8 Ticket Syntax

8.1 Signed Ticket Encoding

All Tickets (see 8.2.3 and 8.2.4) are encoded as JSON documents. These JSON documents secured with digital signature applied to the general serialization described by RFC 7515. The structure of an RFC 7515 document is as follows.

     {
      "payload":"BASE64URL(UTF8(JSON encoded Ticket))",
      "signatures":[
       {"protected":"BASE64URL(UTF8(JSON encoded protected header))",
        "header": JSON encoded header,
        "signature":" BASE64URL(JWS Signature)"},
       ...
       {"protected":"BASE64URL(UTF8(JSON encoded protected header))",
        "header": JSON encoded header,
        "signature":" BASE64URL(JWS Signature)"}]
     }

Appendix A.6 in RFC 7515 provides an example of a document encoding using this structure.

The BASE64URL transform which allows binary data (e.g., UTF-8 encoded text) to be represented as ASCII.

The Ticket is encoded as a JSON object using the reversible JSON encoding defined in OPC 10000-6. This JSON object is converted to an UTF-8 byte array and then BASE64URL before being added to the document.

The protected header specifies the signing Certificate and other information needed to verify the Signature. The required fields are defined in Table 5.

The unprotected header is generally not used; however, it could be used for additional vendor specific information such as a RFC 3161 timestamp or other anti-forgery or validation metadata.

A Signature is computed on the following byte array:

	<protected header>.<payload>

Tickets may have additional signatures added by any actor in the supply chain. For example, a CompositeBuilder shall add Signatures to all Tickets for Devices incorporated into the Composite. The protected header shall have the CompositeInstanceUri.

The Certificate and algorithms used to create the payload Signature are the same as the Certificate and algorithms used to create the RFC 7515 Signature. The RFC 7515 header provides the information needed to calculate the size of payload Signature.

The subtype is "opc-ticket+json".

	opc-ticket+json;type=DeviceIdentityTicketType

8.2 Ticket Types

8.2.1 EncodedTicket

The EncodedTicket is a simple DataType representing a JSON encoded Ticket.

Its representation in the AddressSpace is defined in Table 8.

8.2.2 BaseTicketType

The BaseTicketType is an abstract base class for a Ticket.

The fields of this DataType are defined in Table 7.

Its representation in the AddressSpace is defined in Table 8.

8.2.3 DeviceIdentityTicketType

The DeviceIdentityTicketType describes a single Device produced by a Manufacturer.

The fields of this DataType are defined in Table 9.

Its representation in the AddressSpace is defined in Table 10.

8.2.4 CompositeIdentityTicketType

The CompositeIdentityTicketType describes a single Composite produced by a CompositeBuilder.

The fields of this DataType are defined in Table 11.

Its representation in the AddressSpace is defined in Table 12.

8.2.5 TicketListType

The TicketListType describes a list of Devices and Composites which are part of a shipment from one organization to another.

The fields of this DataType are defined in Table 13.

Its representation in the AddressSpace is defined in Table 14.

8.2.6 CertificateAuthorityType

The CertificateAuthorityType describes a Certificate Authority (CA) used to issue Certificates to Devices, Composites or to organizations that create Tickets.

The fields of this DataType are defined in Table 15.

Its representation in the AddressSpace is defined in Table 16.