scope:

This service is offered by a Security Console (SC). The Security Console offers a user interface for administration of access control on security-aware UPnP devices. [See DeviceSecurity:1 for a description of the actions used in the creation and editing of Access Control Lists (ACLs) and in taking security ownership of Devices.] As a device the Security Console is self-owned. If it has any access controlled actions, then those are to be administered by the human user and not by some other Security Console. Therefore, a Security Console does not need to include a DeviceSecurity service. It does have a certificate cache, but it is an outgoing cache, rather than an incoming cache. A network built of the user's own components with no connection to anything outside the user's personal domain and with no control points belonging to anyone other than the user ever attached to the network would not require the features of UPnP Security. Network isolation would already have achieved a level of physical security. We are concerned in UPnP Security with networks in which more than the user's own Control Points are present on the physical network and able to reach the user's Devices with control messages. These situations can include: