Security

The security mechanisms the MOBI.Hub relies on and how requests from multi-tenant platforms are validated.

The MOBI.Hub Interoperability Hub relies on the security mechanisms defined by the OCPI specification to ensure secure communication between participants. All communications with the platform shall use HTTPS and the corresponding security requirements defined by the underlying infrastructure.

Any additional security policies, namely those related to credential management, authentication and authorization, are defined within the corresponding OCPI modules. The MOBI.Hub platform validates all requests against the OCPI credentials associated with the participant initiating the request.

Multi-tenant platforms

Whenever required, the platform uses the OCPI-from-country-code and OCPI-from-party-id headers to identify the entity on whose behalf the request is being executed. This mechanism is particularly relevant for multi-tenant platforms representing multiple CPOs and/or EMSPs.

For example, when a platform submits a token authorization request on behalf of several CPOs, MOBI.Hub uses the information provided in the OCPI headers to validate the request against the configured interoperability relationships and authorization rules.

A single technical platform may represent one or more entities and roles within the MOBI.Hub ecosystem. In such scenarios:

• a single OCPI credential may be associated with multiple entities;
• the OCPI-from-* headers identify the entity on whose behalf the request is performed;
• MOBI.Hub validates the request against the configured interoperability relationships and authorization matrix.