Changes between Version 1 and Version 2 of TIEDCredentials

Timestamp:

04/18/13 20:42:20 (11 years ago)

Author:

faber@isi.edu

Comment:

--

TIEDCredentials

@@ -18 +18 @@
 == GENI "privilege" credentials ==
 
-The only type of GENI credential currently in use is the "privilege" credential.  This credential assigns a principal (called the owner) one or more privileges with respect to another principal (called the target).  The privileges are strings meaningful to the implementation.  There is also a bit that allows delegation of the privilege.
+The only type of GENI credential currently in use is the "privilege" credential.  This credential assigns a principal (called the owner) one or more privileges with respect to another principal (called the target).  The credential has an implicit issuer, the signer of the credential.  The privileges are strings meaningful to the implementation.  There is also a bit that allows delegation of the privilege.  This section describes how to represent the semantics of the GENI credentials in ABAC statements.  Libabac will import a GENI credential into ABAC statements internally and use those statements to make authorization decisions; the AM (relying party) will import the credentials and policy into libabac and ask libabac for the authorization decision.
 
-This directly translates into one or more ABAC statements that include the owner in the target's privilege set.  Said another way, the target gives owner the privilege attribute defined by the string.  In ABAC RT0 notation: {{{Target.privilege <- Owner}}} for each privilege in the credential.
+The AM is trying to prove that the Owner who is asking to exercise a privilege on Target is authorized with respect to the AM. 
+
+Each GENI credential directly translates into one or more ABAC statements. In the simplest case, each of these statements assigns the owner a privilege with respect to the Target according to the issuer. In ABAC RT1 notation this is 
+
+{{{
+Issuer.privilege(Target) <- Owner
+}}} 
+
+for each privilege in the credential.  This can be expressed in [http://groups.geni.net/geni/attachment/wiki/GEC11Authorization/chase-abac-gec11.ppt "RT0 lite"] as:
+
+{{{
+Issuer.privilege_Target <- Owner
+}}} 
 
 
+Each privilege has a flag indicating whether the owner can further delegate the privilege to others by creating a similar credential and signing it.  The new credential includes the credential that is the basis for delegation in the new credential's parent element.  This recurses.  
 
+Encoding these in ABAC is accomplished in two ways: 
+ * the right to delegate is encoded in an ABAC credential
+ * the rules for valid delagation (that the delegator must have the privilege and the right to delegate) is expressed in the AM policies.
+
+An undelegated credential that can be delegated expands into ABAC statements of the form:
+
+{{{
+Issuer.privilege_Target <- Owner
+Issuer.can_delegete_privilege_Target <- Owner
+}}}
+
+An
+
+{{{
+Issuer.privilege_Target <- Issuer.can_delegate
+
+