SNIP_ADAPTIVE_CAN_FIGURE_Figure_7_10

Figure 7.10: Local and Remote Identity and Access Management The following assumption has to be held true to realize access control: 1. Communication between two applications has to be realized by using ara::com interfaces Communication Management to enable access control. All access permissions for Communication Management are modeled using ComGrant model elements. A ComGrant can be used to model access permissions that either apply to a Machine-local Process or to a remote subject, i.e., either a local Process or a remote entity can be the subject of the access control policy: If a ComGrant references an AbstractIamRemoteSubject in the role remoteSubject, then the subjects of the ComGrant are all remote entities that can be identified using the information specified in the referenced AbstractIamRemoteSubject. If a ComGrant does not reference any remoteSubject, then the subjects of the ComGrant are all Processes referenced in the role process by ServiceInstanceToPortPrototypeMappings which reference an AdaptivePlatformServiceInstance in the role serviceInstance that is referenced by the ComGrant in the role serviceInstance. Local access control and remote access control may be enforced independently from each other.