Changes between Version 3 and Version 4 of TIEDABACModel

Timestamp:

07/28/09 14:07:08 (15 years ago)

Author:

mikeryan@isi.edu

Comment:

remove extra word

TIEDABACModel

@@ -23 +23 @@
 In this case, the delegated attribute (GPO GENI user) is delegated to principals who possess a one (or more) of a set of attributes (''P'' GENI user for many ''P'').  That set is defined in terms of an authorizer attribute (NSF PI).  Any principal with the authorizer attribute can assign the delegated attribute by assigning their local version of the delegating attribute (''P'' GENI user where ''P'' has the NSF PI attribute).  This links the authorizer attribute to the delegating attributes, and is often called a linked attribute.
 
-Each of these delegations is expressed as an ABAC credential: an a signed assertion that can be used in a proof.  Because each of these is a signed assertion of a fact or delegation of authority, connecting them in following the rules above corresponds to collecting those signed credentials, which establishes a trust relationship.  ABAC credentials allow principals to negotiate directly about what they consider adequate proof.  Below we show a simple visualization that represents constructing that proof as finding a path between two nodes in a graph; the actual negotiation protocol can be similarly simple.
+Each of these delegations is expressed as an ABAC credential: a signed assertion that can be used in a proof.  Because each of these is a signed assertion of a fact or delegation of authority, connecting them in following the rules above corresponds to collecting those signed credentials, which establishes a trust relationship.  ABAC credentials allow principals to negotiate directly about what they consider adequate proof.  Below we show a simple visualization that represents constructing that proof as finding a path between two nodes in a graph; the actual negotiation protocol can be similarly simple.
 
 Until an authorization decision needs to be made, all of these credentials can be kept locally and brought together to make the decision.  Principals can also pass them around so they are available when needed.  For example, when the NSF designates a PI, it may send that PI the signed attribute so that the PI can use it in authorization requests.