}}, then once a
Subscription has been updated, the Agent has 30 {{units}} before it
needs to start delivering notifications based on the updated version of
the Subscription (instead of the old version of the Subscription).
{{numentries}}
{{numentries}}
{{numentries}}
Each instance of this table represents a MTP used by the local Agent.
{{datatype|expand}}
Enable/Disable this {{object}} instance.
If this {{object}} instance is to be disabled and currently used for
communication with the requesting controller, the agent has to send
the request response first, before disabling it.
The current operational state of the {{object}} instance.
Value when this {{object}} instance cannot establish
communication.
Value when this {{object}} instance is misconfigured.
The Message Transport Protocol (MTP) to be used for communications by
a USP Endpoint.
This parameter, when {{true}}, enables the advertisement of DNS-SD
services defined for this {{object}} instance using mDNS as defined
in {{bibref|RFC6762}}.
This parameter cannot be set to {{true}} if there are multiple
{{object}} instances with the same value of the {{param|Protocol}}
parameter.
When {{true}}, the hostname advertised in the SRV record MUST be a
Fully Qualified Domain Name (FQDN).
The interfaces that advertise these DNS-SD services are restriced to
the set of interfaces associated with this {{object}} instance and
the interfaces defined by the
{{param|##.DNS.SD.AdvertisedInterfaces}} parameter.
If the USP Endpoint uses the CoAP Message Transport Protocol (MTP),
then this object contains CoAP specific configuration parameters.
{{deprecated|2.15|because the CoAP MTP was deprecated in USP 1.2}}
{{reference|the {{object|###.IP.Interface}} object instance that this
server will use as its host address to receive USP messages}}
{{empty}} will bind this server to all interfaces for this device.
The port number used by the CoAP Server to receive USP messages.
The path that is used by the CoAP Server in order to receive USP
messages.
This parameter represents whether or not communications that utilize
this {{object}} object instance are encrypted.
{{deprecated|2.14|because the {{param|EnableEncryption}} parameter
will dictate whether all connections to this CoAP server instance are
or are not encrypted}}
{{obsoleted|2.16}}
When {{true}}, encryption MUST be used for this MTP instance.
If the USP Endpoint uses the STOMP Message Transport Protocol (MTP),
then this object contains STOMP Client specific configuration
parameters related to how the Agent communicates with the STOMP Server.
A reference to the STOMP Connection used by this Agent when
communicating via the STOMP MTP.
The STOMP destination where the Agent will be listening to incoming
USP messages.
The STOMP destination contained in the subscribe-dest header of the
CONNECTED STOMP Frame.
If the Agent doesn't receive a subscribe-dest header in the CONNECTED
STOMP Frame, then the value of this Parameter MUST be set to
{{empty}}.
If this parameter's value is not empty then this is the STOMP
destination address for this Agent, but if the value is empty the
{{param|Destination}} Parameter contains the STOMP destination
address for this Agent.
If the USP Endpoint uses the WebSocket Message Transport Protocol (MTP)
as a WebSocket server, then this object contains WebSocket specific
configuration parameters.
{{reference|the {{object|###.IP.Interface}} object instance that this
server will use as its host address to receive USP messages}}
{{empty}} will bind this server to all interfaces for this device.
The port number used by the WebSocket Server to receive USP messages.
The service path that is provided by the WebSocket Server in order to
exchange USP messages. The value MUST be used as defined in
{{bibref|RFC3986|Section 3.3}}.
When {{true}}, encryption MUST be used for all connections to this
MTP instance.
The duration in {{units}} between when WebSocket ping control frames
are transmitted by the Agent's WebSocket server to the Controller's
WebSocket client.
If the USP Endpoint uses the MQTT Message Transport Protocol (MTP),
then this object contains MQTT Client specific configuration parameters
related to how the Agent communicates with the MQTT broker.
A reference to the MQTT Client used by this Agent when communicating
via the MQTT MTP.
The Agent's configured "reply to" topic. When MQTT 5.0 is being used,
this value is put in the PUBLISH Response Topic property for all
PUBLISH packets with a USP Record, if no Response Information (value
recorded in {{param|ResponseTopicDiscovered}}) is included in the
CONNACK. When MQTT 3.1.1 is being used, this value is put at the end
of the PUBLISH Topic Name property (as specified in
{{bibref|TR-369|Section "MQTT Binding"}}. If the value of {{param}}
is not a subset (wildcarded or precise match) of any of the
{{param|Reference}} {{param|.MQTT.Client.{i}.Subscription.{i}.Topic}}
values the Agent MUST subscribe to this Topic. The value MUST NOT
contain any wild card characters (“+”, “#”).
Duplicate of {{param|Reference}}
{{param|.MQTT.Client.{i}.ResponseInformation}}. This is the value of
the CONNACK Response Information property supplied by a MQTT 5.0
server and is used by a MQTT 5.0 client as the basis for the PUBLISH
Response Topic property for all PUBLISH packets that expect a
response. If a value is received from the MQTT 5.0 server, it will be
used instead of any value configured in
{{param|ResponseTopicConfigured}}.
The Agent MUST use this QoS value when sending a USP Record on this
MTP.
If the referenced MQTT Client uses MQTT 5.0 and the MQTT server only
indicates support for a QoS value in the CONNACK Maximum QoS property
lower than this QoS value, the Agent MUST use the highest QoS value
that is supported by the server.
If the USP Endpoint uses the Unix Domain Socket (UDS) Message Transfer
Protocol (MTP), then this object contains UDS Client specific
configuration parameters related to how the Agent communicates with the
UDS Server.
A reference to the Unix Domain Socket used by this Agent when
communicating via the UDS MTP.
Each instance of this table represents a USP Controller that has access
to this USP Agent.
On the deletion of an entry from this table, the Agent MUST send the
ObjectDeletion notification to all subscribed recipients, even if the
recipient is the deleted Controller itself. This notification is the
last notification sent to this Controller.
{{datatype|expand}}
The unique USP identifier for this USP Controller.
Information about the configuration state of an Agent as it pertains
to the {{object}} instance. This is not information related to an
operator's installation or usage of the protocol, that information is
maintained in {{param|ProvisioningCode}}.
This parameter could be used in scenarios where the Controller needs
to perform some kind of initialization or periodic configuration
monitoring. For example, a Controller might perform some initial
configuration of an Agent on first contact (perhaps to configure the
Subscriptions). The Controller could inspect this parameter to
determine the current state of the Agent's configuration, allowing
the Controller to streamline the configuration process.
Identifying information which MAY be used by the {{object}} instance
to determine {{object}} instance specific customization and
provisioning parameters.
Enable/Disable this {{object}} instance.
If the Controller instance is to be disabled, the Agent MUST send the
ValueChange notification to all subscribed recipients, even if the
recipient is the disabled Controller itself. This notification is the
last notification sent to this Controller until it is enabled again.
The USP Endpoint MUST terminate the MTP connection. When {{false}},
messages (notifications) are not sent to the remote endpoint
represented by this {{object}} instance, and any MTP session
establishment are refused.
{{list|each entry is a Role that has been assigned to this {{object}}
instance by means other than the
{{param|#.ControllerTrust.Credential.{i}.Role}} parameter}}
{{list|each entry is a Role that has been assigned to this {{object}}
instance from the {{param|#.ControllerTrust.Credential.{i}.Role}}
parameter associated with the CA credential
({{param|#.ControllerTrust.Credential.{i}.Credential}}) used to
validate the Controller certificate}}
{{nolist}}{{noreference}}
Comma-separated list of strings, the set of certificates from
{{object|#.Certificate.{i}}} that a Controller can present for use in
authenticating the identity of this {{object}} instance.
If a Periodic Event Notification Subscription instance is associated
with this USP Controller, then this is the duration in {{units}} of
the interval for which the USP Agent MUST attempt to issue a Periodic
Notification to the USP Controller.
If a Periodic Event Notification Subscription instance is associated
with this USP Controller, then this is an absolute time reference in
UTC to determine when the USP Agent will issue a Periodic
Notification. Each Periodic Notification MUST occur at this reference
time plus or minus an integer multiple of the
{{param|PeriodicNotifInterval}}.
{{param}} is used only to set the ''phase'' of the Periodic Event
Notifications. The actual value of {{param}} can be arbitrarily far
into the past or future.
For example, if {{param|PeriodicNotifInterval}} is 86400 (a day) and
if {{param}} is set to UTC midnight on some day (in the past,
present, or future) then Periodic Notifications will be sent every
day at UTC midnight. These MUST begin on the very next midnight, even
if {{param}} refers to a day in the future.
The Unknown Time value defined in {{bibref|TR-106|section 3.2}}
indicates that no particular time reference is specified. That is,
the USP Agent MAY locally choose the time reference, and needs only
to adhere to the specified {{param|PeriodicNotifInterval}}.
If absolute time is not available to the USP Agent, its Periodic
Notification behavior MUST be the same as if the {{param}} parameter
was set to the Unknown Time value.
This parameter is related to the retry mechanism for Notifications.
Configures the first retry wait interval, in {{units}}, as specified
in {{bibref|TR-369|Section "Responses to Notifications and
Notification Retry"}}.
A value of 5 corresponds to the default behavior.
The USP Agent MUST use a random value between {{param}} and
({{param}} * {{param|USPNotifRetryIntervalMultiplier}} / 1000) as the
first retry wait interval. Other values in the retry pattern MUST be
calculated using this value as a starting point.
This parameter is related to the retry mechanism for Notifications.
Configures the retry interval multiplier as specified in
{{bibref|TR-369|Section "Responses to Notifications and Notification
Retry"}}.
This value is expressed in units of 0.001. Hence the values of the
multiplier range between 1.000 and 65.535.
A value of 2000 corresponds to the default behavior.
The USP Agent MUST use a random value between
{{param|USPNotifRetryMinimumWaitInterval}} and
({{param|USPNotifRetryMinimumWaitInterval}} * {{param}} / 1000) as
the first retry wait interval. Other values in the retry pattern MUST
be calculated using this value as a starting point.
{{numentries}}
Each instance of this table represents a MTP used by this Controller.
{{datatype|expand}}
Enable/Disable this {{object}} instance.
If this {{object}} instance is to be disabled and currently used for
communication with the requesting controller, the agent has to send
the request response first, before disabling it.
The Message Transport Protocol (MTP) to be used for communications by
a USP Endpoint.
The order (relative priority) to use when determining which
{{object}} to use for communicating to the Controller.
A value of ''1'' indicates the highest precedence. For each
configured {{object}}, the instance with the lowest value is
attempted first.
When more than one {{object}} instance has the same value, then each
instance with the same value SHOULD be attempted at the same time.
The value of {{param}} on creation of a {{object}} table entry MUST
be one greater than the largest current value (initially assigned the
lowest precedence).
If the USP Endpoint uses the CoAP Message Transport Protocol (MTP),
then this object contains CoAP specific configuration parameters.
{{deprecated|2.15|because the CoAP MTP was deprecated in USP 1.2}}
The hostname or IP Address of the Controller's CoAP server.
The port number used by the Controller's CoAP Server to receive USP
messages.
The path that is used by the Controller's CoAP Server in order to
receive USP messages.
When {{true}}, encryption MUST be used as specified in
{{bibref|TR-369|Section "MTP Message Encryption"}}.
If the USP Endpoint uses the STOMP Message Transport Protocol (MTP),
then this object contains STOMP Client specific configuration
parameters related to how this Controller communicates with the STOMP
Server.
A reference to the STOMP Connection used by this Controller when
communicating via the STOMP MTP.
The STOMP destination where the Controller will be listening to
incoming USP messages.
A reference to the USP Service associated with this Agent when
communicating via the STOMP MTP.
If the USP Endpoint uses the WebSocket Message Transport Protocol (MTP)
as a WebSocket client, then this object contains WebSocket specific
configuration parameters.
The hostname or IP Address of the Controller's WebSocket server.
The port number used by the Controller's WebSocket server to receive
USP messages.
The service path that is provided by the Controller's WebSocket
server in order to exchange USP messages. The value MUST be used as
defined in {{bibref|RFC3986|Section 3.3}}.
This parameter represents whether or not communications that utilize
this {{object}} object instance are encrypted.
{{deprecated|2.14|because the {{param|EnableEncryption}} parameter
will dictate whether this {{object}} is or is not encrypted}}
{{obsoleted|2.16}}
When {{true}}, encryption MUST be used for this MTP instance.
The duration in {{units}} between when WebSocket ping control frames
are transmitted by the Agent's WebSocket client to the Controller's
WebSocket server.
The current retry count of the session. When zero (0), the session is
not in a retry state.
Configures the first retry wait interval, in {{units}}, as specified
in {{bibref|TR-369|Section "WebSocket Session Retry"}}.
The USP Agent MUST use a random value between {{param}} and
({{param}} * {{param|SessionRetryIntervalMultiplier}} / 1000) as the
first retry wait interval. Other values in the retry pattern MUST be
calculated using this value as a starting point.
Configures the retry interval multiplier as specified in
{{bibref|TR-369|Section "WebSocket Session Retry"}}.
This value is expressed in units of 0.001. Hence the values of the
multiplier range between 1.000 and 65.535.
The USP Agent MUST use a random value between
{{param|SessionRetryMinimumWaitInterval}} and
({{param|SessionRetryMinimumWaitInterval}} * {{param}} / 1000) as the
first retry wait interval. Other values in the retry pattern MUST be
calculated using this value as a starting point.
A reference to the USP Service associated with this Agent when
communicating via the WebSocket MTP.
If the USP Endpoint uses the MQTT Message Transport Protocol (MTP),
then this object contains MQTT Client specific configuration parameters
related to how this Controller communicates with the MQTT broker.
A reference to the MQTT Client used by this Controller when
communicating via the MQTT MTP.
{{deprecated|2.16|because {{param|AgentMTPReference}} was added}}
The topic name the USP Controller has subscribed to, to be used for
Notify messages send by the USP Agent.
If set to {{true}} the Agent MUST set the RETAIN flag in MQTT PUBLISH
messages carrying a USP Response Message to 1, unless the MQTT server
sent Retain Available = 0 (MQTT 5.0) in its CONNACK (in which case,
the Agent MUST set the RETAIN flag to 0).
If set to {{true}} the Agent MUST set the RETAIN flag in MQTT PUBLISH
messages carrying a USP Notify Message to 1, unless the MQTT server
sent Retain Available = 0 (MQTT 5.0) in its CONNACK (in which case,
the Agent MUST set the RETAIN flag to 0).
{{reference|the {{object|###.MTP.}} object instance containing the
Response Topic used by this Controller when communicating via the
MQTT MTP}}
A reference to the USP Service associated with this Agent when
communicating via the MQTT MTP.
If the USP Endpoint uses the Unix Domain Socket (UDS) Message Transport
Protocol (MTP), then this object contains UDS Client specific
configuration parameters related to how the Controller communicates
with the UDS Server.
A reference to the Unix Domain Socket used by this Agent when
communicating via the UDS MTP.
A reference to the USP Service associated with this Agent when
communicating via the UDS MTP.
Each instance of this table represents information related to a X.509
certificate (see {{bibref|RFC5280}}) of a Controller or Certificate
Authority. Instances are referenced from
{{param|#.Controller.{i}.Credential}} and
{{param|#.ControllerTrust.Credential.{i}.Credential}}.
{{datatype|expand}}
Enable/Disable this {{object}} instance.
The Serial Number field in an X.509 certificate, see
{{bibref|RFC5280}}.
The Issuer field in an X.509 certificate, see {{bibref|RFC5280}};
i.e. the Distinguished Name (DN) of the entity who has signed the
certificate.
This object contains information that an Agent applies when
establishing a trust relationship with a Controller.
{{list|each entry is a Role that is associated with Controllers whose
identity cannot be authenticated. The value of the {{param}}
parameter is appended to the {{param|#.Controller.{i}.AssignedRole}}
parameter}}
In some instances, this policy is set by the Agent and cannot be
modified by Controllers. If the Agent does not allow modification of
this parameter, the Agent MUST respond with an error to the request
to set this parameter.
The Role that is associated with Controllers indicate banned access.
When assigned to a Controller or associated with an entry in the
{{object|Credential}} table, this MUST be the only value of the
{{param}} parameter of the {{param|#.Controller.{i}.AssignedRole}}
parameter.
The Agent SHOULD refuse to accept USP messages from, or send USP
messages to, any Controller that has this Role.
{{list|each entry is a Role that is associated with Controllers to
indicate their access to secured parameters (e.g.
{{param|.WiFi.AccessPoint.{i}.Security.WEPKey}}). The value of the
{{param}} parameter is appended to the
{{param|#.Controller.{i}.AssignedRole}} parameter}}
Only Controllers with a secured role assigned (and the appropriate
permissions set) MUST be able to have access to secured parameters
content.
When {{true}}, Agent has active policy that allows for self-signed
certificates and certificates from unknown Certificate Authorities
(CAs) to be trusted on first use (TOFU).
Inactivity timer in {{units}}.
This timer is started when trust on first use (TOFU) policy is used
to accept a Controller certificate. If no USP Message is received
before this timer elapses, the Agent MUST tear down the MTP
connection and underlying (D)TLS session.
A value of 0 means that the TOFU inactivity timer is effectively
disabled.
{{numentries}}
{{numentries}}
{{numentries}}
Each instance of this table represents a Role that can be assigned to
or inherited by a Controller via the Controller Trust mechanism. The
Role contains a set of permissions that determine how the Controller
can interact with the data model.
If multiple permission entries associated with this table contain a
Target that evaluates to the same instantiated Object/Parameter for
multiple Roles, then the permissions to be used are a union of the
identified permissions.
{{datatype|expand}}
Enable/Disable this {{object}} instance.
The Role assigned to this {{object}} instance.
{{numentries}}
Each instance of this table represents the permissions that are
extended to a set of Targets for a specified Role.
If there are multiple entries in this table for a specific Role where
the Targets overlap, the permissions for the entry with the highest
value takes priority over all others.
{{datatype|expand}}
Enable/Disable this {{object}} instance.
The order (relative priority) to use when determining the permissions
for overlapping Targets that are contained within the same
{{object|#.}}.
The larger value of this parameter takes priority over a permission
with a smaller value (i.e., 0 has the lowest priority).
{{list|each entry is a target to which the value of the permissions
parameters are assigned}}
When an entry is a value of a Partial Path, the permissions are
associated to that Object and any child Object/Parameter.
When the value of an entry is an Object instance then the permissions
are associated to all Parameters of the Object instance.
When an entry is a value of a Search Path as defined in
{{bibref|TR-369}} that resolves to zero or more Parameter Paths, then
all Parameter Paths that result from the evaluation of the Search
Path are subject to the permissions assigned by this {{object}}
instance.
The permissions of a Role for the specified Targets.
A string of 4 characters where each character represents a permission
("r" for Read, "w" for Write, "x" for Execute", and "n" for Notify).
The string is always in the same order (rwxn) and the lack of a
permission is signified by a "-" character (e.g., r--n).
The following describes the meaning of the permissions for Parameter
type of Targets:
# Read: Grants the capability to read the value of the Parameter via
Get and read the meta-information of the Parameter via
GetSupportedDM.
# Write: Grants the capability to update the value of the Parameter
via Add or Set.
# Execute: Grants no capabilities; Parameters can not be executed.
# Notify: Grants the capability to receive Notify Messages of type
ValueChange for this Parameter.
The permissions of a Role for the specified Targets.
A string of 4 characters where each character represents a permission
("r" for Read, "w" for Write, "x" for Execute", and "n" for Notify).
The string is always in the same order (rwxn) and the lack of a
permission is signified by a "-" character (e.g., r--n).
The following describes the meaning of the permissions for Object
type of Targets:
# Read: Grants the capability to read the meta-information of the
Object via GetSupportedDM.
# Write: Grants no capabilities for Static Objects. Grants the
capability to create a new instance of a Multi-Instanced Object via
Add (e.g. Device.LocalAgent.Controller.).
# Execute: Grants no capabilities; Objects are not executable and
Commands are controlled by the CommandEventPermissions.
# Notify: Grants the capability to receive Notify Messages of type
ObjectCreation for this Object (multi-instance objects only).
The permissions of a Role for the specified Targets.
A string of 4 characters where each character represents a permission
("r" for Read, "w" for Write, "x" for Execute", and "n" for Notify).
The string is always in the same order (rwxn) and the lack of a
permission is signified by a "-" character (e.g., r--n).
The following describes the meaning of the permissions for
Instantiated Object type of Targets:
# Read: Grants the capability to read the instance numbers and unique
keys of the Instantiated Object via GetInstances and read the value
of Parameters related to the Instantiated Object via a Get
containing a search expression or wildcard in place of the instance
identifier.
# Write: Grants the capability to remove an existing instance of an
Instantiated Object via Delete (e.g.
Device.LocalAgent.Controller.1.).
# Execute: Grants no capabilities; Object Instances are not
executable and Commands are controlled by the
CommandEventPermissions.
# Notify: Grants the capability to receive Notify Messages of type
ObjectDeletion for this Instantiated Object.
The permissions of a Role for the specified Targets.
A string of 4 characters where each character represents a permission
("r" for Read, "w" for Write, "x" for Execute", and "n" for Notify).
The string is always in the same order (rwxn) and the lack of a
permission is signified by a "-" character (e.g., r--n).
The following describes the meaning of the permissions for Command
and Event type of Targets:
# Read: Grants the capability to read the meta-information of the
Command (including input and output arguments) and Event (including
arguments) via GetSupportedDM.
# Write: Grants no capabilities; Commands are executed instead of
written to and Events are read only.
# Execute: Grants the capability to execute the Command via Operate,
but grants no capabilities to an Event.
# Notify: Grants the capability to receive Notify Messages of type
OperationComplete for this Event or Command.
Each instance of this table represents a trusted credential. The
credential can be that of a certificate authority (CA) for a Controller
whose EndpointID is unknown.
When a credential is supplied to the Agent by a Controller during
authentication, the credentials in this table are used to determine if
any of the supplied certificates (including those in the chain of
trust) are considered "trusted".
If the Controller authenticated via an entry in this table is not
previously known to the Agent, the associated Role entry is
automatically applied to the Controller.
{{datatype|expand}}
Enable/Disable this {{object}} instance.
{{nolist}}
Comma-separated list of strings, the (set of) Role(s) applied to a
Controller authenticated through this {{object}} instance.
The roles are added to the Controller's current list of Roles by
replacing the value of the {{param|##.Controller.{i}.InheritedRole}}
parameter.
If the Controller is already known to the Agent, with an associated
Role, this parameter has no impact.
A reference to the {{object|##.Certificate.{i}}} instance for use in
the authentication of certificates provided by a Controller and
authorization of Controllers, and for authentication of certificates
used for MTP encryption.
Identifies what usages the Certificate Authority (CA) authenticated
by the associated credential is trusted to authorize.
The CA can only authorize MTP (domain) connectivity, and cannot
authenticate Controllers.
The CA can authorize MTP (domain) connectivity and authenticate
Controllers.
The CA can authorize MTP (domain) connectivity and the
presenter of this certificate is trusted to have authenticated
the identity of Endpoints whose Records it transmits such that
the from_id can be trusted without additional authentication.
See {{bibref|TR-369|"Authentication and Authorization"}} for
additional description of the Trusted Broker function.
Each instance of this table represents information that is used to
challenge a Controller in order to assign a Role to the Controller or
to determine the authenticity of a Certificate.
The Controller requests a type of challenge from an Agent using the
RequestChallenge command.
The Agent returns the value of the {{param|Instruction}} for that type
of challenge to the Controller which the Controller then provides a
third-party.
The third-party responds to the Instruction which the Controller then
sends to the Agent using the ChallengeResponse command.
The Agent verifies the response to the Challenges and executes an
implementation specific Agent logic in order to establish trust with
the Controller.
This could include (but is not limited to):
*Assignment of roles to the Controller is done by appending the
non-duplicate roles of the {{param|Role}} parameter to the value of
the {{param|##.Controller.{i}.AssignedRole}} parameter.
*Use the Controller's certificate to which the challenge response was
received in order to authenticate the identity of the Controller.
{{datatype|expand}}
The description of this {{object}} instance.
{{nolist}}
Comma-separated list of strings, the (set of) role(s) appended
(non-duplicate values only) to the value of the
{{param|##.Controller.{i}.AssignedRole}} parameter.
Enable/Disable this {{object}} instance.
The type of challenge that will be verified from the challenge
response provided by the third-party through the Controller.
The challenge uses a passphrase the third-party is expected to
match.
The value of the challenge that is specific to the type of challenge.
The media type with a format as defined by {{bibref|RFC6838}} of the
content of the {{param|Value}} parameter.
The instruction that is provided to the external party by the
Controller requesting the challenge.
The media type with a format as defined by {{bibref|RFC6838}} of the
content of the {{param|Instruction}} parameter.
The number of consecutive failed {{template|USP-CHALLENGE-RESPONSE}}
attempts against this {{object}} instance (as determined by the
{{template|USP-REQUEST-CHALLENGE}}.ChallengeRef associated with
{{template|USP-CHALLENGE-RESPONSE}}.ChallengeID parameters) that are
allowed before a {{param|LockoutPeriod}} is started for this
{{object}} instance. Counts of failed attempts for a {{object}}
instance are reset after a successful
{{template|USP-CHALLENGE-RESPONSE}} for the {{object}} instance or
after a started {{param|LockoutPeriod}} expires.
Once the {{param|Retries}} value has been reached by failed
{{template|USP-CHALLENGE-RESPONSE}} attempts against this {{object}}
instance (as determined by the
{{template|USP-REQUEST-CHALLENGE}}.ChallengeRef associated with
{{template|USP-CHALLENGE-RESPONSE}}.ChallengeID parameters), the
value of this parameter represents the amount of time (in {{units}})
that the Agent will prevent any {{template|USP-CHALLENGE-RESPONSE}}
or {{template|USP-REQUEST-CHALLENGE}} against this {{object}}
instance from succeeding. Any attempt to issue a
{{template|USP-REQUEST-CHALLENGE}} or
{{template|USP-CHALLENGE-RESPONSE}} command where the associated
{{template|USP-REQUEST-CHALLENGE}}.ChallengeRef points to this
{{object}} instance during the lockout period will result in an Error
response with 7002 as the error code. When a started lockout period
has expired, the count of failed attempts for this {{object}}
instance will be reset. If the Agent chooses to delete
{{template|USP-CHALLENGE-RESPONSE}}.ChallengeID values for a locked
out {{object}}, the Agent can send the 7004 error code for values it
does not recognize.
A value of zero means that a lockout period doesn't apply and the
{{template|USP-REQUEST-CHALLENGE}} command can be attempted without
the need to wait between failed challenges.