Sensor Alert Service SAS Summary

Copyright © 2009 Open Geospatial Consortium, Inc. 33 DescribeResultModel Valid XML Valid XML POST GetFeatureOfInterest Valid XML GML POST GetFeatureOfInterestType Valid XML GML POST DescribeObservationType Valid XML Valid XML POST DescribeFeatureType Valid XML Valid XML POST RegisterSensor TML or SensorML + OM document Valid XML POST InsertObservation OM Valid XML POST Table 3 – SOS operation summary : Mandatory for transaction profile : plus an OM instance template document from previous GetObservation Summary: All operations can be invoked by a valid XML request and return a valid XML document using the HTTP POST binding and leverage the requestresponse communication pattern.

9.3.4 Sensor Alert Service SAS

Operation name Input encoding Output encoding HTTP Binding GetCapabilities KVP or Valid XML Valid XML GET or POST Advertise Valid XML Valid XML POST RenewAdvertisement Valid XML Valid XML POST CancelAdvertisement Valid XML Valid XML POST Subscribe Valid XML Valid XML POST RenewSubscription Valid XML Valid XML POST CancelSubscription Valid XML Valid XML POST Table 4 – SAS operation summary : Contains XMPP MUC URI 34 Copyright © 2009 Open Geospatial Consortium, Inc. Summary: All operations can be invoked by a valid XML request and return a valid XML document using the HTTP POST binding and leverage the requestresponse communication pattern. Remark: The actual notification of alerts is operated via XMPP using the MUC URI provided by SAS. Even though XMPP supports user authentication, it is unclear how the user and the sensor get the appropriate login information.

9.3.5 Summary

After we have given the condensed service interface summary focusing on input and output encoding as well as service endpoint binding, it becomes clear that the security implementations need to obey the Sensor Web Services specific limitations. Important for introducing a security concept for Sensor Web Services based on message level security is that HTTPGet binding is only applicable to the GetCapabilities operation and that all other operations operate on XML requestresponse messages that can be validated against XML schemata. However, it is not possible to apply message level security to the service interfaces directly, as outlined in a later section. It is also important to note that the SOS operates on the requestresponse and notification communication pattern with XML structured messages for in- and output. But the SAS outsources the notification functionality to an XMPP infrastructure.

9.4 Vulnerabilities and Attacks for the Baseline Services