Changes between Version 35 and Version 36 of TIEDABACDemo

Timestamp:

07/14/09 18:27:54 (15 years ago)

Author:

faber@isi.edu

Comment:

--

TIEDABACDemo

@@ -81 +81 @@
 Now we have two prinicpals granting credentials that grant attributes to principals across domains.  Following the inter-principal connections can be confusing, so the explorer allows users to search the space from a global view.  This shows what authorizations are possible, given the attributes that the explorer knows about.  To activate this feature, the user types an attribute to track in the query window, and the explorer tracks relevant changes.  A sample window showing the results of a query for '''GENI.CTFadmin''' appears below.
 
-[[Image(example3.png)]]
+[[Image(explorer6.png)]]
 
 The query window shows all nodes reachable from the query attibute in a graph with all the arrows' directions reversed, and keeps the display up to date so the user can see the results of changes to the graph.
@@ -97 +97 @@
 In ABAC, this is represented as a linked attribute.  In the explorer, one can create such a linked attribute in a way similar to creating a standard attribute.  Here the GENI principal creates such a rule that allows ACM representatives to designate contestants, all of whom will be granted the CTFaccess attribute.
 
-[[Image(example4.png)]]
+[[Image(explorer7.png)]]
 
 The wording for the credential is a little comples, but it says "Any principal that has a ''P''.'''CTFcontestant''' attribute where ''P'' that has the '''ACM.gamerep''' attribute has the '''GENI.CTFaccess''' attribute, signed GENI".  More simply, the ACM principal can designate representatives by giving them the '''ACM.CTFrep''' attribute; when those representatives give another principal their '''.CTFcontestant''' attribute, the principal with that attribute is given the '''GENI.CFTaccess''' attribute.  ACM representatives can grant access to the slice.
@@ -103 +103 @@
 An advantage of this is that it creates a new administrative group - ACM's game representatives - that can be useful in other contexts. For example, this same group of representatives can designate contestants for other competitions or other attributes relevant to the capture the flag contest without further changes by the ACM.  Delegating through individual ACM attributes would require continuing work by the ACM.
 
-The ACM principal designates representatives by creating the '''ACM.gamerep''' attribute and connecting principals to it.  Below is an example designating the UCLA, USC, and MIT principals as representatives.
-
-[[Image(example5.png)]]
+The ACM principal designates representatives by creating the '''ACM.gamerep''' attribute and connecting principals to it.  The screenshow above includes that a change in the ACM worldview.
 
 == Independent Contestent Administration ==