Re: Avoiding IBAC

With the PubShare VOC system I described earlier, no ACLs are required. 

One of the ways we describe "authorization based access control"(ZBAC), as distinguished from "authentication based access control" is that, with ZBAC, we do indeed still do authentication, but we do it only at the time of the grant. Once the grant is made, when you go to access the resource, the resource does not care about authentication because it already has the authorization.

So, it is worth asking, in PubShare, how do we do the authentication at the time of the grant? PubShare simply sends the webkey out to the email address, so the question is, where is the authentication hidden? The answer, of course, is implicit in the email address: in a typical email system the owner authenticates himself to the email server before he can get his email. In effect, PubShare outsources authentication to the email server. Since email crosses admin domains transparently, PubShare also crosses admin domains transparently, which ACLs do not. 

You can build an email system that is ZBAC-based as well, of course (indeed, we have done so). In this case, the authentication step is pushed even further out of the way, it occurs when the user and his email account are introduced, by whatever means that occurs. In SCoopFS, which had peer-to-peer mail service, that introduction occurred when the user created his mail-serving peer. Introductions across mail serving peers was done with an exchange of webkeys, in which the authentication step was as likely to be done person-to-person, with the people doing authentication of each other using facial recognition, as any other way, though one could also bootstrap via an existing email system as well.

--marcs

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Neal H. Walfield
Sent: Wednesday, October 15, 2014 7:14 AM
To: General discussions concerning capability systems.
Subject: Re: [cap-talk] Avoiding IBAC

Hi, Marc, Alan,

Thanks for your comments!  I haven't looked at the video yet, but I hope to soon.

One more question:

Based on your description, it seems that the system needs ACLs to describe the desired policies.  When Alice grants Bob access to a file, the system needs to check whether Bob is authorized.  So, for HR-only documents, the administrator needs to add an ACL to the relevant files (or filter) that says HR can access these files.  Or, is there a way to do this using capabilities?

Thanks,

Neal
_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk