The following material represents the culmination of months of collaboration among industry experts to develop an interoperable and extensible authorization capability for Green Button Connect My Data (CMD). The architecture described integrates NAESB's "REQ.21 Energy Services Provider Interface" (ESPI), IETF's "The OAuth 2.0 Authorization Framework" [RFC 6749], and "The OAuth 2.0 Authorization Framework: Bearer Token Usage" [RFC 6750] standards. This solution responds to customer requirements by leveraging the strengths of each of these standards to achieve a robust, secure, and interoperable authorization scheme for Green Button Connect My Data.
The following diagram depicts the logical components of both Green Button Download My Data (DMD) and Green Button Connect My Data (CMD). The names and roles of the actors (Data Custodian, Third Party, and Retail Customer) are described in the "Green Button Terms" table..
Green Button Download My Data (DMD) represents the access of Energy Usage Information (EUI) by a Retail Customer from a Data Custodian (typically a utility) via a web browser through the Data Custodian's web portal. This access results in a file containing the Retail Customer's Energy Usage Information being downloaded to their computer for future use. The red arrows in the diagram show the DMD flow.
Green Button Connect My Data (CMD) enables a Retail Customer to "authorize" a service provider (Third Party) to access their Energy Usage Information directly from the Data Custodian without further interaction by the Retail Customer. The blue arrows in the diagram show CMD required authorization mechanisms.
The "One-time Authorization", depicted by the blue arrows, involves an exchange of information between the Data Custodian and Third Party systems. The data exchange occurs through web browser redirection and is initiated by a Retail Customer accessing either their Data Custodian or a Third Party service provider via a web browser. Although the redirection is performed by the web browser, to ensure security of the data being exchanged, all redirection is achieved without the information being shown to the Retail Customer,
The ESPI and OAuth 2.0 Authorization Framework standardize the information that must flow between the Data Custodian and Third Party. However, the method used by both parties to authenticate a Retail Customer, as well as other interactions between the Retail Customer and either the Data Custodian or Third Party web portals are left up to each provider to determine.
