Changes between Version 2 and Version 3 of AuthStoryBoard

Timestamp:

12/06/11 09:55:57 (12 years ago)

Author:

chase@cs.duke.edu

Comment:

--

AuthStoryBoard

@@ -3 +3 @@
 This page is the portal to a series of ppt twitters dealing with GENI's emerging federated authorization system, with a strong dose of advocacy for declarative trust management with automated inference, using a role-based trust delegation logic ("ABAC").  A ppt twitter is a powerpoint deck with a soft limitation of 20 slides.
 
-This space also bears on federation topics that are often intertwined with GENI "control framework architecture".  The various testbeds predating GENI evolved various authorization structures to meet the practical needs of testbed deployments.  One theme of GENI has been retrofitting federation support onto these testbeds, so that we may interconnect them.  At the same time, the project managers have envisioned a system with strong central control and safety restraints, e.g., through a Clearinghouse that bundles various identity and authorization functions.  GENI architects spend a lot of time talking about how to bridge the gaps among various view of how to manage identity and authorize projects and slices in a world of interconnected testbeds.  Similarly, discussions about GENI federation architecture are often dealing with issues of trust policy disguised as architectural questions.
+This space also bears on federation topics that are often intertwined with GENI "control framework architecture".  The various testbeds predating GENI evolved their own authorization structures to meet the practical needs of testbed deployments.  One theme of GENI has been retrofitting federation support onto these testbeds, so that we may interconnect them.  At the same time, some project managers have envisioned a system with strong central control and safety restraints, e.g., through a Clearinghouse that bundles various identity and authorization functions.  GENI architects spend a lot of time talking about how to bridge these gaps in a world of interconnected testbeds.  Similarly, discussions about GENI federation architecture are often dealing with issues of trust policy disguised as architectural questions.
 
-One goal of this work is to disentangle these topics and separate them from questions of control framework architecture.  Once they are separated, we can see that authorization in GENI is an exercise in applying well-understood principles of federated identity, trust management, delegation logic, and role-based trust.  Work on these topics in the decade preceding GENI yielded key research breakthroughs and reasonably mature tools.  GENI can also leverage the large investments in federated identity deployments (Shibboleth, SAML, inCommon).  By applying these early works, we can simplify implementations and free the architects to focus on what is really new in GENI: unified control of diverse virtual infrastructure services.   Discussions of trust policy and governance can go forward separately from these architecture discussions.  
+One goal of this work is to disentangle these topics and separate them from questions of control framework architecture.  Once they are separated, we can see that authorization in GENI is an exercise in applying well-understood principles of federated identity and role-based trust management.  Work on these topics in the decade preceding GENI yielded key research breakthroughs and reasonably mature tools.  GENI can also leverage the large investments in federated identity deployments (Shibboleth, SAML, inCommon).  By applying these other works, we can simplify implementations and free the architects to focus on what is really new in GENI: unified control of diverse virtual infrastructure services.   We can also allow planning of trust policy and governance to go forward separately from the architecture discussions.  
 
  * Background slides on GENI federation architecture