Changes between Version 21 and Version 22 of TIEDABACDemo

Timestamp:

07/12/09 21:56:18 (15 years ago)

Author:

faber@isi.edu

Comment:

--

TIEDABACDemo

@@ -37 +37 @@
 == Assigning Attributes to Principals Directly (local GENI administrator) ==
 
-In order to assign that attribute to a principal using the explorer, one connects the principal representation (an ellipse with that prinicpal's name in it) to the attribute in question.  The following shows the '''BBNAdmin''' principal being assigned the '''GENI.CTFAdmin''' attribute.
+In order to assign that attribute to a principal using the explorer, one connects the principal representation (an ellipse with that prinicpal's name in it) to the attribute in question.  The following shows the '''BBNAdmin''' principal being assigned the '''GENI.CTFadmin''' attribute.
 
 [[Image(example0.png)]]
@@ -48 +48 @@
 
 [[Image(example13.png)]]
+
+Drawing that line creates a credential that says "Any principal that has the GENI.CTFadmin attribute has the GENI.CTFaccess attribute, signed GENI".  Notice that only the GENI principal can create such a credential: it controls the GENI.CTFaccess attribute, and any assignment of that attribute must be done by the controlling prinicpal.  
+
+Any attribute reachable by following edges from principal to attribute is possessed by that principal.  Now the '''BBNAdmin''' principal has both the '''GENI.CTFadmin''' and '''GENI.CTFaccess''' attributes.
+
+== Delegating Administration to ACM ==
+
+At this point the GENI principal has placed a principal in a position to configure and access the contest slice in case of trouble, but the rest of the access control is to be the business of the ACM principal.  Delegating this authority is again expressed by relating two attributes, one controlled by the GENI principal and one by the ACM principal.
+
+In the explorer the GENI user creates an attribute named ACM.CTFofficial and draws an arrow from it to GENI.CFTaccess.  Note that the GENI user cannot draw lines into the ACM.CTFofficial attribute, because that attribute is controlled by ACM, but it can delegate control of its own '''GENI.CFTadmin''' attribute.
+
+[[Image(example1.png)]]
+
+Like all drawn arrows, this represents a credential; that credential says "any principal having the ACM.CTFofficial attribute has the GENI.CTFadmin attribute, signed the GENI principal."  Because the GENI principal cannot control how the '''ACM.CTFofficial''' is administered by the ACM principal (or even that such an attribute exists) this is a delegation of power.
+
+
 
 === ABAC Encoding (simple delegation) ===